Meet Alan DeVaughan, Director of IT Risk Management at Meditology.
Many healthcare organizations don’t have the internal capacity to run a full security and compliance program. How can leaders stay informed and make the right risk decisions while a partner handles the day-to-day execution?
Keeping decision rights within your organization is the key principle. You need to establish a clear communication rhythm between your organization and the third-party partner handling daily security and compliance execution tasks. Items such as routine checkpoints, monthly leadership briefings, and regular reports ensure leadership has the information needed to make informed risk decisions. You should also develop formal strategic and operational plans to keep everyone on track. Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) are important to track progress of your security and compliance program.
Many healthcare organizations need to meet multiple frameworks, like HIPAA, HITRUST, NIST CSF, and SOC 2. What does it take to build and manage one program that satisfies them all?
Developing a unified control framework (UCF) is a great way to manage multiple frameworks. A UCF is a single set of controls which are mapped to each framework applicable to your organization. Establishing a UCF lets you test the control one time but apply the results across multiple frameworks without duplicative evidence collection efforts. Once you have a UCF, you can develop automated evidence collection and real-time gap monitoring to switch your focus to continuous compliance instead of single assessments. For more information check out our blog post, “Healthcare Cybersecurity Plan: How to Align Risk Management and Compliance for a Unified Strategy.” We recently did this for a large west coast health plan by aligning their various audit frameworks into a single set of controls. Now their control owners provide evidence once which is used across each applicable framework.
As AI tools and vendor AI features spread across healthcare, how should organizations build AI risk into their governance program?
Your organization should establish an AI governance committee which includes clinical leadership, IT security, legal/compliance, and health equity (if applicable). This group can then define high-risk AI uses (e.g., patient triage) vs. low-risk AI usage (scheduling automation) and develop appropriate processes and safeguards. You also need to understand what AI is being used within your organization, and how data is flowing through the tools. We’ve worked with a both a large east coast hospital system and a Midwest healthcare data company to provide an AI program assessment to help them establish appropriate governance processes.
What are regulators like OCR focusing on right now, and what does it take to stay ready year-round instead of scrambling before an audit?
At this year’s HIPAA Summit, the OCR noted two specific areas of focus. The first was an individual’s right to timely access to their health records as required by the HIPAA Privacy Rule. The OCR received many complaints from individuals who claim they either had no access or were denied access to their health records.
The second focus area was on risk analysis and risk management. Almost all OCR large breach investigations reveal a lack of an appropriate risk analysis and therefore an insufficient risk management program. By establishing a solid risk management program, you and demonstrate to the OCR that you regularly monitor existing risks, information system activity (e.g., audit logs, incident tracking), discover new risks (e.g., vulnerability management), and track any required remediation activities. A formal risk management program with supporting continuous monitoring enables you to have your HIPAA-related documentation in a central repository which can be provided to the OCR or other auditor on demand, instead of scrambling to track down information. Check out my recent blog post on being prepared for an OCR investigation.
How can organizations tell whether their security and compliance program is actually reducing risk over time?
The key to understanding whether your program is reducing risk is establishing an appropriate set of metrics. At an executive or board level, you need to understand overall governance, not operational results in your risk metrics. Instead of looking at numbers of high, medium, and/or low risks, you should be looking at top risks and how they are trending, critical asset coverage, identity hygiene, and understanding your clinical and/or financial exposure on your top risks. Comparing the same metrics from quarter to quarter allows you to understand your overall trends and their relevance to critical assets.
If you weren’t working in cybersecurity, what would you be doing instead?
Assuming I must work, probably something related to music. I’m always listening to music and enjoy going to concerts.