ZenGRC

Simply Powerful GRC

HITRUST

What is HITRUST Compliance?

· ·

It is a constant challenge for the healthcare industry to comply with the Health Insurance Accessibility and Portability Act (HIPAA).

HIPAA requires healthcare organizations and their business associates to secure protected health information (PHI) and electronic PHI (ePHI). The protections cover all the mediums and locations where companies create, access, store, or exchange sensitive information.

HIPAA incorporates requirements from several industry standards and federal regulations. These include (but are not limited to) the International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST), and Payment Card Industry Data Security Standard (PCI DSS). Hence many companies struggle to comply with HIPAA, because it really is a collection of security controls from many other frameworks.

Using HITRUST CSF certification allows organizations to meet information protection requirements more efficiently. HITRUST CSF stands for the Health Information Trust Alliance Common Security Framework. The HITRUST requirements cross-reference various regulatory requirements and standards into one integrated framework to simplify your compliance program.

When an organization wants to become HITRUST certified, it starts with a self-assessment, reviewing the PHI and ePHI the business collections and the locations where it stores, accesses, transmits, or creates data. Then, the business undertakes a risk management process that focuses on determining the risk levels and tolerances.

After establishing security controls, the business needs to hire a Common Security Framework (CSF) Assessor to perform a HITRUST audit. If the CSF assessor approves the program, the organization can then be HITRUST-certified.

What Is the Difference Between HIPAA and HITRUST?

HIPAA and HITRUST are acronyms that have a similar sound and are interrelated, but they are not the same. The main difference between HIPAA and HITRUST is that HIPAA is legislation, and HITRUST is an organization.

According to the HIPAA Security Rule, healthcare companies and their business associates must implement administrative, physical, and technical safeguards to preserve the privacy, availability, and integrity of PHI and ePHI.

The HITRUST Alliance is an independent evidence organization. HITRUST provides what is referred to as the “HITRUST CSF,” a common security framework that offers organizations a flexible and comprehensive approach to HIPAA compliance and risk management.

The HITRUST CSF framework empowers organizations to deal with security risks and regulatory compliance. It also allows security measures to be customized according to each company’s unique factors, such as organization type, size, business systems, and compliance requirements.

More simply: HITRUST CSF is a framework that an organization may use to meet the legal requirements of HIPAA.

What Are the Benefits of HITRUST Certification?

Highest Standard of Healthcare Data Security

Healthcare service payers and an increasing number of health systems and hospitals are demanding that their business associates become HITRUST-certified. In addition, certification proves that the organization is committed to upholding the highest customer healthcare data protection level.

Cost- and Time-Effective

Although HITRUST is stringent, the organization can respond more comprehensively and rapidly after certification, using fewer hours of repeatable resources. This can significantly reduce the workload from a steady stream of lengthy and time-consuming safety questionnaires, a common feature of doing business as a technology or healthcare company.

Customers of healthcare organizations are aware of and concerned about the rising threat to safety and information security. They realize the value of working with organizations that understand these new threats and have taken the measures necessary to assure that sensitive data is protected with adequate security controls and regulatory requirements for the industry.

Commercial Advantage

HITRUST certification shows that an organization is a leading security, compliance, and privacy provider because it has the certification to support it. This healthcare credibility and status distinguishes an organization.

Best Practices for HITRUST Compliance

The use of a system such as HITRUST CSF isn’t sufficient by itself to avoid cyber attacks. An organization that wants to safeguard sensitive data must continuously monitor security risks through the following five steps.

Identify

Identifying the threats and weaknesses of a computing network is the first step. A thorough risk assessment can determine:

  • The network assets that must be protected;
  • What data is being gathered;
  • The location where sensitive information is kept and where it moves throughout the network;
  • Those individuals who access the confidential data, including service providers and business associates.

