Tech & Innovation in Healthcare

Mark down incident response on your HIPAA risk assessment to-do list.

Your number one business priority as a healthcare provider is to secure your patients’ protected health information (PHI). The safekeeping of this critical information is crucial from a professional and financial standpoint. Your organization needs to establish a plan on how to take action in the event of a data security breach. Regardless of whether you outsource your IT security or have an in-house team, make sure you have a dedicated incident response team.

Why? Under the HIPAA Security Rule, covered entities (CEs) and their business associates (BAs) are tasked with safeguarding electronic PHI (ePHI), which “identifies individuals and includes information relating to an individual’s health, treatment, or payment information” and “is a valuable target for cyber-criminals,” reminds the HHS Office for Civil Rights (OCR) in the October 2022 Cybersecurity Newsletter. Additionally, analyzing threats, implementing policies and procedures, documenting issues and incidents, and responding to and managing problems are all requirements under the Rules — and CEs and BAs are held accountable post-breach for their protocols and actions.

Facts: “In the health care sector, hacking is now the greatest threat to the privacy and security of PHI. A timely response to a cybersecurity incident is one of the best ways to prevent, mitigate, and recover from cyberattacks,” OCR says. At press time, 594 HIPAA breaches were reported in 2022 and under investigation by the feds, but more importantly, a whopping 472 of that total were due to a hacking or IT incident, according to the OCR breach portal.

Plus: On Oct. 21, 2022, the FBI, Cybersecurity and Infrastructure Security Agency (CISA), and Department of Health and Human Services (HHS) released a joint cybersecurity advisory on the “Daixin Team,” the latest ransomware threat to hit the healthcare sector. “The Daixin Team … deployed ransomware to encrypt servers responsible for healthcare services — including electronic health records services, diagnostics services, imaging services, and intranet services, and/or exfiltrated personal identifiable information (PII) and patient health information (PHI) and threatened to release the information if a ransom is not paid,” the advisory says.

As of October 2022, CISA has received the most ransomware complaints — more than 25 percent of the total — from the healthcare sector, out of 16 critical infrastructure sectors the agency monitors, the advisory adds.

Consider This Advice on Incident Response Management

Depending on the size and scope of your organization, you may bristle at allocating funds for HIPAA compliance. Statistics show that data security is an area that your practice may want to invest in, since “security incidents will almost inevitably occur during the lifetime of a regulated entity,” OCR reminds.

There are real and existential costs to contend with, however — particularly for smaller organizations, explains Adam Kehler, director of RSP Healthcare Services at Online Business Systems. “Small practices are at a distinct disadvantage when it comes to procuring IT and cybersecurity services. This is especially true in rural areas,” Kehler cautions. “Often they will hire the only local IT shop or an independent person that someone at the practice knows.”

He adds, “I’ve seen practices where the doctor’s spouse, sibling, or niece/nephew becomes the de facto IT person. The challenge is that just because someone can configure a firewall, doesn’t make them knowledgeable in information security and compliance.”

Cybersecurity on its own is a very diverse and nuanced field. The business of securing health data with the overlap of the various constraints, safety concerns, and regulations adds another layer of complexity and necessitates expertise in the field, suggests Jen Stone, MCIS, CISSP, CISA, QSA, principal security analyst, with Security Metrics in Orem, Utah. “Many people believe their IT people are cybersecurity professionals.”

Stone continues, “This critical misunderstanding happens in practices of all sizes, whether they have on-site staff or outsource their technology needs. While some IT groups do know and implement security, that isn’t their primary function.”

OCR offers insight on starting the process of creating a security incident response team. Here are four items to consider, according to the Cybersecurity Newsletter:

1. Staff the team with subject-matter experts. Whether you use in-house employees or hire an IT vendor, make sure your security incident response team knows the Rules and the requirements. Your structure should “use a centralized or distributed model, staff[ed] with full-time employees or partially outsource[d],” OCR says. And “ensure team members have appropriate expertise — organizational and technical.”

2. Make communicating incidents a priority. Your team must establish “relationships and lines of communication between the security incident response team and other groups (both internal and external),” OCR advises.