Governance & Risk Management , Healthcare , Healthcare Information Exchange (HIE)

Driving Real Cyber Risk Reduction in Healthcare

Key Steps for Healthcare Organizations to Safeguard Sensitive Data Jon Stone • November 5, 2024

Cyber risk reduction is critical as the healthcare landscape has undergone dramatic shifts - a significant portion of the workforce has transitioned to remote work and digital services have surged, breeding new cybersecurity threats and vulnerabilities. Unless strategically countered with proven methodologies, these emerging challenges considerably endanger healthcare organizations’ capacity to fulfill their missions.

Under the HIPAA Security Rule, a comprehensive risk analysis must be conducted regularly on all systems that create, receive, maintain or transmit electronic protected health information, or ePHI, when new technologies are adopted or significant changes in the operational environment occur. These analyses must thoroughly examine how patient data is safeguarded against evolving threats and vulnerabilities, ensuring that the security measures in place are reasonable and appropriate.

A well-developed cybersecurity risk management program transcends simply applying the latest controls or responses to trends like ransomware - it demands a deep understanding of an organization's unique threats and vulnerabilities so that resources can be allocated wisely to mitigate these risks over time.

In the event of an investigation by the Office for Civil Rights, organizations must demonstrate that they have not only identified risks to the confidentiality, availability and integrity of sensitive data but have also implemented reasonable and appropriate security measures and safeguards scaled to the level of identified threats. The OCR looks for demonstrable evidence that an organization's risk management plan is rigorous and effective, focusing on documented proof that security measures have been integrated appropriately to reduce risk.

Clearwater advocates for a proactive, ongoing risk analysis and response process, ensuring that healthcare organizations can readily demonstrate their commitment to comprehensive cybersecurity risk management and, most importantly, reduce the potential of a debilitating and costly breach.

If your organization is not operating in this manner currently, here are a few key things to consider.

Are You Identifying Where Your Greatest Security Risks Lie?

Healthcare organizations, regardless of size, grapple with a multitude of potential security risks that seem to endlessly populate their risk registers, leading to the misconception that every risk demands immediate attention. Such an approach is not only impractical but also strategically flawed. Effective risk management lies in discerning which threats pose the greatest danger and must receive prioritized attention.

Forward-thinking organizations are leveraging artificial intelligence and machine learning to predict the risk likelihood, risk impact and overall risk rating of various threats and vulnerabilities and identify potentially critical risks more quickly.

Are You Making Risk Response Decisions Holistically?

Evaluating risk reduction alternatives demands a holistic approach. Decision-makers must balance the scales between the effectiveness of risk response and its feasibility across various dimensions, always optimizing security while maximizing essential clinical workflows. Balancing security and ongoing operations requires a nuanced understanding of the technological landscape and the healthcare environment on which these decisions have the greatest impact.

Managing cybersecurity risks requires a careful evaluation of risk treatment options. Healthcare organizations should consider the treatment’s effectiveness in mitigating threats, the associated costs and its feasibility for implementation.

Do You Have a Disciplined Implementation Process?

To be successful, risk management requires robust governance. Comprehensive implementation plans are vital and include clearly understood requirements, measurable outcomes and defined accountability to maximize risk reduction.

As a general rule of thumb, well-documented implementation plans should contain:

Specific details of the controls to be added or enhanced;
Mechanisms for monitoring the effectiveness of the risk response;
Clear timelines and priorities;
Assigned roles and responsibilities;
Risks and issues tracking.

Consider the following risk scenario:

Threat source: System cracker

Threat event: Social engineering
Vulnerability: Untrained/untested staff

To mitigate this risk, we may consider implementing a plan with the following structure:

Risk owner: Human resources
Project manager: John Doe

Open risks or issues: Nothing significant to report

Priority 1: Improve or update security and awareness training

Control: Security/privacy awareness training
Action: Enhance
Implementation manager: Information security and talent management
Due date: March 31, 2024 (Q1)

Priority 2: Deploy targeted phishing campaigns

Control: Targeted phishing campaigns
Action: Deploy
Implementation manager: Information security
Due: June 30, 2024 (Q2)

Priority 3: Improve audit trail collections and review cadences

Control: Audit trail collections and cadences
Action: Enhance
Implementation manager: Application analysts
Due: Sept. 30, 2024 (Q3)

Priority 4: Validate, refine and update information disclosure procedures and sanctions policies

Control: Information disclosure procedures and sanctions policies
Action: Validate
Implementation manager: Legal, privacy and compliance
Due: Dec. 31, 2024 (Q4)

Healthcare organizations can systematically address vulnerabilities over time by treating risk response actions as distinct projects with clearly defined outcomes.

A Complex But Crucial Endeavor

Implementing a disciplined cyber risk management process is a complex but crucial endeavor that requires diligent project management and oversight. You can make rapid progress by leveraging experts and specialized tools that can provide structured and automated guidance, enhancing your understanding of risk and facilitating appropriate management action. With these resources, organizations can develop proactive strategies that integrate with their operational goals, ensuring that security measures evolve alongside emerging threats.