The risks posed by third party vendors and suppliers to Indiana Healthcare providers has risen substantially in recent years due to increases in the number of third parties, as well as the criticality of the services those third parties provide.
With that in mind, the Healthcare Committee of the Indiana Executive Council on Cybersecurity (IECC) have created a new online Vendor Management Guide that provides not only the approaches that can be used to manage these risks and it's presented in a way that can be well understood and implemented in a way that's practical and helps ensure patient safety and their information security.
The guidance is focused on six critical areas, ranging from risk assessments, cyber insurance, and incident response, to recommended best practices, as well as understanding what is involved with business associate agreements (BAAs) and resources for creating model contract language to make sure the appropriate security terms are included in the contracts that healthcare organizations enter into with their third-party vendors and suppliers. There is also a section dedicated to highlighting the latest resources, available at the federal level, including the widely used Cybersecurity Framework (CSF) from the National Institute of Standards and Technology (NIST) and the Healthcare and Public Health Cyber Performance Goals.
- Risk Assessments
HIPAA covered entities are required to assess, document, and manage the risks posed to ePHI in their environment. Often, ePHI is housed by third party vendors who provide application or data services to the entity. Prior to onboarding a new vendor, all HIPAA entities should conduct a thorough risk assessment of the vendor’s security practices to ensure that risks to ePHI are minimized.
Many vendors will supply healthcare customers with attestations or audits validated by a neutral third party, such as SOC reports, HITRUST, ISO, or UL certifications, or other audit reports to demonstrate appropriate cyber controls are in place in their organization. If the third party is supplying medical devices to the covered entity, the third party should supply a Manufacturer Disclosure Statement for Medical Device Security (MDS2) statement. Healthcare entities that are Health Information Sharing and Analysis Center (H-ISAC) members can access H-ISAC's library of MDS2 statements collected from their membership.
HIPAA entities should utilize the risk management guidance found on the Office of the National Coordinator for Health Information Technology website, www.healthit.gov.
Organizations may also benefit from using the ONC’s Security Risk Assessment Tool. The use of the ONC tool will also cover the risk assessment requirements from the HIPAA Security Rule.
- Cyber Insurance
Many healthcare organizations have chosen to mitigate the financial risks of cyberattacks, including those posed by third party vendors, by purchasing cyber insurance coverage from their insurance carriers. However, due to the increasing risks related to ransomware in the healthcare and public health (HPH) sector, obtaining cyber insurance coverage has become an increasingly taller task. Following these best practices will help increase a healthcare entities’ chances of obtaining cyber coverage:
- Multi-factor Authentication for access to information systems
- Endpoint Detection and Response
- Secure, air gapped, and encrypted backups
- Privileged Access Management
- Email filtering and web security
- Patching and Vulnerability Management Program
- Cyber Incident Response Plan and Testing
- Cybersecurity awareness and Training Program
- Remote Desktop Protocol hardening and controls
- Logging and Monitoring systems
- Outdated and End-of-Life systems replaced or Compensating Controls in place
- Vendor/Supply Chain Risk Management Program
- Regular Tabletop Exercises for Cyber Incident Response
Following the guidance in Healthcare Cyber in a Box 2.1 provides healthcare organizations with a defensible way to demonstrate compliance needed for cyber insurance coverage.
Additionally, the Cyber Insurance Toolkit, developed by the Indiana Executive Council on Cybersecurity, is a free, easy-to-download resource intended to help businesses and organizations understand what cyber liability insurance is, what it covers and why it’s become an increasingly important part of a company’s risk management strategy.
- Incident Response
Even if the healthcare organization itself has not been subject to a cyber-attack, third-party vendors suffering from attacks can still pose massive operational and data security challenges to healthcare organizations. Increasing the number of vendors supplying applications or services to an organization will likewise increase the likelihood that one of the vendors will experience some sort of cyber-related interruption. It is critical that healthcare organizations develop and maintain incident response plans which include plans for responding to a third- party vendor’s cybersecurity or otherwise related downtime events. Key factors to consider are:
- Operational business continuity plans to continue providing care while the third-party resources are unavailable.
- FEMA offers a free continuity plan template that includes instructions for non-federal entities and community-based organizations
- Technical plans including quick severance of data connections to and from the third party’s systems.
- Maintenance of a log for all communications received from the third party regarding the incident.
