ePHI is defined as “identifiable demographic and other information relating to the past, present or future physical or mental health or condition of an individual.”
HIPAA HITECH CYBERSECURITY CHALLENGE
Reputation is the new target for cyber attacks
- Criminals value information – financial, health, critical infrastructure
- Data Breaches in Healthcare totaled over 112 Million Records in 2015
- Breaches cost the healthcare industry about $5.6 billion annually
The safeguarding of electronic protected health information (EPHI) is legal mandate. Specific actions to ensure HIPAA compliance include Risk Analysis/Assessment process to enforce HIPAA Security Rule. Some key examples that Cavirin adhere's to through automation are highlighted below:
Identifying information assets. Cavirin allows for a deep discovery over the infrastructure inventory of electronic information assets, including native tagging to assign permanent methods for continued tracking of electronic Protected Health Information (ePHI). Enforcing native tags to those assets allows special attention to for compliance handling as well as highlight these items for any compliance reviews performed by CalOHII or audits by the Office for Civil Rights (OCR). (Read about AWS Tags)- Assessing the current realm of threats and vulnerabilities that could put information assets at risk. For the purpose of those identified and tagged assets, Cavirin's ARAP enables evidence of your efforts to ensure their assessment review via communicated reports. These scheduled assessments cover responsibility to gather and respond to potential threats.
- Evaluating the current organizations security measures, safeguards and controls to protect the information assets. The HIPAA Security Rule contains Administrative, Physical and Technical safeguards, and Cavirin covers the majority of those technical aspects that are most difficult to both prove and track.
- Assessing all vulnerabilities and threats found during the previous steps to determine the likelihood of the occurrence and impact to the organization in order to determine the overall risk level. No matter how frequent your measures to maintain a reasonable risk posture, events will happen. Using Cavirin's ARAP is proof of asset based threat management, maintaining the history of discovery and steps of remediation, as well as logic used to risk rank areas of vulnerability based on your unique architecture and business priorities.
- Documenting the results of the risk analysis/assessment. Cavirin risk reporting leverages the topics recommended by the Common Security Framework, CSF 7.0 or HITRUST and uses all mandated and recommended sources for validation of system policy rules mapping to the right level of risk analysis. Using the entire of NIST 800-53r4 and Appendix J, leveraging AICPA recommendations for mapping SOC2 in Healthcare to NIST and CSF, the security and compliance team further includes for alignment:
- OCR provides materials on the Security Rule – including an Educational Paper on Basics of Risk Analysis and Risk Management
- National Institute of Standards and Technology (NIST) Several Special Publication (SP) papers are applicable to this process:
- SP800-30 – Risk Management Guide for Information Technology Systems
- SP800-39 – Managing Risk from Information Systems
- SP800-66 – An Introductory Resource Guild for Implementing HIPAA Security Rule
- SP800-100 – specifically Chapter 10 of the Information Security Handbook provides information on Risk Management Framework
- SP800-115 – Guide to Technical Aspects of Performing Information Security Assessments
Why comply with HIPAA HITECH?
As summarized by An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act; NIST Special Publication 800-66, “in addition to being subject to the Federal Information Security Management Act of 2002 (FISMA), [agencies] are also subject to similar requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule (the Security Rule), if the agency is a covered entity as defined by the rules implementing HIPAA.
The HIPAA Security Rule specifically focuses on the safeguarding of electronic protected health information (EPHI). Although FISMA applies to all federal agencies and all information types, only a subset of agencies are subject to the HIPAA Security Rule based on their functions and use of EPHI. All HIPAA covered entities, which include some federal agencies, must comply with the Security Rule, which specifically focuses on protecting the confidentiality, integrity, and availability of ePHI, as defined in the Security Rule. The EPHI that a covered entity creates, receives, maintains, or transmits must be protected against reasonably anticipated threats, hazards, and impermissible uses and/or disclosures.
Cavirin Security and Compliance solutions are uniquely tailored to manage both FISMA and HIPAA as it relates to Health and Government Regulated Industries.
Avoiding Security Breaches
HIPAA Rules places burden on health staff and IT. Mismanagement of these disparate administrative, physical and technical requirements exposes entities to data breaches. Cavirin’s suite of policy packs include HIPAA specific, as well as all government DISA configuration and system policy guidance, including comprehensive ISO27002:2013 customizable policy enforcement.
The Office for Civil Rights (OCR) released a crosswalk between the HIPAA Security Rule and the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework). Cavirin Security and Compliance has leveraged all available resources to make your reporting applicable for most, if not all health related technology compliance events.
Complying with HIPAA is not just about health
Complying with HIPAA and HiTECH Rules technical requirements is onerous. An organization needs solutions that can monitor on site and virtual environments. Cavirin’s Automated Risk Analysis Platform (ARAP) manages these day-to-day challenges, implementing technology based HIPAA security best practices and reporting exceptions in the context of operational risk.
THE SOLUTION
Cavirin’s Platform assists Chief Risk & Security, as well as IT and DevOps leadership with the top challenges they face in meeting HIPAA Security Compliance:
- Missing patches for operating systems and applications.
- Monitoring and detecting sensitive data loss (data exfiltration).
- Locating weak passwords.
- Lack of logs and audit trails than can conduct forensics to identify and respond to a breach.
- Security validation for new systems.
- Missing or outdated anti-malware technology.
- Encryption of sensitive information in transit.
- Remediate deficiencies that would otherwise be impossible to manage due to the lack of trained staff maintaining security controls.
Compliance in any environment
- Cloud Native platform supporting 12-factor patterns (things like port binding, logs, concurrency…)
- A “hyper plane” of integrated “risk assessment” amongst segmented vulnerability domains
- Works with Private, Hybrid, and Public Clouds
- Support AWS, Azure, GCP (Google Cloud Platform)
- Manages thousands of out-of-box policies, well curated and certified (SCAP, XCCDF, OVAL)
- Supports current compliance authority (PCI DSS, HIPAA, NIST, SOC2, FedRamp, CIS Benchmark, DISA, CIS CSC, CSF)
- Is CIS Certified security content (Multiple OS, Docker, AWS Cloud)
- Complies with DISA standards in all aspects of delivery and reported results
Cyber Ready
- Know the critical assets and who’s responsible for them
- Get everyone involved in cyber-resilience
- Assure they have the knowledge and autonomy to make good decisions
- Be prepared for both unsuccessful AND successful attack
- Prevent a cyber-attack from throwing your organization into complete chaos.
HIPAA HITRUST and Cavirin
Cavirin Security and Compliance actively contributes to all major standards and organizations responsible for the mapping of regulatory requirements and the most highly leveraged national and international standards. In addition to organic CIS Benchmarks and DISA STIG NIST based configuration management, Cavirin has implemented all assessments with NIST Cyber Security Framework (CSF) and NIST 800-53 r4 and Appendix J for Privacy.