HITRUST CSF Meaningful use risk assessment

2,212 views
1,989 views

Published on

0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
2,212
On SlideShare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
77
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

HITRUST CSF Meaningful use risk assessment

  1. 1. Meaningful Use Privacy and Security Risk Assessment: What it is and How to Approach it Leveraging the CSF and CSF Assurance ProgramJune 2011
  2. 2. IntroductionHITRUST continues to receive questions on performing a risk assessment formeaningful use. This document is being released as guidance to provide thehealthcare industry with a clear process to satisfy the privacy and securityrequirements of meaningful use.This guidance is intended for security and compliance professionals of healthcareproviders and is divided into three sections:1. Quick start guide to conducting a risk assessment for Stage 1 meaningful use security and privacy requirements2. Background on meaningful use and the Stage 1 security and privacy requirements for conducting a risk assessment3. The recommended approach for conducting an efficient and effective risk assessment leveraging the CSF Assurance program1 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  3. 3. Conducting your Meaningful Use Risk Assessment Five steps to getting started with the CSF Assurance Program: 1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your meaningful use risk assessment.* 2. Identify your scope – Details on slides 15 and 40 3. Perform an assessment using the Common Health Information Protection Questionnaire (CHIP) and Compliance Worksheet.** – Details on slides 16-20 and 42-43 4. Submit your CHIP to HITRUST 5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP – Details on slides 23-24 and 46-48 6. Register and attest for meaningful use Stage 1 – Details on slides 26-30*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visithttp://www.hitrustalliance.net/assurance/**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g.,HIPAA Security Rule) © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved. 2
  4. 4. Meaningful Use Stage 1 Requirements for Privacy and Security3 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  5. 5. What is Meaningful Use?• The use of a certified EHR [system/technology] in [a] meaningful way: – For the electronic exchange of health information to improve the quality of health care, and – To submit clinical quality and other measures (to federal and state agencies)• Stage 1 requirements (2011 and 2012) – For eligible hospitals and critical access hospitals • 25 MU objectives – 15 core objectives that are required » Includes the protection of electronic health information – 5 of 10 menu set objectives that are optional – For eligible professionals • 24 MU objectives – 14 core objectives that are required » Includes the protection of electronic health information – 5 of 10 menu set objectives that are optionalSource: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asp4 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  6. 6. Why Pursue Meaningful Use?• Medicare and Medicaid provide financial incentives for the meaningful use of certified EHR technology to achieve health and efficiency goals.• By [implementing] and meaningfully using an EHR system, providers: – Receive financial incentives (complex formula) • Hospitals (Health System = Hospital) – Base of $2 million—up to 1,149 acute inpatient discharges for prior 12 months – Maximum of $6,370,200—$200 for each additional discharge up to 23,000 • Critical Care Hospitals will be paid “on reasonable costs” • Eligible Providers – Between $24K and $44K based on first calendar year submitted – Avoid reductions in Medicare and Medicaid payments beyond 2015 – Reap benefits beyond financial incentives (e.g., reduction in errors, availability of records/data, reminders and alerts, clinical decision support, and e- prescribing/refill automation)Source: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asphttp://journal.ahima.org/2010/08/26/meaningful-use%E2%80%94incentive-payments-and-program-requirements5 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  7. 7. What are the Security & Privacy Requirements?• Stage 1 MU Measure – Protect [ePHI] created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities• Stage 1 MU Objective – As part of [an overall] risk management process • Conduct or review a security risk analysis [per the HIPAA Security Rule] (45 CFR 164.308(a)(1)) • Implement security updates as necessary • Correct identified security deficiencies• Stage 1 MU Attestation – Organizations must conduct a risk analysis at least once prior to the end of the EHR reporting period with supporting documentation and updates implemented as necessary – You’re attesting to the government, which implies civil and/or criminal penalties for false statements … so take attestation very seriously!Source: http://www.cms.gov/EHRIncentivePrograms/Downloads/14HC-ProtectElectronicHealthInformation.pdf 6 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  8. 8. What is a Security Risk Analysis?• The Security Rule describes a “risk analysis” as “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information [ePHI]”• Conducting a risk analysis is the first step in identifying and implementing safeguards that comply with and carry out the standards and implementation specifications in the Security Rule• Additionally, the Security Rule requires entities to implement reasonable and appropriate security measures to protect against reasonably anticipated threats or hazards to the security or integrity of ePHI• However the Security Rule does not prescribe a specific risk analysis methodology …Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf 7 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  9. 