Perimeter defense

Perimeter security plays an important role in ensuring the security of your information.  DoS/DDoS mitigation helps ensure the availability of PHI. IP reputation management blocks known bad IPs at the edge of the network before connection requests get to your server/applications.

Web application firewalls are also valuable as they protect websites and applications against attacks such as SQL injection, cross-site scripting (XSS), URL parameter tampering, session-hijacking and other application-layer attacks.

These controls are especially helpful for healthcare IT for a reason. They permit legitimate transactions while preventing attacks from impacting performance. They help protect the speed, uptime and data availability that can impact patient outcomes.

In the end, there’s simply not an easy button for healthcare IT security. All of these controls require effort, diligence and skill. But they do safeguard data – and doing this security work will cover much of the compliance work you would have to do anyhow. By focusing on security first, you build a shield of protection that safeguards data and satisfies the core of HIPAA compliance.

2. There’s an entry price for healthcare IT.

During the course of a typical security discussion, people complain that they can’t afford another server or that encryption is too expensive. If that sounds familiar, here’s the straight talk: you can’t afford not to invest in these things.

Consider the alternatives, after all. Just one breach can mean any or all of:

·      Lawsuits

·      Penalties

·      Massive costs of complying with Breach Notification laws

·      Investigation costs

·      HIPAA fines

·      Brand damage

A severe attack can put you out of business. Studying the list above, security is absolutely the more affordable path. Every organization needs to realize, up front, that there’s a minimum cost to participate in healthcare IT.

The franchise plan

Consider it akin to buying a franchise. You can’t start your own version of a fast food restaurant chain. You need to pay the franchise fee and then build a restaurant according to their blueprints and guidelines. The headquarters will also vet your balance sheet and assets to make sure you’re financially capable of building an appropriate franchise to ensure that your efforts don’t reflect badly on them.

A healthcare organization is no different. While hospitals, clinics, insurers and other entities may technically function as separate businesses, all of them are beholden to certain regulatory laws. Organizations that claim they “can’t afford” real security are eventually going to pay a much higher price in the form of a breach. There simply is no escaping the entry price of healthcare IT.

Finally, remember that the heart of compliance and security is protecting other people’s privacy. Treat PHI as if it were your medical records at stake and build the risk management program your data deserves. Your organization will be that much closer to HIPAA compliance – and you’ll also enjoy a stronger, higher-performing environment.