Know What You Have
Knowing what IT assets you have, how its protected (logical and physical) and where it exists are critical management functions for any organization responsible for HIPAA compliance. We recommend a HIPAA Gap Assessment to gain a better insight into your internal boundary, ePHI discovery, risk management, vulnerability management, 3rd party providers to ensure you understand HIPAA requirements.
HIPAA & Cloud Considerations
Are you leveraging cloud services and assume you inherit their HIPAA (enabled) attestations? Security in the cloud is shared responsibility and there are separate security and privacy responsibilities for each organization. Make sure that your cloud service providers have the appropriate security and privacy programs in place that you can count on with respective Business Associate Agreement in place.
Cloud Service Provider Understanding
Many of the Covered Entities and/or Business Associates are utilizing cloud offerings providers. Are you working with a firm that understands cloud and cybersecurity? Have they worked with the leading hyperscale providers – do they understand the IaaS/PaaS nuances, HIPAA enabled services (attestations), and know how to piece together a security roadmap (inclusive of cloud offerings)?
Continuous Assurance
Meeting security and privacy requirements for HIPAA are important for both compliance and your brand. Cyber incidents and data breaches in the healthcare space are at an all-time high. What is your organization doing to manage risk? Make sure that you have the right security partner to guide continuous assurance activities for the right organizational visibility.
