Why HIPAA Security Rule Compliance is Challenging for Healthcare Providers

The HIPAA Security Rule can get challenging. It covers what your organization needs to do for compliance, but not how it should be done. That’s a crucial piece left to the interpretation of the entities covered under HIPAA.

So, it’s no surprise that most healthcare providers think they are in compliance with the HIPAA Security Rule, while the audit reports by Office for Civil Rights (OCR) tell a different story. According to the OCR, since the HIPAA Security Rule came into effect in April 2003, the most common violations have been:

• Impermissible uses and disclosures of Protected Health Information (PHI): For example, a patient’s PHI is disclosed by a staff member to a research entity without the patient’s authorization, or the health insurance information of a patient was sent to the wrong recipient. This violation is rarely the result of malintent and may occur accidentally, however, it is the healthcare providers’ responsibility to ensure there are safeguards in place to protect against such errors.
• Lack of administrative safeguards of electronic protected health information: There are nine standards under HIPAA’s administrative safeguards alone, and most of these have three to four sections, which makes it seem challenging to adhere to. An added challenge is HIPAA doesn’t tell you how to adhere to the standards making it difficult for healthcare providers to determine if they are in full cybersecurity compliance with the HIPAA Security Rule.
• The use, or disclosure of more than the minimum necessary PHI: Again, this violation is rarely intentional. For example, if an employee at your clinic calls the patient’s house and speaks to a relative of the patient, they may share more information than necessary regarding the patient’s medical condition and treatment plan.

These HIPAA Security Rule violations are not limited to new boutique clinics that may not know any better. In reviewing the frequency of violations, general hospitals top the charts followed by outpatient facilities, pharmacies, and community health centers.

Why is healthcare struggling with HIPAA Security Rule Compliance issues almost two decades later?

HIPAA Security Rule compliance isn’t straightforward. Take a quick glance at the HIPAA Security checklist and you’ll realize that you need a dedicated team to work on it. There are many safeguards to follow, and it can seem like a never-ending list of requirements. So, why do the aforementioned violations keep occurring?

Inadequate risk analysis and risk management

Risk analysis is the first item on the HIPAA Security Rule and it requires healthcare organizations to be very thorough. You need to create a detailed inventory of all the ePHI that you receive, transmit, create, or maintain; and this should be done at least every year or as soon as any new information system or application is added to your environment. The number of moving parts involved, coupled with limited resources to keep track of everything makes it challenging for healthcare organizations to conduct a thorough risk analysis.

Our recommendation: Leverage the Security Risk Assessment (SRA) Tool developed by the Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS Office of Civil Rights (OCR) to help guide your IT and cybersecurity team through the risk analysis process.

Insufficient IT and/or cybersecurity resources

From zero-days to brute force and ransomware attacks, cybercriminals have become more specialized and sophisticated in their use of cyberattacks. While there are a growing number of cyber threat actors constantly trying to infiltrate healthcare systems and steal ePHI, most healthcare organizations have only a handful of IT resources in-house to monitor and defend against these cyberattacks alongside troubleshooting day-to-day system or network issues. So, it’s likely that your healthcare practice may need external support to augment your team and help you contain and respond to threats before they become business-disrupting events.

Our recommendation: Engage a Managed Detection and Response (MDR) service provider to help your team effectively detect malicious activity, maintain 24/7 threat hunting, carry out deeper investigation, and a Mean Time to Contain of 15 minutes that ensures cyberattackers don’t have enough time to action on their objectives before being stopped.

Inefficient phishing and security awareness training

Unfortunately, data breaches aren’t purely an external affair. Cyberattackers are betting on luring your staff to download fraudulent files or click malicious links, making your staff the weakest link. Plus, due to the stressful environment of hospitals and clinics, and your staff being focused on patient care, there’s a high probability they will fall prey to a phishing email or accidentally disclose ePHI to the wrong recipient.

Our recommendation: Implement a phishing and security awareness training program to help your team manage an effective user resiliency program, continuously test your staff, and ensure that your weakest link is hardened against the most sophisticated phishing attempts. Additionally, periodically evaluate the quality of your phishing and security awareness training program to stay ahead of evolving cyber threats and minimize the risk of accidental ePHI leaks. HIPAA isn’t the be-all and end-all for cybersecurity. It’s the minimum federal standard to ensure the availability, confidentiality, and integrity of all electronic protected health information (ePHI). There are state laws with more stringent standards that could apply over HIPAA. For example, the Texas Health and Safety code for medical records takes precedence over HIPAA in some cases as it applies to a broader range of entities, has stricter training requirements for staff, prohibits unconsented release of PHI for marketing purposes, and does not allow re-identification of de-identified individuals.

How eSentire MDR helps healthcare providers be more than just HIPAA compliant

Complying with the HIPAA Security Rule while mitigating cyber risk from an expanding threat surface with constrained resources is challenging. While most healthcare providers have traditional perimeter defenses in place, many lack the advanced defenses required to detect and contain modern cyber threats.

As healthcare cybersecurity breaches continue to make national headlines, many healthcare providers are outsourcing their cybersecurity to an MDR service provider that can protect their patients and critical business operations with 24/7 threat detection, investigation, and response.

At eSentire, we work with healthcare delivery organizations ranging from individual practices to major hospitals and their business associates to ensure they have the systems, processes, and controls in place to protect their practice, patient data, and most importantly, critical operations from known and unknown cyber threats

eSentire MDR helps healthcare providers become HIPAA compliant, and maintain their compliance by:

• Protecting ePHI: We are adept at securing all forms of sensitive data, such as ePHI, PII, financial information, and credit card or payment transfer services (PCI). Our 24/7 Elite Threat Hunters and SOC Cyber Analysts actively hunt for threats across your environment.
• Preventing operational disruption: We detect intrusions and contain cyberattacks before attackers can establish a foothold to steal patient data or disrupt your critical operations.
• Meeting compliance standards: Our MDR and Managed Risk services are designed to help you navigate the complexity of HIPAA Security Standards and put corrective controls in place. Our SOC leverages proven runbooks which include detectors mapped to requirements and reporting measures for PCI, PII, SOX, GDPR, CCPA as well as state-level regulations.
• Securing your business associates and critical technology: We can assist with creating a third-party risk management program for your business and support securing Mergers & Acquisitions and digital transformation activities. We also identify core services, including electronic medical records (EMR), drug management, time tracking, file share and document signing, and prioritize these services for monitoring.
• Tackling ransomware attacks: We monitor your attack surface 24/7 to discover intrusion attempts and prevent the pervasive deployment of malware and ransomware. We support multi-signal coverage, ensuring visibility across endpoint, network, log, cloud, and other data sources for deep investigation and response capabilities.

To discuss your security risk assessment and learn about how eSentire can help strengthen your HIPAA Security Rule strategies, book a meeting with one of our security specialists.