[fusion_builder_container hundred_percent=”no” equal_height_columns=”no” menu_anchor=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=”” background_color=”” background_image=”” background_position=”center center” background_repeat=”no-repeat” fade=”no” background_parallax=”none” parallax_speed=”0.3″ video_mp4=”” video_webm=”” video_ogv=”” video_url=”” video_aspect_ratio=”16:9″ video_loop=”yes” video_mute=”yes” overlay_color=”” video_preview_image=”” border_size=”” border_color=”” border_style=”solid” padding_top=”” padding_bottom=”” padding_left=”” padding_right=””][fusion_builder_row][fusion_builder_column type=”1_1″ layout=”1_1″ background_position=”left top” background_color=”” border_size=”” border_color=”” border_style=”solid” border_position=”all” spacing=”yes” background_image=”” background_repeat=”no-repeat” padding_top=”” padding_right=”” padding_bottom=”” padding_left=”” margin_top=”0px” margin_bottom=”0px” class=”” id=”” animation_type=”” animation_speed=”0.3″ animation_direction=”left” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” center_content=”no” last=”no” min_height=”” hover_type=”none” link=””][fusion_text columns=”” column_min_width=”” column_spacing=”” rule_style=”default” rule_size=”” rule_color=”” hide_on_mobile=”small-visibility,medium-visibility,large-visibility” class=”” id=””]

Why Having a Vendor Security Management Program is Necessary

News of a cybersecurity incident compromising the personally identifiable information of the American Medical Collections Agency (AMCA), a downstream financial management and collections contractor serving scores of healthcare organizations, has put a spotlight on concerns over the lax approach some in the industry take to assessing vendor information security practices. The breach, the largest healthcare related incident to have been reported since 2017, comes on the heels of the recently released fact sheet produced by the Department of Health and Human Services, Office for Civil Rights (OCR) that provides guidance for HIPAA compliance and direct liability for business associates that many believe to be insufficient in effectively safeguarding health information.

The HIPAA standards require that a covered entity or business associate obtains satisfactory assurances from its business associate that the business associate will appropriately safeguard the protected health information (PHI) it receives or creates on behalf of the covered entity. The satisfactory assurances must be in writing, usually taking the form of a contract or “business associate agreement” (BAA) between the covered entity and the business associate. However, the HIPAA standards do not require a covered entity or a business associate to assess or monitor the information security practices or security rule compliance of their business associates.

Have an Effective Vendor Security Management Program

Providers should have an effective vendor management program in place and document greater due diligence through these efforts to better manage their business associates. An effective vendor security management program will evaluate and monitor vendors on a regular and ongoing basis and hold them accountable for requirements your organization identifies or assigns as remediation. Healthcare organizations should perform risk based assessments of vendors’ information security practices and safeguards. The more access an organization has to your information system or the sensitivity of the data, the more comprehensive and thorough the examination.

Just as important is to require a vendor to identify and perform vendor management assessment of the subcontractors or vendors they hire to create or maintain your organization’s personally identifiable data. Ensure that all vendor agreements include provisions for what types of incidents have to be reported your healthcare organization and when that notification must be provided. Equally important is specifying in your vendor contract how information about incidents involving downstream contractors are reported to your organization as well as the right to obtain information or investigate such incidents.

OCR Fact Sheet Summarizes Business Associate Requirements

The OCR fact sheet provides a summary of the responsibilities for business associates to comply with the HIPAA Privacy, Security, and Breach Notification provisions added by the Health Information Technology for Economic and Clinical Health (HITECH) Act and the 2013 final rule implementing those changes. The HIPAA Rules are designed to set the floor of safeguards to prevent unauthorized use or disclosure for protected health information (PHI). The HIPAA Rules only apply to the covered entities and business associates as defined by the HIPAA and HITECH laws. The fact sheet identifies 10 categories of HIPAA violations for which a business associate may be directly liable:

1. Failure to provide records and compliance reports in cooperation with OCR investigations;
2. Taking retaliatory actions against individuals for filing a HIPAA complaint;
3. Failure to comply with HIPAA Security Rule requirements;
4. Failure to provide a breach notification to a covered entity or another business associate;
5. Impermissible uses or disclosures of PHI;
6. Failure to fully comply with HIPAA’s right of access to PHI in a readily available form and format;
7. Failure to make reasonable efforts to limit access to PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request;
8. Failure to provide an accounting of disclosures in certain circumstances;
9. Failure to enter into HIPAA-compliant downstream business associate agreements (BAAs); and
10. Failure to take reasonable steps to address a breach or violation of a downstream BAA.

The Bottom Line

Business associates are required to conduct thorough, annual risk assessments. Risk assessments are required under the HIPAA Security Rule and can lead to protection from arguments that safeguards in place at the time of an incident or otherwise were inadequate.

Healthcare organizations should go beyond the minimum requirements of the HIPAA standards through an effective vendor management program. Design your vendor security management program to evaluate and monitor vendors on a regular and ongoing basis and hold them accountable for requirements your organization identifies or assigns as remediation. Evaluate each vendor’s level of risk and determine which protections are in place so your organization can make a determination around how to adjust your contracts, service levels, or your overall relationship. Actively monitor each vendor, communicate the security gaps identified, and alert the covered entity on any changes to the vendor’s status over time.

Learn more about CynergisTek’s Vendor Security Management Service.

[/fusion_text][/fusion_builder_column][/fusion_builder_row][/fusion_builder_container]