When patients walk into a doctor’s office, they trust providers not only to keep their bodies safe, but also their private healthcare information. This sense of security is quietly assured in the background as healthcare IT professionals work tirelessly to protect the digital health landscape.
The healthcare ecosystem consists of a network of organizations that support healthcare providers, starting with the doctors’ offices and hospitals we all trust to keep our protected health information (PHI) safe. These major organizations partner with a variety of third-party vendors, including digital health companies, to enhance the patient experience.
Third-party providers are critical in providing support services to patients around the world, but not all of these businesses fall under the HIPAA umbrella, nor are all obligated to comply with its regulations. In these cases, major organizations must set standards for their suppliers through contract language, rather than all parties independently upgrading to a common standard.
While patients may trust their providers, they are often unaware of the larger devices that underpin their healthcare experience. This implicit trust should force active vigilance among health professionals managing patient data. In healthcare, any organization can implement a digital security gold standard to ensure the highest standards of security: HITRUST.
HITRUST is a framework for systematically managing digital security well above HIPAA requirements. Its rigor explains why it can be daunting to implement, and why no healthcare company should be without this certification.
More than just HIPAA
this Health Insurance Portability and Accountability Act (HIPAA) was enacted by the U.S. government to protect the electronic exchange, privacy, and security of health information. However, HIPAA does not provide a mechanism to protect that information; it just outlines the standards that should be followed. Without a HIPAA certification process or a dedicated law enforcement agency, this current legislation is left open to interpretation, and “HIPAA compliant” is a subjective statement.
Security-conscious organizations recognize the need for standardization and accountability around these guidelines. As a result, numerous platforms, processes and regulators have emerged to protect protected health data.this HITRUST Alliance Founded in response to an increase in security options, the goal is to create a systematic and comprehensive approach that any company can follow to ensure the security of data across its organization.
HITRUST (formerly Health Information Trust Alliance) is a privately held organization in Frisco, Texas that ensures companies meet current and future security benchmarks through what it calls the Common Security Framework (CSF). The HITRUST Alliance provides certification within this framework to differentiate compliant organizations. The robustness of its approach has not only made HITRUST CSF certification an industry standard, it is now required by most primary care organizations.
Given the recent escalation in cybercrime, especially since the emergence of Covid-19, the importance of HITRUST across the healthcare ecosystem has become even more important. Ransomware Attacks on Healthcare Organizations Specifically, an analysis reports that the global healthcare industry has grown by 45% since November 2020, while other industries have only grown by 22%. In a healthy ecosystem that is increasingly reliant on digital systems, we are more vulnerable than ever to cybercriminals who either seek personal data or hold it for ransom.
HITRUST certification seems like the obvious way to protect everyone, but many third-party health companies have yet to adopt it. The answer to why starts with understanding what it means to be HITRUST certified.
Rigorous benefits
HITRUST certification is unique because of its rigour. The Alliance is an alliance of cybersecurity expertise that continues to evolve as technology and security threats become more advanced. As part of its certification process, HITRUST evaluates over 150 controls (or requirements) that need to be regularly maintained and updated in order for companies to remain certified.
Certified
Certification begins with a comprehensive review that can take months or more, including a revolving door of questions, answers, evidence gathering, and clarification. Policies and procedures need to be documented and evidenced for encryption and other security markets for critical covered systems.
HITRUST requirements are tied to focus categories such as endpoint protection, access control, network protection, and auditing and logging. If there is a gap in meeting the requirements, the health organization will not receive a stamp of approval. Anything new must be at least 90 days old to meet control requirements, so certification and action plans may be affected.
Once the audit is complete, security breaches are discovered. A Corrective Action Plan (CAP) must be developed to proceed with certification. For example, if an auditor finds that you do not have a written policy for contractors who have minimal access to your servers, you will need to develop a plan to create that policy and report progress against the goal as outlined by the CAP.
Audits and the following CAPs are administered by a HITRUST approved auditor employed by a certified company. The HITRUST Alliance conducts quality assurance reviews of audits and spot checks work as needed.
These layers of review ensure high standards and require a lot of time and manpower. Once certified, it doesn’t stop; ongoing maintenance is required, including quarterly reviews of security, ongoing security training for all levels of staff, and testing business continuity and disaster recovery plans, among others.
There are obvious reasons why many companies do not accept HITRUST certification, if not required by law. Both budgetary costs and human resource costs create barriers to entry. But considering if your company or partners suffer the consequences of a security breach, the upfront cost each time seems worth it.
Build better partnerships
In addition to the peace of mind of the safety itself, there are logistical advantages to becoming a HITRUST certified healthcare provider. For the customers of these suppliers, especially pharmaceutical companies, payers and suppliers, HITRUST is a seal of approval that indicates the quality of the supplier. Any company committed to this level of rigor will stick with its products and invest in its services to the same degree.
HITRUST certified suppliers are easier to onboard and integrate into customers’ workflows. HITRUST eases the burden of due diligence as certification ensures best practices around digital security. If partners need to integrate electronic health records (EHR), HITRUST can simplify marriages and ease the workload of customers integrating new services.
Ultimately, HITRUST instills confidence in potential partners and helps new projects get to market faster.
It is imperative that digital health companies not only earn the trust of their customers and their patients, but also actively hold to the highest possible standards. HITRUST certification helps organizations do just that. Without this level of trust, the integrity of the system is compromised.
Photo: Tratov, Getty Images
