HITRUST Releases New Guidance for Healthcare Organizations to Assess Cybersecurity Preparedness | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HITRUST Releases New Guidance for Healthcare Organizations to Assess Cybersecurity Preparedness

April 10, 2013
by John DeGaspari
| Reprints
HITRUST Releases New Guidance for Healthcare Organizations to Assess Cybersecurity Preparedness Rise in Cyber Threats Targeted at the Healthcare Industry Leads to Increased Industry Awareness

In response to heightened awareness and concerns about cyber threats, attacks and incidents, the Health Information Trust Alliance (HITRUST) announced today new guidance for healthcare organizations wanting to assess the state of their cybersecurity preparedness. The guidance identifies an appropriate subset of controls within the HITRUST Common Security Framework (CSF) that are most directly related to detecting and thwarting cyber-related breaches and allows organizations to assess against the cyber-specific controls and receive a snapshot of their cyber capabilities and readiness. 

“As predicted, HITRUST has seen a marked increase in the frequency and sophistication of cyber attacks targeted at healthcare organizations,” said Daniel Nutkis, chief executive officer, HITRUST. “What is raising concerns is the amount of personal health information misappropriated from health plans and providers that is for sale on the various hacker forums. As the sophistication and intensity of cyber attacks increases, HITRUST believes it is more critical than ever that healthcare organizations have the appropriate safeguards in place and a means by which to review their current level of preparedness.”

More than a year ago HITRUST established the HITRUST Cyber Threat Intelligence and Incident Coordination Center (C3). The HITRUST C3 provides cyber threat intelligence and incident coordination specific to healthcare organizations and acts as a vehicle for sharing cyber threat information between healthcare organizations and the government. The signing of the White House Cybersecurity Executive Order in February 2013 has added to the awareness and sensitivity of the risks associated with cyber threats and escalating need for cybersecurity preparedness, according to HITRUST.

The HITRUST Cybersecurity Working Group was established to review the CSF and ensure the controls fully incorporate best practices consistent with the various risk factors related to cybersecurity for healthcare organizations. Given the increasing volume, sophistication and risks associated with cyber attacks perpetrated on healthcare organizations and increased awareness by legislators and regulators, HITRUST believes there is real value in providing additional guidance to organizations wanting to review their current level of preparedness, according to the group.

With this guidance, organizations not yet assessing themselves against all the CSF controls will be able to focus immediately on the specific set of CSF controls that are highly related to cybersecurity. They will then be well positioned to complete a full CSF assessment in the future.

The working group will meet at HITRUST’s annual conference in May 2013 to receive industry comments and finalize the guidance. HITRUST does not expect significant changes to the guidance and is releasing the guidance in its current state so that organizations are not delayed in assessing their cybersecurity preparedness.  The working group is also responsible for coordinating the submission of HITRUST’s recommendations to the National Institute of Standards and Technology (NIST) relating to the development of a national Cybersecurity Framework as outlined in the Executive Order. 

Organizations can download a white paper published by HITRUST that describes a basic risk management framework (RMF) and details the HITRUST RMF. 

The new cybersecurity guidance is available for review via HITRUST Central.

Topics

News

Stanford and Google Team Up on Digital Scribe Pilot Project

Stanford Medicine and Google Research have launched a pilot project to study the use of a digital-scribe to replace a human scribe in order to save the physician time on data entry and improve physician-patient interaction.

PCORI Board Funds 14 Clinical Effectiveness Research Projects

The Patient-Centered Outcomes Research Institute (PCORI) board of governors has approved $57 million to fund 14 new comparative clinical effectiveness research studies.

House Committee Calls on HHS to Enhance Security of Medical Device Components

The House Committee on Energy and Commerce is calling on the U.S. Department of Health and Human Services (HHS) to take steps to strengthen the cybersecurity of medical devices by focusing on the security of technology components.

Healthcare Industry Leaders Submit Comments on Future of CMMI

Responses to the CMS' request for information on the Innovation Center New Direction were due Monday, and several health IT and healthcare industry organizations submitted feedback on the future of CMMI.

HHS OIG to Review Medicaid Telehealth Payments

The U.S. Department of Health and Human Services (HHS) Office of the Inspector General (OIG) plans to review Medicaid payments for telehealth services to gauge compliance with reimbursement requirements.

Survey: Health IT is Underfunded at European Healthcare Organizations

Health IT is not sufficiently funded and supported at most European healthcare provider organizations, according to an eHealth survey from HIMSS Analytics.