Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
The Rx for HIPAA Compliance in the Cloud
For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.
4 Min Read
The challenges of secure healthcare IT are really hard! It's akin to navigating a barbwire minefield that's surrounded by an endless sea infested with fast, hungry sharks. And it's raining.
That may sound a bit flippant — and it is — but it's also an insightful way to describe the frustrating level of complexity involved in making digital healthcare information more secure and legally compliant. At best, your chance of success is always questionable, and even small missteps come with severe penalties.
About five years ago, the Department of Health and Human Services (HHS) expanded the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a set of laws aimed at providing continuous healthcare coverage and controlling the electronic transmission of healthcare data. The expansion laid out the responsibilities of covered entities (CEs), such as medical practices and insurance companies, and business associates (BAs), referring to technology providers and vendors.
In 2016, the law got even more detailed with guidance for how BAs and cloud service providers (CSPs) should behave in order to be suitably "cyber secure." The new regulations issued very thorough written guidance and set up very stiff penalties for things like data breaches, data loss, and data theft. Since that time, investigations and legal charges have been ongoing — and increasing in volume. If you are curious, you can take a look at the current list of open cases under investigation by the Office of Civil Rights, which has the job of policing HIPAA-covered cyber events.
Recently, a healthcare customer of mine described HIPAA cloud compliance as a big boat that's been hastily built and not tested on the open water. Holes spring up everywhere and, when you plug one, another opens up at the same time.
With all these holes, simply following HIPAA CSP guidelines is not nearly enough to ensure that your company or practice is protected from cyber threats, government investigations, and fines. Each entity involved in handling electronic healthcare information must continuously take extra precautions to keep their risk levels as low as possible.
If those companies (or their IT providers) were to take a look at the cloud networks and client-accessible web portals where they're storing data and hosting things, they'll often find some interesting and unexpected "meetings" going on between their networks and external, often high-risk, IP addresses and networks around the globe.
In other words, if you look at the servers your cloud apps and networks are talking to behind your back and assess them for their cyber threats, you'll find you're opening yourself up to all sorts of potential badness — and HIPAA-policed things like breaches — via vectors like Tor, ransomware, phishing, malware, and botnet-delivered attacks.
By using focused IP and network threat intelligence, healthcare companies and their technology providers can add simple but effective protection measures to more traditional firewall approaches that automatically block access to their networks, data, sites, and apps before the bad things occur.
How do you get started? Here's a checklist to cover the fundamentals:
Make sure all your apps, websites, and other networked assets are sufficiently logging inbound and outbound network connections to grab IPs that attempt or make connections.
Ensure you have adequate tooling to search, alert, and report on the IP and network data you're collecting with a SIEM or similar tool.
Use a quick and accurate service or tool to identify, score, and "rack and stack" the threat profiles of all the collected IP addresses by things like blacklist type and volume, type of threat with which the IPs have been associated, and recency of incidents.
Proactively and aggressively provide feedback about the worst and most threatening offenders to your network and web application firewalls for block-listing.
Monitor collected IP data over time to catalog baseline patterns and anomalies that warn of current or future incidents.
These methods will help develop a core process you can rely on to profile "normal" traffic patterns between your cloud and external services in order to spot suspicious communications patterns more quickly, which will lead to better threat response and mitigations downstream in your environments before data goes missing. For example, if your cloud all of a sudden starts talking to strange servers in China for a week, you can immediately start looking around for another hole in the boat. At the very least, it's a sign of potential problems to come.
Too often, medical practitioners and healthcare companies assume that technology providers bear all the burden (and legal risk) for protecting them from the dangers of HIPAA violations. In actuality, the burden to protect businesses and health IT practices is still very much on the non-technical covered entities.
Related Content:
About the Author
You May Also Like
More Insights