9. What are the Elements of a Risk Analysis? • Scope the Analysis – Include the potential risks and vulnerabilities to the confidentiality, availability and integrity of all ePHI that an organization creates, receives, maintains, or transmits (45 CFR § 164.306(a)) • Collect Data – Identify where ePHI is stored, received, maintained or transmitted (See 45 CFR §§ 164.308(a)(1)(ii)(A) and 164.316(b)(1)) • Identify and Document Potential Threats and Vulnerabilities – Identify and document reasonably anticipated threats to ePHI (See 45 CFR §§ 164.308(a)(1)(ii)(A) and 164.316(b)(1)(ii)) • Assess Current Security Measures – Assess and document the security measures an entity uses to safeguard ePHI (See 45 CFR §§ 164.306(b)(1), 164.308(a)(1)(ii)(A) and 164.316(b)(1)) – In other words, conduct an information security risk assessmentSource: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf 8 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  10. 10. Guide to Meaningful Use Risk Assessments1. Demonstrate reasonable practices A. Select a sound risk assessment methodology B. Align controls with industry standards and best practices2. Be efficient—you’ll need resources for remediation efforts A. Meaningful use focuses on your certified EHR not the whole environment B. Use sampling techniques in your environment for similar implementations C. Don’t forget physician practices—they are an entry point into your environment3. Take remediation seriously A. Develop prioritized corrective action plans, but be careful not to over- commit or under-commit resources, as this could expose you to cost overruns or non-compliance with regulatory requirements B. Actively manage remediation as a portfolio of projects and initiatives9 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  11. 11. Demonstrate Reasonable Practices10 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  12. 12. Select a Sound Risk Assessment Methodology• Identify an information security risk assessment approach that – Scopes (tailors) the assessment – Prepares for the assessment – Reports assessment results – Tracks and measures progress (corrective actions)• If you use a third party to assist with or conduct the assessment, ensure their “proprietary” methodology incorporates the above-listed items• Identify standard templates for documenting results and developing corrective action plans• Many organizations confuse a technical evaluation of controls with a risk assessment, however, these are different concepts and different requirements under HIPAA11 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  13. 13. Fundamental Risk Assessment Approach 1. 2. 3. 4. Prepare for Assessment Report Track andDetermine Scope Measure Progress - Focus on high risk areas - Establish a - Identify individuals PM over the responsible for key - Report of remediation - Applications, control areas findings - Track progress interfaces, against industry infrastructure - Conduct top down - Remediation enterprise control plan benchmarks analysis - Focus on - Do not get stuck in the measures weeds12 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  14. 14. Align Control Decisions with Industry Standards• Seek an integrated information security and compliance framework COBIT• Choose a controls-based approach that is ISO 27001/2 – Comprehensive HITECH – Prescriptive Act – Certifiable HIPAA PCI Security• Define control practices tailored Mngfl. for use in a healthcare State Use Reqs. environment NIST 800-5313 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  15. 15. Be Efficient14 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  16. 16. Focus on the Certified EHR System• Within scope of a review – All servers that run any module of the certified EHR – The wide area and local networks supporting the EHR – Information/data exchange interfaces with other systems – Workstations, laptops or portable media used to access the EHR – Vendors that support or have access to data in the EHR – People, process, policies and standards that are related to the control of the above components• Potentially out of scope – Third party applications that do not interface with the EHR (for example, payroll system would not be included in scope) – Network environments that are isolated from the wide area network or the network connected to the EHR15 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  17. 17. Testing• Testing of controls to identify risks may include one or all of the following components: – Interview of key personnel responsible for security, IT and key business processes – Review of documentation related to the security practices of the organization and systems – Technical testing of application, system and hardware configurations © 2010 HITRUST LLC, Frisco, TX. All Rights Reserved.16
