BLOG

by Maliha Charania and Brian Fletcher 

In today’s interconnected healthcare landscape, managing third-party risk has become more crucial than ever. As healthcare organizations increasingly rely on external vendors for essential services, the risks associated with these third parties have skyrocketed. Recent incidents, such as the breaches involving Change Healthcare and the Salesforce, have exposed sensitive patient data, disrupted services, and caused significant reputational and financial damage. These events underscore the severe consequences of inadequate third-party risk management and the necessity of a proactive approach to safeguarding your organization. 

The Importance of a Strategic Approach 

A successful third-party risk management (TPRM) program is built on a strong strategic foundation. This involves not only managing risks but also fostering productive relationships with your suppliers, setting clear expectations, and ensuring that your processes are scalable. 

1. Collaboration with Suppliers: Effective third-party risk management is not about creating an adversarial relationship with your vendors. It’s essential to recognize that both sides face challenges, particularly when it comes to security. Transparency is key—open communication about security expectations and concerns can lead to more robust security practices on both sides. Collaborating with suppliers as partners rather than adversaries helps in building trust and achieving mutually beneficial outcomes. 
2. Setting Expectations: Clearly defining what you expect from your suppliers regarding their security programs is crucial. This includes outlining specific security requirements, compliance obligations, and incident response expectations. Equally important is communicating what your suppliers can expect from you, particularly in terms of streamlining the contracting and onboarding processes. Setting these expectations upfront helps to avoid misunderstandings and ensures that both parties are aligned from the start. 
3. Scalability: Managing a large portfolio of suppliers can be resource intensive. It’s important to balance your available resources with the expectations of your business stakeholders. This means scaling your due diligence efforts appropriately focusing on high-risk vendors while maintaining a manageable process for lower-risk suppliers. By prioritizing your efforts, you can ensure that your TPRM program is both effective and sustainable. 

Establish Visibility to Third-Party Risk 

Understanding your organization’s third-party risk landscape is critical for effective management. Establishing visibility means having a clear and comprehensive view of all third-party relationships and the risks they present. This involves mapping out the vendor ecosystem, categorizing vendors based on the criticality of the services they provide and the sensitivity of the data they access, and continuously monitoring their risk profiles. 

Visibility into third-party risk ensures that your vendors are investing in security the right way and allows you to stay informed of any changes in their security posture on a regular basis. This ongoing awareness enables you to take timely actions as needed to maintain a strong security posture across your vendor ecosystem. 

Conducting Risk Assessments 

Before entering into any contractual agreement with a vendor, it is essential to conduct a risk assessment. This assessment should evaluate the vendor’s security posture, compliance with relevant regulations, and the potential impact of a security breach. By assessing the risks prior to contracting, you can make informed decisions about how you may choose to enter into a business arrangement with each vendor. 

The importance of this step cannot be overstated. Vendors may present a polished image, but without an assessment, critical risks may be overlooked. A robust risk assessment process helps ensure that only vendors who meet your security and compliance standards are onboarded, reducing the likelihood of future security incidents. 

The Necessity of Ongoing Vendor Reviews 

Risk management doesn’t end once a contract is signed. The threat landscape is constantly evolving, and so is the risk associated with your vendors. To maintain a strong security posture, it's crucial to conduct periodic reviews of your vendors. These reviews should reassess the vendor's security controls, compliance status, and any changes in their operations or the services they provide. 

Regular vendor reviews allow you to identify and address emerging risks before they can cause harm. They also provide an opportunity to revisit and update contract terms, ensuring that they remain aligned with current security requirements and regulatory standards. 

Optimizing TPRM Operations 

To effectively manage third-party risk, it’s essential to optimize your TPRM operations. This involves simplifying security due diligence processes to reduce the burden on business stakeholders and partners without compromising security. By streamlining these processes, you can achieve faster, more efficient assessments and maintain a strong security posture with less friction. 

Collaboration with business stakeholders is critical in maintaining smooth operations. Engaging with these stakeholders ensures that TPRM practices are aligned with business objectives and that there is a shared understanding of the importance of managing third-party risks. This collaboration can also help in identifying areas where processes can be improved or where additional support is needed. 

