Compliance isn’t enough: Improving governance, risk management, compliance

Post by Jaimin Patel, Vice President IAM Program Management, Caradigm
Originally posted: October, 2016

Change is the new normal in healthcare, which can come in many forms: mergers and acquisitions, the formation of accountable care organizations and clinically integrated networks, having new groups of physicians arrive at a teaching hospital, or even the replacement of an EHR. From an IT perspective, the impact is that you constantly have new clinicians needing access as quickly as possible because it impacts patient care. IT and security professionals also understand that access has to be granted and managed in a manner compliant with the HIPAA Security Rule. However, with the increase in motivated and persistent security threats, healthcare as an industry has to move beyond the notion that the goal is only HIPAA compliance.

Limitations of using HIPAA compliance as the standard

I recently heard Mac McMillan, CEO of CynergisTek, talk about this at the Caradigm Customer Summit where he stressed that compliance with HIPAA does not equal security. McMillan explained that HIPAA was designed to protect the privacy and security of certain health information – it was not intended to cover all forms of information or to be a complete standard for data protection.

A major part of the problem is that the HIPAA Security Rule, initially conceived in 2001, pre-dates many of today’s technology advancements. It did not envision cloud computing, mobile devices, networked medical devices, wearables, population health applications, and many other advancements seen since that time. It also pre-dates many of today’s evolving threats such as cyber-extortion (e.g. ransomware), cyber-espionage, hacktivism, and specific threats such as phishing and zero day attacks. Consequently, if healthcare organizations are focused solely on compliance, then their security is inadequate.

How to improve GRC

McMillan called on healthcare organizations to think and act differently when it comes to data security and privacy. It’s about greater due diligence, day in and day out, and aligning with your organization’s broader governance, risk management, and compliance strategy. For identity and access management, greater security can involve improvements such as the following:

• Employing a role-based security model to enable more precise granting of access
• Automating provisioning and deprovisioning so that role changes are made efficiently and accurately
• Using analytics to proactively search for potential risk such as orphaned accounts or mismatched entitlements
• Streamlining workflows to evaluate and remediate threats faster across many applications
• Performing audits more efficiently by empowering managers to review and attest to their direct reports’ entitlements

When I speak to healthcare organizations, I recommend that they consider getting the tools in place now so they can be prepared for when change hits their organization. It’s going to happen eventually. Having the right tools not only makes your organization more secure, it makes your staff far more efficient, and will deliver to your clinicians timely and accurate access. There aren’t many IT projects that can claim this trifecta of wins for your organization.