Common Weaknesses Healthcare Providers Must Overcome to Avoid Regulators’ Wrath
Federal regulators have long pushed HIPAA-regulated organizations to improve their security risk analysis to ensure it’s comprehensive, enterprise-wide and timely so they can identify security issues before they become data breaches.
See Also: What Manufacturing Leaders Are Learning About Cloud Security – from Google’s Frontline
Department of Health and Human Services regulators have decried the poor state of risk analysis in healthcare through awareness campaigns, random audits, breach investigations and heightened enforcement actions including fines and corrective action plans.
So, why do so many organizations struggle with this top HIPAA priority?
According to the experts, many healthcare organizations somehow haven’t gotten the message about risk analysis, or they completed the exercise but they still don’t have a good inventory on PHI assets, or the information is woefully out of date.
“Organizations rely on outdated asset inventories, assume that high-level reviews are sufficient, or treat the process as a ‘check-the-box’ compliance exercise rather than a living part of risk management,” said Dave Bailey, vice president of consulting services at security and privacy firm Clearwater.
The Cost of Inaction
HHS’ Office for Civil Rights for over a decade has spotlighted in the agency’s audits and breach investigations faulty HIPAA security risk analysis as the most commonly found weakness among healthcare providers and business associates.
Last October, the HHS OCR further intensified its focus on risk analysis, naming it a top initiative in its HIPAA enforcement program.
Since then, the agency has dished out nearly a dozen settlements and financial penalties in cases in which HHS OCR investigators found weak or non-existent HIPAA security risk analyses at the breached entities.
HHS OCR announced the latest such action on Monday – a $175,000 financial settlement and corrective action plan with New York-based accounting firm, BST & Co. CPAs LLP, in a 2019 ransomware breach affecting 170,000 individuals (see: Accounting Firm Pays Feds $175K for HIPAA Ransomware Breach).
The HIPAA enforcement agency – like in so many of its breach investigations – determined that BST “failed to conduct an accurate and thorough risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information.”
Some experts say comprehensive and accurate risk analysis still falls through the cracks despite years of HHS OCR prodding HIPAA-regulated firms to clean up their acts.
“First, some organizations do not perform a risk analysis at all, either believing they can fly under the radar or don’t have resources to conduct one,” said Wendell Bobst, partner and principal consultant at privacy and security consulting firm tw-Security. “Second, we’ve seen some organizations conduct a gap analysis on HIPAA compliance. This is not a risk analysis,” he said.
Most often both HIPAA-covered organizations and business associates in their risk analysis “miss the crucial and fundamental first step of an inventory of all of the enterprise ‘assets’ and vendors that create, receive, maintain, or transmit electronic protected health information,” said regulatory attorney Iliana Peters of the law firm Polsinelli.
“In other words, such entities must document all of the systems – devices, applications, servers, etc. – and vendors that hold ePHI to start,” she said. “Then, they must follow the NIST 800-30 requirements for enterprise risk analysis,” she said.
“HIPAA risk analysis is not an audit of the HIPAA requirements, and if the entity receives a list of the requirements of the HIPAA Security Rule from their vendor, they’ve wasted their money,” she said. “The risk analysis must track the ePHI in the assets and vendors and assess the risk given the specific controls implemented to those assets and vendors.”
Common Omissions
Some experts said that very often risk analyses either omit certain systems and processes from scope or fail to drill down into specific vulnerabilities.
Bobst said that he finds that risk analysis often overlooks the safeguarding of legacy systems, such as a previous electronic medical record system, that are still maintained on the network.
Risks could be related to data migrated from an old to a new system, or not sufficiently migrating ePHI and leaving important content in the old system.
Bailey has seen similar issues with archived or legacy databases. “Older systems that may still store PHI but are rarely included in risk analysis because they’re ‘out of sight, out of mind,'” he said.
Other commonly overlooked devices and systems containing ePHI include shadow IT such as unapproved tools and cloud apps adopted by staff without formal vetting; medical IoT devices such as imaging systems, infusion pumps and other connected devices that often run on outdated, unsupported operating systems; and third party-hosted applications, such as portals and analytics platforms, run by vendors but integrated into workflows, Bailey said.
“This happens due to incomplete asset inventories, poor cross-department communication and a lack of formalized discovery processes during mergers, acquisitions or system migrations,” he said.
Other areas of neglect include a lack of depth and documentation, which shows auditors how risks were identified and mitigated.
Ongoing Task
Sometimes shortcomings involve a regulated organization having a “one-and-done” mindset around risk analysis.
Bobst recommends that HIPAA-regulated organizations perform a security risk analysis at least annually. But he adds that a risk analysis should be conducted “any time a major change in technology infrastructure occurs.”
Bailey agrees. “Risk analysis should be part of an ongoing, continuous risk management program – not a once-a-year compliance event.”
Organizations should reassess whenever there are significant operational or technical changes, such as implementing new EHR modules, migrating to the cloud, merging with another entity, or deploying new connected medical devices.
Bailey also suggests incorporating “interim reviews” into risk analysis when major threat landscape shifts occur, such as a surge in healthcare-targeted ransomware campaigns.
The Long View
Is meeting HHS OCR’s HIPAA security risk analysis expectations “enough” of an analysis to keep up with today’s cyberthreats?
“It is a good start. However, HIPAA security risk analysis is part of the 20-plus-year old HIPAA Security Rule,” Bobst said. “Technology and threats have significantly evolved since then,” Bobst said.
“Risk analysis should include how well prepared an organization is for ransomware attacks. To be more comprehensive, risk analysis should also include more than ePHI,” he said.
“Personally identifiable information, such as Social Security numbers, credit card numbers, bank account numbers, etc. are confidential data types that are typically governed by state law. Healthcare organizations often store these types of PII in HR systems, including payroll data,” he said.
To go beyond HIPAA’s baseline requirements, Bailey suggests organizations should:
- Align with a broader cybersecurity framework such as NIST CSF or ISO/IEC 27001 to address enterprise-wide risks, not just those tied to HIPAA compliance;
- Simulate breach scenarios to validate the effectiveness of controls and incident response plans;
- Integrate risk analysis into vendor management, ensuring business associates undergo regular security evaluations.
Elevate cyber risk governance to the board level, ensuring leadership understands cyber risks in business terms;
“These additional steps close the gap between compliance and real-world resilience,” he said.