Become HIPAA Compliant Without Losing Focus from Cybersecurity

The pandemic, unending digital transformation, and unsympathetic cybercriminals have taken their toll on healthcare organizations.

Exhausted healthcare employees are falling prey to clever phishing and business email compromise (BEC) scams and in-house cybersecurity teams have been inundated with alerts. Cyber threats to data and operations systems can take a facility off-line, leading to disruption of care, resulting in longer lengths of stays in hospital and delays in procedures and tests. In addition, the loss of access to health records may limit the provider’s ability to provide appropriate care, shelter, and medicine in times of need.

It’s safe to say that the stakes have increased considerably in the last few years. Unfortunately, while cybercriminals continue to disrupt critical healthcare operations without any care of the impact, healthcare organizations are feeling immense pressure to not only comply with stringent privacy and cybersecurity regulations but stay one step ahead of the cybercriminals as they do so.

It’s easy for your cybersecurity team (and even other healthcare employees) to feel underappreciated and unsupported in their fight against cyber threat actors, but you’re not alone.

Over the last few years, eSentire has worked to keep tens of thousands of hospital beds open and ensure that doctors stay focused on providing critical patient care without worrying about clicking on the wrong email link. We know you must be HIPAA compliant, and we can help. In fact, our core services go a long way to keep you safe from cyberattacks, and compliant with HIPAA-HITECH.

Comprehensive Overview of the HIPAA Rules

HIPAA Privacy Rule

The US Department of Health and Human Services (HHS) issued the HIPAA Privacy Rule to meet the privacy requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a federal law that mandated a national standard to protect private health information (PHI). The HHS later augmented the HIPAA Privacy Rule with the HIPAA Security Rule to protect electronic private health information (ePHI) as patient records moved to digital systems.

HIPAA Security Rule

The HIPAA Security Rule covers the detection and safeguarding against anticipated healthcare cyber threats and unauthorized access or disclosure of ePHI and includes provisions to certify professionals with access to ePHI. The HIPAA Breach notification rules cover notification to regulators, press and affected parties of exposure of their health information when more than 500 records are affected.

HIPAA-HITECH

The incorporation of provisions from the Health Information Technology for Economic and Clinical Health (HITECH) Act in 2013 marked a significant expansion of the HIPAA Rules. Commonly known as the "Omnibus HIPAA Final Rule," this modification introduced important changes, including enhanced privacy and security protections for electronic health records (EHRs) and increased penalties for non-compliance.

HIPAA Breach Notification Rule

In the event of an unauthorized disclosure of Protected Health Information (PHI), the HIPAA Breach Notification Rule comes into play. The rule mandates that affected individuals, the Department of Health and Human Services (HHS), and sometimes the media be notified in case of a breach. This rule is crucial for maintaining transparency and trust in the healthcare system by ensuring timely communication after a data breach.

HIPAA Enforcement Rule

The HIPAA Enforcement Rule is integral to the regulatory framework, setting forth the procedures for the investigation and enforcement of HIPAA compliance. The rule outlines the steps for conducting compliance reviews, imposing penalties for non-compliance, and hearing procedures. This rule underscores the importance of HIPAA compliance and the consequences of failing to protect patient information.

HIPAA Transactions and Code Sets Rule

To streamline healthcare transactions, the HIPAA Transactions and Code Sets Rule standardizes electronic data interchange formats for healthcare-related transactions. This rule facilitates efficient and consistent processing of billing and patient data, enhancing the operational efficiency of healthcare providers.

Navigating HIPAA Privacy Rule and HIPAA Security Rule Compliance

While the HIPAA Privacy Rule and HIPAA Security Rule seem simple enough, the devil is always in the details, and healthcare delivery organizations (HDOs) struggle to protect ePHI against an evolving threat landscape, new tactics, and even more devastating outcomes.

Like other privacy and cybersecurity regulations, the HIPAA Privacy and Security Rules are aspirational and provide high-level guidance which leaves many organizations scratching their heads when it comes to tackling the many ways to achieve compliance.

Violations can lead to expensive settlements and complex corrective action plans, and HDOs are constantly under the scrutiny of the HHS and Joint Commission (JCO) that conducts regular audits of healthcare standards and can levy hefty fines.

Although the HHS Office for Civil Rights (OCR) offers the HIPAA Security Risk Assessment Tool and NIST HSR Toolkit Application self-assessment survey to help organizations understand the requirements under HIPAA, the reality is that both the HIPAA Privacy Rule and HIPAA Security Rule are more about privacy than cybersecurity.

These rules were written to protect unintended exposure like lost or improperly disposed records, rather than defend against state-sponsored actors bent on shutting down operations and exploiting organizations already struggling to cope with a global pandemic.

Neither rule provides guidelines designed to protect against today’s pervasive and aggressive tactics. As a result, maintaining HIPAA compliance such that cybersecurity remains the focus proves to be quite the challenge for HDOs.

