A Vendor's Security Reality: Comply Or Good-Bye

The Health Insurance Portability and Accountably Act (HIPAA) Omnibus Rule and the Federal Information Security Management Act (FISMA) have introduced an unprecedented emphasis on third-party compliance. For those providing services within the healthcare sector or to the federal government, privacy compliance is now mission critical. Although vendor compliance has long been clouded in ambiguity, these directives provide much needed and long-overdue clarity to the vast vendor community.

Unfortunately, many vendors have yet to address their compliance obligations and are now scrambling to salvage customer relationships. Federal regulators, awakened by the expansion of outsourcing and the unending drumbeat of vendor breaches, have turned their focus directly toward service providers and the risks they pose. The result is that vendors face a new and stark reality: comply or good-bye. Those that fail to meet specific data protection mandates ultimately will be excluded from doing business in these lucrative vertical markets.

HIPAA Omnibus Rule
The HIPAA Omnibus Rule represents a dramatic change to healthcare regulation and jolted the vendor community. Although enacted in 2009 as part of the Health Information Technology for Economic and Clinical Health (HITECH) Act, the effective date was postponed until September 2013. The Omnibus Rule addresses important issues such as disclosure and patient rights, but the most significant change, from a data protection perspective, relates to the responsibilities of "business associates" — any entity that "creates, receives, maintains or transmits protected health information on behalf of a health care provider or insurer."

Before September 2013, healthcare vendors were required to meet minimal data protection standards, while hospitals, health clinics, and insurance plans were subject to the full scope of HIPAA's Privacy and Security Rules. The Omnibus Rule, however, subjects vendors to requirements that had previously applied only to covered entities. Therefore, vendors must implement a combination of administrative, technical, and physical safeguards to ensure the security of protected health information or be exposed to the consequences of a regulatory violation.

Specifically, vendors are required to:

In addition to experiencing disruption of customer relationships, healthcare vendors are now exposed to significant financial penalties from the Department of Health and Human Services for failure to comply with HIPAA. Should you doubt the government's resolve in enforcing the rigorous business associate requirements, several vendors have been fined in excess of $500,000 since the implementation of the Omnibus Rule.

FISMA
FISMA was enacted in 2002 as a framework for ensuring the security of systems that support government operations. It requires all federal agencies, entities administering federally funded programs, federal grant recipients, and government contractors to develop, document, and implement a program to secure federal information and corresponding systems. FISMA mandates that those subject to the law implement "baseline security controls" through a combination of managerial, operational, and technical measures and is aligned with NIST 800-53, the National Institute of Standards and Technology's outline of security controls for federal information systems.

Although third-party service providers have been subject to FISMA since its enactment, vendor compliance has been prioritized over the past few years. This development has prompted government contractors to pursue FISMA compliance or risk exclusion from the federal vendor community. Enforcement of FISMA's third-party standard is being performed primarily through the procurement process, with all prospective vendors required to attest to adherence with rigorous data security controls when responding to a solicitation. The specific language within contract awards mandates that vendors submit evidence of FISMA compliance in the form of monthly, quarterly, and annual deliverables.

Accordingly, if your company is doing business with a government agency, you will be required to provide detailed and ongoing evidence of compliance. Additionally, agencies are increasingly deploying audit teams to perform on-site verification of a vendor's control environment.

The following list, taken directly from a Federal Highway Administration RFP, details the specific documents that vendors must provide as evidence of FISMA compliance:

The New Reality
Although meeting the enhanced requirements of HIPAA or FISMA will entail additional resources, third-party service providers should view this as a critical, long-term investment. The reality is that vendors operating within highly regulated industries must be capable of demonstrating compliance to each customer. Therefore, those who are unable to meet the new regulatory mandates will find themselves on the outside, looking in.

Related Content: