Free Healthcare ‘Toolkit’ Ranks and Maps Third-Party Risk

Third-party security and supply-chain risk are among the most complicated and persistent challenges for the healthcare sector because of the sheer volume and wide variety of vendors involved and the mission-critical products and services they provide to hospitals and medical practices.

See Also: OnDemand | CISO Leadership Blueprint to Managing Budgets, Third-Party Risks & Breaches

The Health Sector Coordinating Council has issued a new free guidance document to help all types of health sector organizations – including patient care providers, health plans, insurance firms and manufacturers – navigate those difficult decisions.

The HSCC said its Health Industry Cybersecurity Sector Mapping and Risk Toolkit – or SMART, which was released on Tuesday, was developed over the past 16 months with cross-sector collaboration among 80 organizations across all subsectors of healthcare, such as patient care, insurance, labs, pharmaceutical and blood services, medical technology, public health and health IT.

The SMART Toolkit provides templates and a methodology “to visualize, identify and measure systemic risk posed by third-party technology, software and communications services essential to clinical, administrative and manufacturing workflows,” HSCC said.

The guidance is intended for use by cyber, supply chain, risk, operational and administrative executives across health industry organizations of all sizes and subsectors, HSCC said.

“A cybersecurity event affecting a single supplier or third-party product that supports a critical function across healthcare poses one-to-many problems, such as a disruption to a single payment clearinghouse can shut down a significant portion of the nation’s healthcare delivery,” HSCC said.

That’s not just a notion, but something that actually already played out in the U.S. health ecosystem after the February 2024 ransomware attack at UnitedHealth Group’s Change Healthcare. IT services units disrupted the business and patient care of thousands of medical practices, pharmacies and other types of organizations for months.

“The SMART Toolkit approaches third-party risk from a different perspective,” said Samantha Jacques, vice president of clinical engineering for McLaren Health in Michigan, and co-lead of the HSCC’s cybersecurity working group’s task force that developed the SMART toolkit.

Instead of treating all third parties the same by assessing all of them using the same rubric, as many organizations do, the toolkit breaks down the potential risk factors, she said.

For instance, it asks organizations to define what “materiality” risk means for that particular organization. “What will stop the organization from being viable, profitable or able to attain its mission?” she said.

The toolkit guides healthcare organizations in identifying workflows that are critical to the functioning of the organization; vendors, third parties, software and other products or services in those critical workflows that are material to the functioning of the organization; and to focus assessment on these critical third parties that could affect the organization significantly, if compromised, she said.

The toolkit also directs “the effort of limited resources to mitigating the risks discovered in these assessments to reduce the risks, making a larger impact with the resources available,” she said.

“Ultimately implementing this methodology has the opportunity to change the way organizations spend their effort,” she said.

“Instead of taking 80% of effort and spending it on assessing third parties and their risk, and the other 20% on mitigating the risk, we can instead use this methodology to flip this effort and spend 20% assessing risk and use 80% of our time mitigating the risk we have identified,” she said.

“This will ultimately help organizations be more prepared for unknown events in the future.”

Prioritizing Vendor Risk

Indeed, one fundamental mistake many healthcare organizations make is assuming all suppliers in their portfolio bear the same level of risk, resulting in spending unnecessary time, money and effort managing “low-risk suppliers,” said Steven Adler, partner at risk mitigation consulting firm The Edmund Group, and former director of enterprise third-party risk management at health insurer Humana.

“HSCC’s SMART Toolkit will provide clarity and guidance to cyber and risk teams within healthcare organizations to identify those most critical healthcare delivery functions that drive continuity of care but also those underpinning third parties, which support those functions,” said Adler, who was not involved in the development of the guidance.

It’s imperative for healthcare sector entities to prioritize their third-party risks, he said.

“First and foremost, healthcare organizations regardless of size or market cap, need to recognize this sector is highly regulated with increasing enforcement from federal and state regulators in addition to scrutiny from ‘administrative services only’ clients and consumers,” he said.

ASOs include employers that self-fund employee benefit plans, such as health insurance, but contract with a third party to manage the administrative tasks.

“The next step is to take preventative steps to identify your most important risks and suppliers, keeping your patient and consumer centric approach throughout the process,” he said.

The supplier risk model should be developed using predetermined components such as volume of protected data, strategic importance and annual spend, then “ultimately assigning suppliers to specific risk tiers,” Adler said.

“This model will assist healthcare organizations in risk prioritization of their suppliers for more effective oversight,” Adler said. HSCC’s SMART toolkit can help healthcare organizations begin to build out their “risk road map,” he said.