Healthcare Organizations Move to Streamline Third-Party Assessment Process | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

Healthcare Organizations Move to Streamline Third-Party Assessment Process

May 8, 2013
by John DeGaspari
| Reprints
Third parties continue to pose significant risks and challenges associated with safeguarding health information

The Frisco, Texas-based Health Information Trust Alliance (HITRUST) has announced that several healthcare organizations will require their business associates to participate in the HITRUST Common Security Framework (CSF) Assurance Program and submit CSF assessment reports as part of their information protection programs.

According to HITRUST’s analysis of U.S. healthcare data breaches, business associates accounted for 58 percent of the records breached, and they were implicated in 21 percent of the breaches. The organization also notes that business associates and suppliers struggle with the need to address a multitude of assessment processes utilized by the many healthcare organizations they service, resulting in significant complexities and inefficiencies that can impact the effectiveness of a security program. These redundant assessment processes also increase costs for covered entities, their business associates and the healthcare system as a whole, it says.

In an effort to standardize those proceses, HITRUST says several healthcare organizations, including CVS Caremark, Health Care Services Corp., Highmark, Humana, United Health Group and WellPoint, are announcing their commitment to leverage the CSF Assurance Program in their business associate information compliance programs and require the submission of the CSF assessment reports as part of those programs. Many healthcare organizations currently accept the CSF assessment reports, but have not required them. These organizations will now phase in the requirement for the CSF assessment and communicate the new reporting obligations to their business partners, according to HITRUST.

“We accept the CSF assessment reports from our business partners as well as maintain the capability to support our own approach to conducting third party risk assessments,” said Roy Mellinger, vice president and chief information security officer, WellPoint, in a statement.  “Unfortunately, we’ve found that managing and coordinating two separate approaches adds costs and inefficiencies for us and our partners. What we need is a single integrated approach—such as provided by a CSF assessment, which we can achieve with the right leadership to help coordinate and advance adoption across the healthcare industry, covered entities and business associates alike.”

A business associate or partner can receive hundreds of unique requests a year for some form of information protection assessment or attestation of their security controls, which requires considerable resources in trained personnel and operational dollars. Additionally, the entity requesting the assessment or attestation is burdened with ensuring that the reports are consistent, accurate and timely. More information on the CSF Assurance Program can be found at HITRUSTalliance.net/assurance.

Last month, HITRUST released new guidance for healthcare organizations to assess cybersecurity preparedness that identifies a subset of controls within the HITRUST CSF that are most directly related to detecting and thwarting cyber-related breaches.

Topics

News

NewYork-Presbyterian, Walgreens Partner on Telemedicine Initiative

NewYork-Presbyterian and Walgreens are collaborating to bring expanded access to NewYork-Presbyterian’s healthcare through new telemedicine services, the two organizations announced this week.

ONC Releases Patient Demographic Data Quality Framework

The Office of the National Coordinator for Health IT (ONC) developed a framework to help health systems, large practices, health information exchanges and payers to improve their patient demographic data quality.

AMIA, Pew Urge Congress to Ensure ONC has Funding to Implement Cures Provisions

The Pew Charitable Trusts and the American Medical Informatics Association (AMIA) have sent a letter to congressional appropriators urging them to ensure that ONC has adequate funding to implement certain 21st Century Cures Act provisions.

Former Michigan Governor to Serve as Chair of DRIVE Health

Former Michigan Governor John Engler will serve as chair of the DRIVE Health Initiative, a campaign aimed at accelerating the U.S. health system's transition to value-based care.

NJ Medical Group Launches Statewide HIE, OneHealth New Jersey

The Medical Society of New Jersey (MSNJ) recently launched OneHealth New Jersey, a statewide health information exchange (HIE) that is now live.

Survey: 70% of Providers Using Off-Premises Computing for Some Applications

A survey conducted by KLAS Research found that 70 percent of healthcare organizations have moved at least some applications or IT infrastructure off-premises.