  18. 18. Example Interviews• Types of roles to interview: – Web application manager – Internal audit – Security assurance manager (risk management, business continuity management, vulnerability management, training and awareness, security policies) – Monitoring and response manager – Server engineering – Desktop engineering – Human resources – Access and identity management – Application developer – Operations/office manager – Legal counsel17 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  19. 19. Example Documents to Review (i)• Asset inventory with risk classification• Network diagram• Organization chart• Business associate agreement template• Risk assessment program – Application assessment questionnaires – Sample web application assessments – Sample network vulnerability assessments – Sample attack and penetration report• Project/engagement hierarchy• System configuration checklists18 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  20. 20. Example Documents to Review (ii)• Business continuity management program – Business impact analysis templates – Business continuity plan template – Disaster recovery plan template – Sample business continuity and disaster recovery plans• Sample security awareness and training materials• Policies and standards framework – Policy and standards third party review report• Incident monitoring and response program and associated procedures• Security council charter19 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  21. 21. Use Sampling Techniques Where Appropriate• General rule of thumb – Use sampling when: • Environment is under the same management control • Departments/facilities/systems are subject to the same policies and procedures • Portions of hybrid enterprise/local environments are under enterprise control – Assess everything if sample indicates excessive variability• Multi-facility systems – Scope is directly impacted by the level of standardization • Highly standardized with enterprise level controls – Select a random sample of like facilities to assess risks (e.g., assess a sample of large acute care, smaller acute care and of outpatient facilities) • Little standardization – Select a sample of facilities to assess any enterprise wide or centrally managed controls (e.g., assess how effectively the enterprise wide patch management function is operating at a sample of facilities) – Assess non-standard controls at every facility (e.g., if facilities contract and manage data disposal independently, then assess this process at every facility)20 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  22. 22. Assist Physician Practices• Physician practices: – Introduce significant vulnerabilities into an EHR system of a hospital or health system – Generally do not have the expertise or resources to conduct a risk assessment• To assist: – Physician practices that run on a hospital’s EHR and are subject to hospital policies • Leverage hospital assessment for any controls under direct control of the hospital (e.g., the patching and configuration of the EHR servers) • Select a sample of practices to assess how effectively hospital policies are implemented (e.g., clear desk policy, password management policies) – Physician practices that run on a hospital’s EHR, but aren’t subject to hospital policies • Leverage hospital assessment for any controls under direct control of the hospital (e.g., the patching and configuration of the EHR servers) • For each practice, assess controls under the management of the physician practice (e.g., security policies, workstation security)21 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  23. 23. Take Remediation Seriously22 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  24. 24. Develop Sound Corrective Action Plans• Develop a methodology for the development of corrective action plans (CAPs) … what the federal government refers to as “Plans of Action and Milestones” – Integrate CAP development into existing processes where possible • Project management • Ticketing systems (or other workflow management) • Change control – Automate with a governance, risk and compliance (GRC) system/tool when possible• Obtain or develop training materials for control owners and other stakeholders (e.g., management) to understand and implement the CAP methodology• Train your control owners and other stakeholders23 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  25. 25. Actively Manage Remediation• HIPAA (in general) and meaningful use (in particular) requires the remediation of identified security deficiencies – It’s sufficient for Stage 1 meaningful use to develop formal corrective action plans – However, there is an expectation that these corrective actions will be taken – Failure to take reasonable and appropriate measures to remediate deficiencies would be a violation of the HIPAA Security Rule and could make an organization subject to federal and state civil and criminal penalties for making false statements• Use project management principles and techniques to actively manage remediation activities as a single portfolio – Management should formally approve all corrective action plans – Remediation activities should be actively monitored and CAPs updated accordingly – CAP status should be reported to senior management on a regular and timely basis (along with other security risk metrics), such as: • Number of CAPs developed and approved as a percentage of identified deficiencies • CAP progress such as percentage on-time or behind schedule sorted by risk • Number of CAPs remediated over time as a percentage of all CAPs actively managed24 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  26. 26. Additional Information: Attestation of Meaningful Use25 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  27. 