Protect

After the company has mapped its assets and their weaknesses, measures need to be implemented to secure the data and network. Logical and hardware security access controls should be employed. These may include annual security awareness training for employees and new employee orientation, as well as administrative and engineering controls, including:

  • Data at rest and in-transit encryption;
  • Data lifecycle monitoring;
  • Data breach protection;
  • Data backup and recovery;
  • Application and network change management controls;
  • Software enhancement life cycle;
  • Event response and management.

Detect

An enterprise should deploy detection tools and processes to identify malicious activity. These mechanisms involve:

  • Access checks of users that detect problems with segregation of roles;
  • Anti-malware programs that identify and protect against malware;
  • A vulnerability management system that routinely screens for vulnerabilities and patches systems appropriately;
  • Security reporting and event monitoring systems that can recognize hardware and software-generated warnings.

Respond

Organizations must be able to react to an attack or incident. Therefore, it is critical to have an effective incident plan and personnel trained in their duties and responsibilities. This response strategy should be reviewed and refreshed yearly. Perform an analysis to assure appropriate response times and the necessary support for recovery activities.

Recovery

When cyber attacks do happen, an organization will need to bounce back quickly after the event. The business continuity and recovery plans can support organizations in restoring operations effectively. It’s best to fine-tune and test such strategies annually.

Let ZenGRC Help You Maintain Compliance

ZenGRC is a governance, risk, and compliance solution that can assist you in implementing, managing, and monitoring your risk management framework and remediation processes. In addition, it can help you streamline the administration of the entire lifecycle of all relevant cybersecurity risk management frameworks – HITRUST, and others such as PCI, ISO, and more others.

Security policies, incident response procedures, and internal controls must be documented and updated regularly to assure they meet the evolving cybersecurity environment. With ZenGRC’s document repository, policies and procedures are revision-controlled and easy to find.

Workflow management features offer easy tracking, automated reminders, and audit trails. The ZenConnect feature enables integration with popular tools such as Jira, ServiceNow, and Slack, assuring seamless adoption within your enterprise.

Insightful reporting and dashboards provide visibility to gaps and high-risk areas. By better understanding your risk landscape, you can take action to protect your business from cyberattacks, avoid costly data breaches, and monitor the security posture of your vendors.

Schedule a free demo now to learn more about how ZenGRC can help you enhance your cybersecurity procedures and compliance.

What Is a HITRUST Audit?

· ·

A HITRUST assessment, or audit, helps healthcare organizations gauge their compliance with the Health Information Trust Alliance Common Security Framework (HITRUST CSF).

Increasingly, clients expect assurances regarding the information security practices of healthcare organizations and their business associates. Consequently, they’re asking healthcare providers to achieve HITRUST CSF certification to demonstrate that they’re safeguarding the integrity, confidentiality, and accessibility of individuals’ protected health information (PHI).

The HITRUST CSF brings together the security controls from federal law, such as HIPAA (Health Insurance Portability and Accountability Act) and NIST (National Institute of Standards and Technology), as well as state law, and industry standards into a certifiable framework that’s focused on risk management and geared toward use in the healthcare industry. 

The HITRUST CSF was established to address the numerous cybersecurity, privacy, and regulatory challenges facing organizations. 

Understanding the HITRUST CSF certification process enables health systems and other providers to become compliant in ways that best align with the needs of their organizations. Nevertheless, verifying that their organizations have met all of the HITRUST certification requirements can be challenging. 

There are two types of assessment/audits that organizations can use to ensure HITRUST compliance: a self-assessment and a validated assessment.

Self-assessment

In a self-assessment, organizations assess themselves using the standard methodology, requirements, and tools that HITRUST provides under the CSF Assurance Program. External auditors don’t verify any aspects of this type of assessment, although HITRUST performs limited validation on the outcome of the self-assessment. 

A high-level review of control objectives, the self-assessment lets organizations compare their programs against the required security controls. Companies use the results of the self-assessment to rectify gaps in their security controls using recommendations from the HITRUST framework and the MyCSF assessment tool that streamlines the compliance and risk management process. This self-assessment helps healthcare companies determine if they’re ready for HITRUST certification.

