BLOG

There is a dynamic duo in healthcare data security assurance: HITRUST CSF certification and SOC 2 attestation. Aligning your data security program with healthcare standards contained in HITRUST CSF and the SOC 2 attestation can bring numerous benefits. Pursuing these together in a full-scale security initiative offers an efficient approach to securing healthcare data. Read More

At the recent HIMSS conference, the OCR provided an Enforcement Update where they outlined how they plan to approach enforcement with healthcare covered entities in 2019. As security and privacy consultants and advisors with our ears to the ground, we keep our eyes peeled for these important regulatory trends. What are the top trends that will have the biggest impact to healthcare security and privacy policy? Read More

Medical device and IoT unmanaged devices have introduced a significant hurdle for security teams to protect critical healthcare information and systems. A strategic direction for managing medical devices should be captured in a formal medical device security program and strategic plan. And while the “device” itself should be carefully evaluated for security risks, additional focus should be given to the middleware and platforms running behind the scenes. Read More

Even as third-party data breach activity continues to grow, the importance of third-party data security in board-level risk management strategy is not growing to match the need. In November 2018, the Ponemon Institute reported that among U.S. firms surveyed, 61 percent experienced a breach caused by third parties, which is up from the previous year at 56 percent. However, only 46 percent of firms surveyed say managing relationship risk is a priority. Read More

Cyber Hygiene consists of the practices and steps required to ward off potential viruses, data hijack attempts and intruders invading your information systems. Good hygiene is a major part of preventative healthcare for humans, but also for healthcare information systems. But just setting up employee training, policies and procedures is only covering the surface area of good cyber hygiene. Audits are akin to going for a health check up or dental cleaning. But what about other preventative measures before the annual “checkup”? Read More

Are you part of a health care organization that is having a difficult time filling information security positions needed? Perhaps many security projects are slowing down to a trickle or coming to a complete standstill as your security program initiatives get backed up. Don’t worry, you are not alone. According to ISC2, the global information security workforce shortage is expected to hit almost two million by 2022, demonstrating a staggering 20% increase from 2015. Read More

Each time a shuttle, rocket, person or animal is shot into space, spectators watch because we can visualize and imagine the risks. We understand a lack of oxygen, gravitational force, water and food creates extreme survival difficulties. However, the risks and dangers of operating health practices in cyberspace are less visible. There is no “blast-off” of your health record or financial information rocketing into the unknown with a huge fuel cloud to mark the occasion. Still, the information is going into the great, wide unknown, often without adequate information security and risk analysis and protections. Read More