The Role of Stakeholder Buy-In and Relationship Building 

A successful TPRM program requires the support and collaboration of stakeholders across your organization. This includes executive leadership, IT, legal, procurement, and even clinical staff. Securing stakeholder buy-in ensures that TPRM becomes an integral part of your organization’s culture rather than just a checkbox exercise. 

Building strong relationships with your vendors is equally important. Open communication and collaboration can help ensure that vendors are aligned with your security expectations and are willing to work with you to address any potential risks. 

Strategically Driving Change 

Beyond managing day-to-day risks, a resilient TPRM program should also be a driver of strategic change. Engaging with strategic partners to drive systemic changes, such as collaboration on incident response, is essential for a forward-looking risk management strategy. Developing approaches to adjust to strategic IT directions and identifying clusters of risk by business unit are crucial steps in ensuring that TPRM evolves with your organization’s broader goals. 

Engaging with business units on remediation strategies allows for a targeted approach to risk management, addressing specific risks where they are most likely to impact the organization. By driving change strategically, you can enhance your organization’s overall risk posture and ensure that TPRM is not just a reactive process, but a proactive force for improvement. 

Metrics and Executive Reporting 

To effectively manage third-party risk, you need to measure it. Establish key risk indicators (KRIs), key performance indicators (KPIs), and other metrics that provide insight into the risk posture of your third-party ecosystem. These metrics can include the average risk of your vendor portfolio over time, the frequency of security assessments, and the time taken to remediate identified risks. 

Regularly reporting these metrics to executive leadership is crucial. It not only keeps them informed of the organization’s risk posture but also ensures that TPRM remains a priority at the highest levels. Executive reporting can also help secure additional resources or support for your TPRM program. 

How Meditology Services Can Help 

Building and maturing a third-party risk management program is no small feat, but you don’t have to do it alone. Meditology Services specializes in helping healthcare organizations design, implement, and enhance their TPRM programs. Our team of experts can assist you in establishing visibility into third-party risks, optimizing your TPRM operations, and strategically driving change across your organization. We’ll work with you to develop a comprehensive strategy, conduct thorough risk assessments, prioritize your vendors, ensure compliance, and establish effective metrics and reporting mechanisms. 

With our support, you can build a resilient third-party risk management program that protects your organization, your patients, and your reputation. 

Managing third-party risk is an ongoing journey, but with the right approach and support, you can navigate it successfully. Ready to take the next step? Contact Meditology Services today to learn how we can help you build and mature your third-party risk management program. 

About the Authors

Maliha Charania, MSIS, MSCS, HITRUST | Director, Risk Advisory Services 

Maliha leads Risk Advisory Services, drawing on over 14 years of expertise in IT security and risk management. Her leadership includes designing, spearheading, and successfully implementing global initiatives within the healthcare, financial, and academic sectors. Widely acknowledged as a Subject Matter Expert in IT security and compliance, Maliha has provided pivotal support to numerous healthcare providers, business associates, and payers worldwide. 

Her profound technical knowledge spans various stringent standards and regulations, encompassing HIPAA, GDPR, ISO, NIST, and HITRUST. Her contributions ensure thorough cybersecurity evaluations and seamless integration. Maliha’s distinguished reputation stems from her adept blend of consulting prowess and hands-on international experience, firmly establishing her as a leader in the realms of Risk Management and Cybersecurity. 

Brian Fletcher | TPRM Strategy Services Leader 

Brian is an accomplished senior level healthcare consulting leader with 30 years of experience in the healthcare industry. As CORL’s third-party risk management (TPRM) services leader, Mr. Fletcher is responsible for designing CORL's TPRM strategy for the organization's top-tier clients, while guiding projects from pilot through implementation. Mr. Fletcher has developed and implemented TPRM strategies for some of the largest healthcare organizations in the U.S., including HCA Healthcare and Texas Health Resources. Mr. Fletcher also architected and deployed a cutting-edge TPRM program for the Mayo Clinic, integrating an industry leading vendor risk management tool. Prior to working with CORL, Brian held senior-level positions with the healthcare practices of Ernst &Young and Deloitte Consulting.