BLOG

GDPR has been a real game changer and has raised the bar when it comes to data breach notification and protecting personal data privacy. Following in the footsteps of the GDPR, the U.S. has seen several states issue significant changes concerning their data breach notification laws. This blog elaborates on new and upcoming breach notification laws. Read More

There is a dynamic duo in healthcare data security assurance: HITRUST CSF certification and SOC 2 attestation. Aligning your data security program with healthcare standards contained in HITRUST CSF and the SOC 2 attestation can bring numerous benefits. Pursuing these together in a full-scale security initiative offers an efficient approach to securing healthcare data. Read More

At the recent HIMSS conference, the OCR provided an Enforcement Update where they outlined how they plan to approach enforcement with healthcare covered entities in 2019. As security and privacy consultants and advisors with our ears to the ground, we keep our eyes peeled for these important regulatory trends. What are the top trends that will have the biggest impact to healthcare security and privacy policy? Read More

Medical device and IoT unmanaged devices have introduced a significant hurdle for security teams to protect critical healthcare information and systems. A strategic direction for managing medical devices should be captured in a formal medical device security program and strategic plan. And while the “device” itself should be carefully evaluated for security risks, additional focus should be given to the middleware and platforms running behind the scenes. Read More

Even as third-party data breach activity continues to grow, the importance of third-party data security in board-level risk management strategy is not growing to match the need. In November 2018, the Ponemon Institute reported that among U.S. firms surveyed, 61 percent experienced a breach caused by third parties, which is up from the previous year at 56 percent. However, only 46 percent of firms surveyed say managing relationship risk is a priority. Read More

Cyber Hygiene consists of the practices and steps required to ward off potential viruses, data hijack attempts and intruders invading your information systems. Good hygiene is a major part of preventative healthcare for humans, but also for healthcare information systems. But just setting up employee training, policies and procedures is only covering the surface area of good cyber hygiene. Audits are akin to going for a health check up or dental cleaning. But what about other preventative measures before the annual “checkup”? Read More

Are you part of a health care organization that is having a difficult time filling information security positions needed? Perhaps many security projects are slowing down to a trickle or coming to a complete standstill as your security program initiatives get backed up. Don’t worry, you are not alone. According to ISC2, the global information security workforce shortage is expected to hit almost two million by 2022, demonstrating a staggering 20% increase from 2015. Read More