The Importance of HITRUST CSF Certification: Vet Your IT Partners – Being HIPAA Compliant Isn’t Enough

Electronic medical records (EMR) have become the most sought-after form of private consumer data, valued for their illicit resale and extortion potential. For that reason, no healthcare organization is immune from a cyberattack. Any organization that uses, processes, delivers, or stores health information is an attractive target for cybercriminals. And small clinics and practices that once escaped attention are now just as at-risk as large networks.

Any organization that uses, processes, delivers, or stores health information is an attractive target for cybercriminals.

HIPAA requires that healthcare organizations, as well as business associates of HIPAA-covered entities, implement safeguards to protect patients’ personal health information (PHI). And they must be able to demonstrate those safeguards through annual HIPAA audits and assessments. This is true of all IT vendors as well, but is particularly salient to the managed services providers (MSPs) and cloud hosting providers that play a crucial role in the delivery, protection and storage of PHI in the cloud.

But in today’s threat landscape, just meeting HIPAA requirements is no longer enough.

That’s why it’s time for all healthcare organizations to insist that their IT vendors achieve HITRUST Common Security Framework (CSF) certification for their cloud infrastructure or migrate to a provider that is HITRUST certified.

That’s why it’s time for all healthcare organizations to insist that their IT vendors achieve HITRUST Common Security Framework (CSF) certification for their cloud infrastructure or migrate to a provider that is HITRUST certified.

Why do you need HITRUST?

HITRUST incorporates more than 40 globally recognized security standards, including:

• HIPAA
• The National Institute of Standards and Technology (NIST)
• The International Organization for Standardization (ISO)
• Payment Card Industry (PCI)
• Federal Trade Commission (FTC) Red Flag
• Control Objectives for Information and Related Technology (COBIT)

Altogether, HITRUST specifies more than 400 ongoing controls and processes to measure an organization’s ability to safeguard PHI.

That depth of protection gives your organization more peace of mind than any other individual certification or standard an MSP might claim.

Med Tech Solutions CEO Mona Abutaleb, who is widely covered in national healthcare IT and security publications, discusses this topic in HealthIT Answers. You won’t want to miss it.

Read the full article here.

 

Contact Med Tech Solutions for our HITRUST-CSF & HIPAA-compliant solutions and more information.