A Vendor's Security Reality: Comply Or Good-Bye
Privacy compliance is now mission critical. Third-party suppliers that fail to meet data protection mandates will be excluded from doing business in lucrative vertical markets.
The Health Insurance Portability and Accountably Act (HIPAA) Omnibus Rule and the Federal Information Security Management Act (FISMA) have introduced an unprecedented emphasis on third-party compliance. For those providing services within the healthcare sector or to the federal government, privacy compliance is now mission critical. Although vendor compliance has long been clouded in ambiguity, these directives provide much needed and long-overdue clarity to the vast vendor community.
Unfortunately, many vendors have yet to address their compliance obligations and are now scrambling to salvage customer relationships. Federal regulators, awakened by the expansion of outsourcing and the unending drumbeat of vendor breaches, have turned their focus directly toward service providers and the risks they pose. The result is that vendors face a new and stark reality: comply or good-bye. Those that fail to meet specific data protection mandates ultimately will be excluded from doing business in these lucrative vertical markets.
HIPAA Omnibus Rule
The HIPAA Omnibus Rule represents a dramatic change to healthcare regulation and jolted the vendor community. Although enacted in 2009 as part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the effective date was postponed until September 2013. The Omnibus Rule addresses important issues such as disclosure and patient rights, but the most significant change, from a data protection perspective, relates to the responsibilities of "business associates" — any entity that "creates, receives, maintains or transmits protected health information on behalf of a health care provider or insurer."
Before September 2013, healthcare vendors were required to meet minimal data protection standards, while hospitals, health clinics, and insurance plans were subject to the full scope of HIPAA's Privacy and Security Rules. The Omnibus Rule, however, subjects vendors to requirements that had previously applied only to covered entities. Therefore, vendors must implement a combination of administrative, technical, and physical safeguards to ensure the security of protected health information or be exposed to the consequences of a regulatory violation.
Specifically, vendors are required to:
Conduct a formal risk assessment
Implement measures to mitigate internal and external risk
Implement written policies governing the security of protected health information
Conduct data security training for all employees
Restrict physical access to storage of protected health information
Protect workstations and electronic media
Implement technologies to prohibit unauthorized access
Log all electronic access of protected health information
Secure electronically transmitted protected health information
In addition to experiencing disruption of customer relationships, healthcare vendors are now exposed to significant financial penalties from the Department of Health and Human Services for failure to comply with HIPAA. Should you doubt the government's resolve in enforcing the rigorous business associate requirements, several vendors have been fined in excess of $500,000 since the implementation of the Omnibus Rule.
FISMA
FISMA was enacted in 2002 as a framework for ensuring the security of systems that support government operations. It requires all federal agencies, entities administering federally funded programs, federal grant recipients, and government contractors to develop, document, and implement a program to secure federal information and corresponding systems. FISMA mandates that those subject to the law implement "baseline security controls" through a combination of managerial, operational, and technical measures and is aligned with NIST 800-53, the National Institute of Standards and Technology's outline of security controls for federal information systems.
Although third-party service providers have been subject to FISMA since its enactment, vendor compliance has been prioritized over the past few years. This development has prompted government contractors to pursue FISMA compliance or risk exclusion from the federal vendor community. Enforcement of FISMA's third-party standard is being performed primarily through the procurement process, with all prospective vendors required to attest to adherence with rigorous data security controls when responding to a solicitation. The specific language within contract awards mandates that vendors submit evidence of FISMA compliance in the form of monthly, quarterly, and annual deliverables.
Accordingly, if your company is doing business with a government agency, you will be required to provide detailed and ongoing evidence of compliance. Additionally, agencies are increasingly deploying audit teams to perform on-site verification of a vendor's control environment.
The following list, taken directly from a Federal Highway Administration RFP, details the specific documents that vendors must provide as evidence of FISMA compliance:
Security assessment: formal evaluation of control environment (annual)
Plan of action: plan to mitigate assessment findings (quarterly)
System security plan: documentation of all controls (annual)
Security categorization: impact level of each system (annual)
System contingency plan: documentation of redundancy (annual)
Security policy and workforce training records (annual)
Interconnection agreements from sub-contractors (annual)
The New Reality
Although meeting the enhanced requirements of HIPAA or FISMA will entail additional resources, third-party service providers should view this as a critical, long-term investment. The reality is that vendors operating within highly regulated industries must be capable of demonstrating compliance to each customer. Therefore, those who are unable to meet the new regulatory mandates will find themselves on the outside, looking in.
Related Content:
About the Author
You May Also Like
A Cyber Pros' Guide to Navigating Emerging Privacy Regulation
Dec 10, 2024Identifying the Cybersecurity Metrics that Actually Matter
Dec 11, 2024The Current State of AI Adoption in Cybersecurity, Including its Opportunities
Dec 12, 2024Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024