Healthcare orgs have to achieve true cybersecurity, not only compliance

How many organizations in the healthcare sector are conforming with the HIPAA Security and Privacy Rules and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)?

According to a report by CynergisTek, which is based on aggregate ratings from privacy and security assessments performed in 2018 at nearly 600 healthcare provider organizations and business associates across the US, an average of 72% of orgs conform with the HIPAA’s rules and a 47% with NIST CSF controls.

This reflects only a 2% increase with conformance with NIST CST and a 2% decrease in conformance with the HIPAA Security Rule from the previous year’s findings.

Key findings

Additional findings and insights from the Measuring Progress: Expanding the Horizon report include:

• 74% of unauthorized insider access to patient records was users’ household members and the second most common was accessing high profile (VIP/confidential) patient data.
• Over 60% of privacy assessments found gaps in maintaining written policies and procedures to guide workforce members in managing all or some of these uses and/or disclosures of PHI.
• The most common gaps among third-party vendors included risk assessment, access management, and governance.
• In terms of the Five Core Functions, there was a surprising .4% decline in Awareness and Training this year.
• The average rating for the Respond and Recover Function was 2.5 (on a scale of 0 – 5), indicating the healthcare industry is still not as prepared to respond to a cyber incident as they should be.

Need for cybersecurity investments

CynergisTek’s 2019 report demonstrates that compliance and security are not one-in-the same. After being in effect for 14 years, the industry is still only achieving 72% compliance on the HIPAA Security Rule, a C-level grade at best.

From a technical security perspective, this rule is no longer as relevant, since being compliant with an older, out of date rule is not about security, it is about checking boxes, and that is not a measure of risk posture or actual security.

The report results highlight the growing need for healthcare organizations to make serious investments in cybersecurity readiness, as cybersecurity has become one of the top business risks facing healthcare today.

“The slight decline in the Awareness and Training category under the Protection Function is very alarming considering how much more sophisticated attackers were with targeted phishing attempts and new attack vectors, such as medical devices,” said David Finn, Executive Vice President of Strategic Innovation at CynergisTek.

“Furthermore, the fact that we did not see any improvement in either the Respond or Recover functions means we may be losing even more ground with the increased number of attacks last year. Organizations need to take into account whether their individual security needs are actually being met in order to be truly secure, and not only compliant.”