Validated assessment

A validated assessment is conducted by an external HITRUST-approved CSF assessor. The assessor uses the assessment methodology of the CSF Assurance Program. The controls are scored using HITRUST’s maturity approach to control implementation. The assessments that meet or exceed the current CSF Assurance Program requirements receive a HITRUST validated report indicating they are HITRUST CSF Certified.

Is AWS HiTRUST Certified?

· ·

Currently, the Health Information Trust Alliance Common Security Framework (HiTRUST CSF) certifies 64 Amazon Web Services (AWS) services. These HiTRUST-certified services include Amazon Elastic Compute Cloud, Amazon EMR, Amazon Redshift, and AWS Managed Services.

The HiTRUST certification lets AWS customers customize their security control baselines to many factors, including regulatory requirements and type of organization.

The CSF is “a certifiable framework that provides organizations with a comprehensive, flexible and efficient approach to regulatory compliance and risk management,” according to HiTRUST.

HiTRUST developed the CSF framework in collaboration with health care and information security professionals. The CSF brings together the security controls from federal law, including HIPAA (Health Insurance Portability and Accountability Act), state law, and industry standards, such as PCI-DSS (Payment Card Industry Data Security Standard), into one framework geared toward use in the health care industry. 

Organizations can use the HiTRUST framework to comply with these other compliance standards:

  • HIPAA compliance 
  • PCI-DSS 
  • ISO/IEC 27000 series (comprising information security standards published jointly by the International Organization for Standardization and the International Electrotechnical Commission)
  • NIST (National Institute of Standards and Technology) standards

To help customers comply with HIPAA and/or HiTRUST, AWS gives them access to AWS tools and services to protect the security and privacy of their protected health information (PHI) and personally identifiable information (PII). 

According to Amazon, more AWS customers, especially health care payers, are using the AWS Cloud to ensure compliance with HIPAA and HiTRUST.   Amazon Web Services offers its customers a Business Associate Addendum (BAA), a contract that is required under HIPAA rules to ensure that AWS appropriately safeguards their protected health information.

The BAA provides a list of HIPAA-eligible services that customers can use to process, store, and transmit protected health information under the BAA.

What is the Difference between HIPAA and HiTrust?

· ·

The Health Insurance Portability and Availability Act (HIPAA) establishes a set of security controls that govern information security in the healthcare industry. Healthcare organizations and their business associates are legally required to protect certain types of patient information from data breaches. A HIPAA compliance violation can lead to fines and jail time, depending on how the protected health information (PHI) or electronic PHI (ePHI) disclosure or unauthorized access occurs.

The HIPAA Security Rule governs security standards regarding ePHI. Although the regulation does not prescribe controls, it details standards and regulations as guiding principles, including but not limited to COBIT, ISO, NIST, and PCI DSS. Thus, meeting these requirements can flummox healthcare organizations trying to establish controls to achieve compliance.

The Health Information Trust Alliance (HITRUST) established the HITRUST Common Security Framework (CSF) that assists companies attempting to meet the high HIPAA compliance standard. The HITRUST CSF aggregates all the suggested controls into a framework that makes it easier for an organization to be HIPAA compliant, although it is not part of the HIPAA regulation.

As a framework rather than a regulation, the HITRUST CSF creates a process that begins with establishing a risk management program that includes a self-assessment, asset inventory, risk assessment, risk analysis, risk tolerance considerations, risk mitigation process, and monitoring control effectiveness. HITRUST certification also requires the organization to undergo an external audit from a HITRUST CSF certified assessor. The CSF assessor reviews the risk management program and control monitoring to determine whether the organization appropriately completed the HITRUST assessment.

Although HITRUST CSF certification differs from HIPAA compliance, it allows an organization to create a more streamlined approach to meeting the Security Rule requirements.