9 Ways HITRUST Helps Healthcare Providers Protect Patient Information

As a healthcare provider, the need to stay HIPAA-compliant is not news to you. Violation of HIPAA regulations is no joke — fines range from $100 to $50,000 per violation (or per record), with a maximum penalty of $1.5 million per year for each violation.

With the rising concern about cybersecurity and the privacy of patients’ Private Health Information (PHI), having the proper IT security measures in place is now a must for healthcare organizations of any size.

The Cost of a Data Breach Is Rising

Cybersecurity is continuing to be a major issue for the healthcare industry. The latest “Cost of a Data Breach Report” published by IBM Security and Ponemon Institute found that the healthcare industry has the highest cost associated with data breaches, costing affected organizations nearly $6.5 million each — over 60% higher than in other industries.

The financial consequences of a data breach can be particularly acute for practices with fewer than 500 employees. The losses caused by a data breach are over $2.5 million on average for these businesses, which is a potentially crippling amount for many healthcare organizations.

This monetary amount only represents the initial cost. A data breach also carries less tangible and long-term consequences, such as damage to your organization’s reputation or eroding patients’ trust, diminishing patients’ loyalty, and impacting retention rate.

The healthcare industry continues to be a hot target for cybercriminals because the protected health information has very high resale values on the black market as it can be used for malicious activities such as identity theft, insurance, and health care fraud. In fact, one in four cyberattacks targets the healthcare industry.

Unfortunately, many medical practices don’t have sufficient security measures to protect patients’ PHI. It’s highly challenging to implement the proper protocols when outsourcing administrative tasks (e.g., patient statements and payment processing) to improve efficiency and lower costs.

Breaches caused by third-party vendors account for over 30% of all data breaches in the healthcare industry. As such, it’s important that you not only tighten internal cybersecurity but also work with vendors who are properly set up to protect your patients’ information.

To ensure long-term compliance, you should start by choosing the right security framework.

What’s HITRUST?

The Health Information Trust Alliance (HITRUST) is an extensive certification program that combines various different security standards and regulations, including federal (HIPAA, HITECH), third-party (PCI, COBIT,) and government (NIST, FTC) into one organized Common Security Framework (CSF) designed to safeguard sensitive information and manage information risk for organizations of any size.

HITRUST partners with the Department of Homeland Security (DHS) and the Department of Health and Human Services (HHS) to exchange cyber threat indicators so it can prevent potential breaches before they occur. It also established the HITRUST Cyber Threat Intelligence and Incident Coordination Center to identify threats and coordinate incident responses specific to the healthcare industry.

The rigorous certification process requires a thorough on-site audit by a third-party certified CSF assessor and then a comprehensive review of the assessor’s findings by the HITRUST organization to ensure that the proper policies, procedures, and technologies are implemented, measured, and maintained.

Besides internal systems, HITRUST also addresses the use of third-party vendors by providing an integrated approach to help organizations ensure that all programs are aligned, maintained, and supported to meet information risk management standards and compliance objectives.

The HITRUST framework allows healthcare organizations to leverage third-party services without risking non-compliance with various industry regulations so they can securely outsource administrative tasks (e.g., billing, payment processing) to increase efficiency and lower costs.

Check out our infographic explaining the differences between HIPAA and HITRUST.

How HITRUST Helps Protect Your Patients’ PHI

Working with HITRUST-certified service providers ensures that your patients’ PHI is protected at all times when vendors are processing patient data on your behalf.

Here’s how HITRUST can help you protect your patients and avoid the hefty costs of data breaches:

• HITRUST is developed by healthcare and IT professionals that have a vested interest in maintaining the highest levels of healthcare information security, so the protocols are highly relevant to medical practices.
• The framework is designed to help healthcare providers prevent data exposures, combat cyberattacks, and establish industry-wide reliability. The audited and verifiable certification process promotes overall transparency and builds trust.
• You have a trusted benchmark from which to measure and manage compliance and stay current with the latest cybersecurity protocols at all times.
• HITRUST provides an industry-managed approach for meeting requirements set by multiple compliance measures designed to protect PHI.
• HITRUST offers CyerbAid to help small healthcare establishments create and implement cybersecurity plans so they can address cyber risks and protect patient PHI cost-effectively.
• You have a comprehensive and standardized method to assess, mitigate, and manage cybersecurity risks when working with various vendors.
• By using only service providers that invest the time and resources to become HITRUST certified, you can weed out third-party vendors that skirt compliance requirements, which could endanger your patients’ PHI and your reputation.
• Working with a HITRUST service provider simplifies your internal processes by streamlining IT management and lowering operating costs.
• Unlike vendors that self-assess their operations and call themselves “HIPAA-compliant,” HITRUST-certified vendors must complete a self-assessment, provide evidence of implementation of hundreds of requirements, then have each requirement investigated by a certified auditor and approved by HITRUST.

Partner with HITRUST Vendors to Protect Your Patients’ Information

Working with third-party service providers that perform a variety of functions, such as handling patient statements and patient payments, helps you navigate the increasing cost and complexity of running a healthcare practice, allowing you to improve cost-efficiency, augment the patient experience, and boost your bottom line.

To safeguard your patients’ interest while ensuring that your organization stays compliant to avoid hefty penalties and protect your reputation, you need to select vendors that are HITRUST-certified so you can rest assured that your patients’ sensitive information is in good hands.

Hugh Sullivan is the CEO of MailMyStatements, an industry-leading healthcare billing, and payments company. He has over 25 years of experience as a seasoned healthcare executive, was the co-founder of ENS Health — a highly successful national healthcare electronic data interchange company, and has served in various leadership roles within Optum, a UnitedHealth Group company. Considered as an industry thought leader, Hugh is an expert in using health IT to improve healthcare information exchange, which can enhance the quality of care, improve efficiency, and reduce costs.

#PatientStatements

You can follow Hugh on Twitter @hughdsullivan