27. Attestation … How to get the money• Medicare hospitals’ EPs must attest, through “secure mechanism approved by CMS,” that they have “satisfied the required objectives and associated measures” of §495.6• Calendar years 2011 and after (no provision for demonstration), except that EPs using certified EHR need not attest until 2012 (42 CFR §§ 495.8; 495.210)• Medicaid providers must attest: “This is to certify that the foregoing information is true, accurate, and complete. I understand that Medicaid EHR incentive payments submitted under this provider number will be from Federal funds, and that any falsification, or concealment of a material fact may be prosecuted under Federal and State laws.” (42 CFR §§ 495.368)26 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  28. 28. Attestation … Associated Risks (i)• Comment: “A commenter indicated that attestation is an insufficient means to hold providers accountable for the expenditure of public funds and to protect against fraud and abuse.” (Federal Register Vol. 75, No. 144, p. 44324)• Response: “We likewise are concerned with the potential fraud and abuse. However, Congress for the HITECH Act specifically authorized submission of information as to meaningful use through attestation. CMS is developing an audit strategy to ameliorate and address the risk of fraud and abuse.” (Ibid.)• CMS (Medicare) and states may “review an EP, eligible hospital or CAH’s demonstration of meaningful use.” (42 CFR § 495.8)• States required to “annually collect and verify information regarding the efforts to adopt, implement, or upgrade certified EHR technology and the meaningful use of said technology before making any payments to providers.” (42 CFR § 495.366)27 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  29. 29. Attestation … Associated Risks (ii)• States are required to ensure the qualifications of the providers who request Medicaid EHR incentive payments – Detect and take corrective action for improper payments to providers – Refer suspected cases of fraud and abuse to Medicaid Fraud Control Unit (42 CFR § 495.368)• HITECH incentives audits• HIPAA compliance investigations• Security breach investigations• Federal/state false claims act penalties• Whistleblower (qui tam) lawsuits• Federal/state program disqualification• Criminal/civil fraud actions28 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  30. 30. Attestation … Manage the Risks• Risk analysis is a process, not a product• Follow HIPAA “flexible factors” and “reasonable and appropriate” standards in determining updates and corrections• Show due diligence in risk identification and update and correction implementation – Use appropriate professional expertise – Incorporate “reasonable practice” information from industry, professional communities – Strongly consider the use of outside expertise29 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  31. 31. Attestation … Perform “Due Diligence”• Make sure attesting officer is properly informed about risks, updates, corrections, etc. – Create and retain supporting documentation file – In any field where officer does not have appropriate expertise, ensure s/he is briefed and provided with supporting documentation from appropriate experts – Good “business judgment” is the attesting officer’s best friend• Show your work! – Document risk analysis process and findings – Document implementation of updates and corrections – Providers must retain “documentation supporting their demonstration of meaningful use for 6 years” after attestation • Note HIPAA has same document retention period Source: John R. Christiansen, Esq., Christiansen IT Law30 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  32. 32. Meaningful Use Privacy and Security Risk Assessment: Leveraging the HITRUST CSF Assurance Program31 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  33. 33. Guide to Meaningful Use Risk Assessments1. Demonstrate reasonable practices HITRUST Common A. Select a sound risk assessment methodology Security B. Align control decisions with industry standards/practices Framework2. Be efficient—you’ll need resources for remediation HITRUST CSF A. Meaningful use focuses on your certified EHR Assurance not the whole environment A. Use sampling techniques in your environment for similar implementations B. Assist physician practices—they are an entry point into your environment HITRUST CSF3. Take remediation seriously Assurance A. Develop sound corrective action plans but be careful not to over-commit or under-commit resources, as this could expose you to cost overruns or non-compliance with regulatory requirements B. Actively manage remediation as a portfolio of projects and initiatives32 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  34. 34. Demonstrate Reasonable Practices33 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  35. 35. Select a Sound Risk Assessment MethodologyThe CSF Assurance assessment is based on NIST and ISO standards forevaluating risk Likelihood Impact Risk Residual Risk Controls Risk • HITRUST risk areas • Based upon analysis of breach data • Significantly simplified for organizations • HITRUST Common Security Framework • Reasonable practice34 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  36. 36. High Risks for Healthcare Organizations*• Insecure and/or unauthorized removable/transportable media and laptops (internal and external movements)• Insecure and/or unauthorized external electronic transmissions of covered information• Insecure and/or unauthorized remote access by internal and third-party personnel• Insider snooping and data theft• Malicious code and inconsistent implementation and update of prevention software• Inadequate and irregular information security awareness for the entire workforce• Lack of consistent network isolation between internal and external domains• Insecure and/or unauthorized implementation of wireless technology• Lack of consistent service provider, third-party and product support for information security• Insecure web development and applications• Ineffective password management and protection• Ineffective disposal of system assets*Based on loss and breach data analyzed by HITRUST35 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  37. 