CynergisTek, Inc, a leader in health care cybersecurity, privacy, and compliance, recently released its annual report, "Measuring Progress: Expanding the Horizon." The 2019 report provides a sobering analysis of how health care provider organizations measured against the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the HIPAA Security and Privacy Rules, which outlines best practices for health care organizations to adopt to manage cybersecurity risks.
CynergisTek’s 2019 report aggregates ratings from privacy and security assessments performed in 2018 at nearly 600 health care provider organizations and business associates across the nation to reveal an average 47% conformance with NIST CSF controls and an average 72% conformance with the HIPAA Security Rule. This reflects only a 2% increase with conformance with NIST CST and a 2% decrease in conformance with the HIPAA Security Rule from the previous year’s findings. New areas of research in the report take a deeper look into the Five Core Functions of the NIST framework, and a new section focused on top privacy issues based on CynergisTek’s privacy assessments and privacy monitoring service. The report also examines the leading risks posed by third-party vendors.
Additional findings and insights from the "Measuring Progress: Expanding the Horizon" report include the following:
“The slight decline in the Awareness and Training category under the Protection Function is very alarming considering how much more sophisticated attackers were with targeted phishing attempts and new attack vectors, such as medical devices,” says David Finn, executive vice president of strategic innovation at CynergisTek. “Furthermore, the fact that we did not see any improvement in either the Respond or Recover functions means we may be losing even more ground with the increased number of attacks last year. Organizations need to take into account whether their individual security needs are actually being met in order to be truly secure, and not only compliant.”
CynergisTek’s 2019 report demonstrates that compliance and security are not one and the same. After being in effect for 14 years, the industry is still only achieving 72% compliance on the HIPAA Security Rule, a C-level grade at best. From a technical security perspective, this rule is no longer as relevant, since being compliant with an older, out of date rule is not about security; it is about checking boxes, and that is not a measure of risk posture or actual security. The report results highlight the growing need for health care organizations to make serious investments in cybersecurity readiness, as cybersecurity has become one of the top business risks facing health care today.
The report also includes expertise and analysis from CynergisTek’s thought leaders, as well as proven best practices for strengthening privacy and security controls at health care organizations. The full report can be downloaded here.
— Source: CynergisTek, Inc