How HDOs Can Maintain HIPAA Cybersecurity Compliance

While most healthcare providers have traditional perimeter defenses in place, many lack the advanced and layered defenses required to detect and contain modern healthcare cyber threats. There’s no doubt that maintaining HIPAA compliance while mitigating cyber risk from an expanding threat surface with constrained resources is challenging.

As a result, many healthcare providers are outsourcing their cybersecurity to a Managed Detection and Response (MDR) service provider that can protect their patients and critical business operations with 24/7 threat detection, investigation, and response.

Here’s how you can prepare your team to become HIPAA compliant, and maintain compliance, without losing focus from cybersecurity:

Understand your cyber risks to align your cybersecurity program

HIPAA requires HDOs to conduct regular risk assessment as the foundation of your cybersecurity program. This means you should assign an officer to lead the cybersecurity strategy and conduct periodic assessments to measure the program’s efficacy.

We recommend: Engage HIPAA cybersecurity experts or Virtual CISO (vCISO) services for your assigned officer to assess the maturity of your cybersecurity program, identify any compliance gaps and vulnerabilities, and build a strong cybersecurity strategy and program designed specifically for your HDO. eSentire Exposure Management provide risk assessments, vulnerability assessments, penetration testing and can even develop cybersecurity policies and procedures for your organization.

Identify your vulnerabilities and patch them immediately

Modern healthcare organizations are part of an interconnected web of data, patient wearable devices, and other healthcare Internet of Things (HIoT) systems that expand the threat surface and make it easier for cybercriminals to infiltrate your environment.

We recommend: Perform better patch management to protect your HDO against opportunistic healthcare cyberattacks, especially those that take advantage of zero-day vulnerabilities. Leverage a comprehensive vulnerability management program that includes three elements: awareness of the cyber threat landscape (e.g., from advisories, notifications, cyber news, etc.); vulnerability scanning to understand your cyber threat surface, including ‘discovering’ systems that are inadvertently exposed; and disciplined patch management.

Educate all your healthcare employees, no matter their roles

Majority of cyberattacks start with phishing campaigns and drive-by downloads that target employees. The stressful environment of hospitals and clinics, in addition to your staff being focused on patient care, only add to the success of phishing and BEC attempts. There’s also a high probability that your staff may accidentally disclose ePHI to the wrong recipient. So, beyond cybersecurity compliance with HIPAA, security awareness training is essential to empowering employees and protecting your HDO.

We recommend: Periodically evaluate the quality of your phishing and security awareness training program to stay ahead of evolving healthcare cyber threats and minimize the risk of accidental ePHI leaks. Use Phishing and Security Awareness Training (PSAT) to level up your employees’ understanding of the most common tactics, techniques, and procedures (TTPs) that cyberattackers use to gain access into your environment.

Proactively detect and contain cyber threats

Perhaps the most challenging aspect of HIPAA is having the ability to detect unauthorized or suspicious behaviour and potential cyberattacks. Unfortunately, many tools designed to simply monitor and report compliance gaps are mistakenly considered to be a part of the cyber defensive toolbelt active defenses that will catch malicious activity. Cybercriminals know how to evade these tools so your team must be able to identify when a cybercriminal has broken through your traditional defenses and respond rapidly to contain the threat.

We recommend: Engage an Managed Detection and Response (MDR) provider for 24/7 threat detection, investigation, and response so your team can stop the cyberattack before it disrupts your business operations. True MDR also relies on host isolation, malicious network communication disruption, account-based suspensions and other killswitch measures to stop the cyberattackers at any level before they can fulfill their objectives.

Proactively prepare for a cybersecurity incident

A vast majority of HDOs are not prepared for a ransomware attack or massive data breach. Any organization, healthcare or otherwise, that has suffered a cyberattack knows that when you’ve been breached, every second counts. To further complicate the matters, under the HIPAA Breach Notification Rule, HDOs and their business associates are required to provide notification after any data breach that includes unsecured PHI.

We recommend: Have an Incident Response (IR) retainer in place by engaging a Digital Forensics and Incident Response (DFIR) provider. Having an IR retainer in place will help drive incident response, remediation, recovery, and root cause analysis in case of a cyberattack results in a data breach.

HDOs depend on healthcare specialists and skilled practitioners to deliver the best patient care. The same holds true for cybersecurity. It takes expert collaboration to stop cyber threats before they disrupt your operations. You don’t have to face state-sponsored cyberattackers on your own.

At eSentire, we can work with HDOs to ensure they have the systems, processes, and controls in place to protect their practice, patient data, and most importantly, critical operations from known and unknown healthcare cyber threats. We focus on protecting your operations so you can focus on treating your patience. As we say, an attack on you, is an attack on us.

To learn more about how eSentire can protect your healthcare organization against today’s most sophisticated, targeted cyberattacks, book a meeting with our cybersecurity specialist today.