- Obtaining an after-incident report including root cause analysis and mitigation/improvement actions taken by the third party in response to the event.
- HICP 10 Best Practices
In January 2021, the President signed into law HR 7898, which provides regulatory incentive for healthcare organizations to adopt recognized security best practice frameworks. The Health Industry Cybersecurity Practices (HICP) publication promulgated by the 405(d) Task Group is cited as a best practice framework for healthcare.
It is comprised of 10 practices that can be implemented to mitigate the risk of being impacted by the top threats facing healthcare organizations. There are two published volumes to help organizations implement the best practices: one for Small Organizations and one for Medium and Large Organizations. The 10 best practices include:
- Email Protection Systems
- Endpoint Protection Systems
- Access Management
- Data Protection and Loss Prevention
- Asset Management
- Network Management
- Vulnerability Management
- Security Operation Center and Incident Response
- Network Connected Medical Devices
- Cybersecurity Oversight and Governance
Healthcare organizations should utilize the 10 best practices as vetting resources when evaluating vendors’ cybersecurity practices as well as their own.
The IECC developed a maturity model to support the HICP 10 Best Practices, Healthcare Cyber in a Box 2.1 and it outlines the steps healthcare organizations need to follow to address HICP guidelines.
- Business Associate Agreements (BAAs)
Business Associate Agreements (BAAs) are a critical component of vendor management for healthcare organizations under HIPAA regulations. These agreements are required when a HIPAA covered entity engages a third party that will have access to, transmit, or store protected health information (PHI) on behalf of the covered entity.
Key points to consider for BAAs include:
- Mandatory Requirement: HIPAA covered entities are required to have a BAA in place with any vendor that handles PHI on their behalf.
- Scope of Agreement: The BAA should clearly define the permitted uses and disclosures of PHI by the business associate.
- Security Measures: The agreement should specify the security measures the business associate must implement to protect PHI, aligning with HIPAA Security Rule requirements.
- Breach Notification: BAAs should include provisions for timely notification to the covered entity in case of a data breach involving PHI.
- Subcontractor Management: The BAA should address how the business associate will manage any subcontractors that may have access to PHI.
- Termination and Data Return: The agreement should outline procedures for the return or destruction of PHI upon termination of the contract.
- Compliance Audits: Consider including provisions that allow for periodic audits or assessments of the business associate's HIPAA compliance.
- Liability and Indemnification: Clear terms should be established regarding liability and indemnification in case of HIPAA violations or data breaches.
Healthcare organizations should work closely with their legal counsel to ensure that their BAAs are comprehensive and comply with all HIPAA requirements. Regular review and updates of these agreements are essential to address evolving cybersecurity threats and regulatory changes.
For additional guidance on BAAs, healthcare entities can refer to the Office for Civil Rights (OCR) website, which provides sample BAA provisions and other relevant resources.
- Model Contract Language Resources
The Health Sector Coordinating Council (HSCC) published the Model Contract Language for Healthcare Cybersecurity (HC2), available here. This model contract, developed by providers, device vendors, and other stakeholders, provides vetted language for ensuring security terms are included in contracts that healthcare organizations enter into.
- Federal Resources
The National Institute of Standards and Technology (NIST) has updated the widely used Cybersecurity Framework (CSF), its landmark guidance document for reducing cybersecurity risk. The new 2.0 edition is designed for all audiences, industry sectors and organization types, from the smallest schools and nonprofits to the largest agencies and corporations — regardless of their degree of cybersecurity sophistication.
In February 2024, NIST also published Special Publication (SP) 800-66r2 (Revision 2): Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. SP 800-66r2 is a comprehensive cybersecurity resource guide that provides guidance for HIPAA-regulated entities on implementing the HIPAA Security Rule, including risk assessment, management of electronic Protected Health Information (ePHI), and improving overall cybersecurity posture.
The Healthcare and Public Health (HPH) Cyber Performance Goals (CPGs) are a set of voluntary cybersecurity standards released by the U.S. Department of Health and Human Services (HHS) to help healthcare organizations prioritize key security actions and reduce risk. The CPGs consist of "essential" goals for establishing minimum security practices and "enhanced" goals for advanced strategies, catering to organizations at different levels of security maturity. These healthcare-specific CPGs build upon existing frameworks and are designed to provide layered protection at various stages of potential cyberattacks, with the possibility of becoming mandatory standards in the future.