37. Overview of CSF Assurance Risk Assessments• Referenced by Office of Civil Rights in risk assessment guidance http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidanc e.pdf• Designed to cost-effectively gather the information about security controls needed to appropriately understand and mitigate risk• Leverages defined, reasonable controls in the HITRUST CSF – The most broadly adopted security control framework in the healthcare industry• Streamlines risk determination analysis by prioritizing areas based on analysis for breach data for the healthcare industry• Provides formal and credible report for internal and external reporting• Utilizes benchmarking data• Provides recommendations for remediation36 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  38. 38. CSF Assurance Assessment Approach 1. 2. 3. 4. Track andDetermine Scope Prepare for Assessment Report Measure Progress - Focus on high risk areas - Identify individuals responsible - Track progress - Applications, for key control areas against industry - Report of findings interfaces, benchmarks - Conduct top down enterprise and remediation plan infrastructure control analysis - Focus on measures - Do not get stuck in the weeds - HITRUST CSF - HITRUST Scoping - HITRUST High Risk List Validated Report - HITRUST CSF Template - HITRUST CHIP Questionnaire - Corrective Action Validated Report Plan Template37 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  39. 39. Align Control Decisions with Industry Standards,Regulations and Best Practices HITRUST CSF• Healthcare-specific security initiative• Openly available framework• Comprehensive requirements – Focused on high risk controls• Integrated control set• Prescriptive and certifiable• Value-added services – Industry-reviewed control practices – Vendor product certification – “Trusted broker” third–party assurance38 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  40. 40. Be Efficient39 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  41. 41. Focus on the Certified EHR System• HITRUST CSF assessments are broken out into two types of assessment – Organizational: assesses the general information security controls that may impact the confidentiality, integrity or availability of ePHI – System: assess the administrative, technical and physical controls specific to the implementation of a certified EHR technology• Each type of assessment is further scoped (tailored) based on very specific factors related to risk and an entity’s ability to implement appropriate and reasonable security measures – Organizational: includes type of organization, size, and revenue – System: includes average number of transactions and external interfaces• Assessments are further focused on high risk areas – Based on HITRUST’s analysis of breach data and feedback from over 200 healthcare and security experienced professionals – Focus on these risks first, adjust for your environment, and expand as dollars and resources allow (i.e., follow the 80/20 rule)40 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  42. 42. Key Components of the CSF Assurance Program• Standardized tools and processes – Questionnaire • Focus assurance dollars to efficiently assess risk exposure • Measured approach based on risk and compliance requirements • Ability to escalate assurance level based on risk – Worksheet for reporting compliance – Report that is consistently interpreted across the industry• Cost effective and rigorous assurance – Multiple assurance options based on risk • Self reporting • Remote testing—conducted by a CSF Assessor; includes interviews with key personnel and review of policies, procedures and other relevant documentation • On-site assessment—conducted by a CSF Assessor; includes remote testing and the review of system configurations and physical walkthroughs – Quality control processes to ensure consistent quality/output from CSF Assessors41 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  43. 43. QuestionnaireCommon Healthcare InformationProtection (CHIP) Questionnaire: • Innovative approach to assess the quality of information protection practices in an efficient manner • Focus on the security capabilities and outcomes of an organization • Leverages key measures and supports benchmarking • Structured according to the high- risk areas identified in the CSF, which reflect the controls required to mitigate the most common sources of breaches for the industry42 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  44. 44. Use Sampling Techniques Where Appropriate• HITRUST CSF Assurance supports sampling when – Practices/locations are governed by one set of policies and procedures – Environments and administrative/technology controls are similar• There must be a basis for concluding the practices/locations are similar – Some dissimilarity may support sub-grouping and sampling within sub-groups• HITRUST recommended sample sizes Number of Practices in Population/Group Minimum Number of Practices at Which to Perform Security Risk Assessments >50 10%, Maximum of 25 Practices 15-50 Minimum of 5/Use Judgment <15 Minimum of 3/All Practices• Sampling should be random but other methods could be supported• Inconsistent results from the sample imply … – All practices/locations may need to be addressed / assessed • Exceptions/deviations should be investigated to determine root cause(s) • If isolated instance or human error, may be able to select a replacement • Decision and rationale should be documented as part of the assessment43 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  45. 