Preparing for a Cyber Security Audit: Part X

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series of articles on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the tenth installment in the series.

The U.S. Department of Health and Human Services (HHS) recently defined a security rule formally known as its Security Standards for the Protection of Electronic Protected Health Information (e-PHI).

This rule sets standards for information and communications technology (ICT) in any healthcare organization. Compliance with the rule is mandatory. Enforcement powers of the government are codified at 45 C.F.R. Part 160, Subparts C, D, and E. If there is a violation, then civil money penalties (CMP) may be imposed.

One part of the rule calls for identification of and protection against “reasonably anticipated threats to the security or integrity” of e-PHI. What does “reasonably anticipated” mean? In particular, does it refer only to the psychological side of “anticipation,” or does it translate deeper into organizational actions?

Here, we will argue that “reasonably anticipate” means not only the purely psychological side, but it also implies that your organization must take specific tangible steps to anticipate a ransomware or other form of cyberattack, and effectively deal with it should it occur.

Preparing for a Cyber Audit

In previous articles in this series, we have reviewed the high-level steps of a cyber audit. First comes a “desk audit,” in which the healthcare provider is given a number of questions that must be answered in writing within 10 business days. Second, it is possible for certain providers to be chosen for more in-depth, on-site audits that can last for 3-5 days. Third, if necessary, the organization can be subjected to even more detailed audits that may lead to penalties.

Section §160.410 of this rule sets forth the “affirmative defenses” that might be used by the healthcare provider. For example, the provider might attempt to show that it demonstrated “reasonable diligence” in combatting hacking. What follow are a few of the steps that might be taken to demonstrate “reasonable diligence” in protecting against malware attacks.

Tabletop Exercise 

The tabletop exercise is a simulation of how your organization would respond to a cyberattack. The U.S. Department of Homeland Security offers generous documentation on how to conduct these exercises. In addition, there are a number of commercial security consulting organizations that can help you conduct this type of drill – for a fee.

The purpose of the tabletop is twofold: First, it is designed to raise awareness of the issues that must be dealt with, and to clarify who is responsible for handling them; second, it is designed to find glitches or flaws in how the organization responds. These glitches are particularly important to understand because only once they are identified, they can be fixed.

In many cases, a tabletop exercise is the first time an organization is forced to think through how it might respond to a cyberattack, and who is responsible for doing what.

Document Everything

The entire tabletop exercise and all of the details must be scrupulously documented. Of particular concern is documentation of any issues found in the organizational response, and exactly what steps were taken to rectify the problem(s) and mitigate the potential for serious damage.

For even the most hard-headed auditor, it is music to the ears to see well-organized documentation illustrating how your organization has been systematic in anticipation of a threat and responsible in the formulation of an effective response.

Strictly Enforce Security Protocols

The auditors will be looking not only for security protocols that are on the books – everyone has those – but also for evidence that the protocols are being used. Because of this, it is necessary to maintain a log of every single breach of a security protocol, including the date, time, systems affected, persons involved, how it was discovered, and what actions were taken to make sure it does not happen again.

It goes without saying, however, that in order to enforce a security protocol, an organization must have one in the first place, and everyone must understand how it applies to them personally.

Book of Security Protocols

Your organization should be able to present documentation of each security protocol. This includes how to log on to a system, how to log off, how to choose passwords, how to keep passwords safe, how to respond to phishing emails, how to handle email attachments, and so on.

Not only is it necessary to have complete documentation of your security protocols, but it also is useful to have documentation verifying that each employee in the organization is fully aware of all protocols that they might need in the event of a security breach.

Standing Patient Notification Protocol

In the case of any substantial security breach, your organization will be required to notify patients that their records have been compromised. In order to prepare for this, your organization must have documentation of drafts of the notification letter, with specification of the principles that will govern exactly when (and to whom) notifications will be sent.

Documentation of Security Maintenance 

Each modification or maintenance made to your information system with an aim of improving cyber security must be completely documented. In particular, there must be a clean record showing the date, time, and other report of any security patch that is applied to your information system.

After all, it is difficult to conclude that an organization is not taking “reasonable steps” towards effective cyber security when the documentation shows otherwise.

In some cases, an information systems organization may resist the adding of an additional “bureaucratic” step of recording their every move, but be assured, it is necessary, because it proves due diligence on the part of your organization.

Preparing for a cyber audit involves taking tangible steps to improve the security of your information system. But being secure is not adequate, for the purposes of an audit.

Instead, it is necessary to be able to show documentation of everything you have done. In this way, you can feed the audit monster before it bites off your hand.

In future issues of this series, we will go into greater detail about cyber audits.