45. Assist Physician Practices• HITRUST recognizes the constraints and limitations of physician practices and other small healthcare organizations• Small Organization Health Information Assurance Questionnaire (SOHIA) – Simplified questionnaire • Intended for self assessment • Assesses general organizational security for high risk factors – Automated technical assessment • Simple agent-based tool downloaded from vendor Web site • Assessment of current vulnerabilities • Re-assessment provides proof of corrective action44 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  46. 46. Take Remediation Seriously45 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  47. 47. Develop a Sound Corrective Action Plan• Meaningful use only requires a focus on the certified EHR, but….• Organizations are expected to routinely perform a risk analysis under HIPAA and manage/implement corrective actions• If a HIPAA risk assessment was not performed in over two years, consider a broader risk assessment to stay aligned with HIPAA requirements• HITRUST includes a HIPAA Compliance Scorecard produced for each HIPAA security requirement• Ratings and benchmarks for high risk controls can help organizations prioritize remediation efforts46 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  48. 48. Benchmark Data Higher Priority Lower Priority CAPs CAPs PRISMA SCORE Organization Benchmark Orgs47 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  49. 49. Actively Manage Remediation • HITRUST CSF Validated and Certified provide a standard assessment report, compliance scorecard and corrective action plans HITRUST Common Security Framework CSF Assurance Toolkit 2010 / v1.0 Corrective Action Plan [TEMPLATE] Instructions Use this spreadsheet to document the corrective action plan to remediate any findings resulting from an assessment under the CSF Assurance Program. The weakness identifier will be Weaknesses represent any program or system-level Related HITRUST CSF Control A POC is the organization, Resources required include the Completion dates should Milestones with completion dates outline the Changes to milestones indicate the new estimated used to track and correlate information security vulnerability that poses an unacceptable Specification for the identified department or title of the funding (denoted in dollars) or be set based on a specific high-level steps to be executed in future date of a milestone’s completion if the weaknesses that are ongoing risk of compromising confidentiality, integrity or availability of weakness. position within the man-hours necessary for realistic estimate of mitigating the weakness and the estimated original date is not met. throughout quarterly information. organization that is directly mitigating a weakness. The type amount of time it will completion date for each step. submissions within the Ex. 01.b User Registration responsible for mitigating the of funding (current, new or take to collect the Ex. None noted to-date organization. A rule of thumb is Ex. 1—Granting, transfer and termination procedures for user weakness. reallocated) should be noted. resources for the Ex. Develop user registration procedures for to use an abbreviated system access are not established corrective action and granting, transferring, and terminating access, name, the quarter, the year, and Ex. System X Director of IT Ex. 120 hours, current staff implement/test the 8/1/2009 a unique number. Security corrective action. Submit to System X Administrator for review and input, 8/15/2009 Ex. SYSX_3_2009_1 Ex. 8/31/2009 Weakness Identifier Weakness Description HITRUST CSF Control Organizational Point of Resources Required Scheduled Milestones with Completion Dates Changes to Milestones Reference(s) Contact (PoC) Completion Date • Remediation of security deficiencies is required to maintain CSF Validated status – No gaps with prioritized requirements (controls) are allowed with CSF Certified status48 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
  50. 50. Conducting your Meaningful Use Risk Assessment Five steps to getting started with the CSF Assurance Program: 1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your meaningful use risk assessment.* 2. Identify your scope – Details on slides 15 and 40 3. Perform an assessment using the Common Health Information Protection Questionnaire (CHIP) and Compliance Worksheet.** – Details on slides 16-20 and 42-43 4. Submit your CHIP to HITRUST 5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP – Details on slides 23-24 and 46-48 6. Register and attest for meaningful use Stage 1 – Details on slides 26-30*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visithttp://www.hitrustalliance.net/assurance/**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g.,HIPAA Security Rule) © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved. 49
  51. 51. For More Information: For more information on the CSF Assurance Program visit: www.HITRUSTAlliance.net/assurance For a list of HITRUST CSF Assessors visit: www.HITRUSTAlliance.net/Assessors_List.pdf HITRUST Central professional subscribers, can contact customer support for questions: support@HITRUSTalliance.net50 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.

×