SEC474: Building A Healthcare Security & Compliance Program

Leveraging the HIPAA Security Rule for Better Cybersecurity

One of the challenges organizations face in complying with the Health Insurance Portability and Accountability Act (HIPAA) is that the act's regulatory and privacy standards are not prescriptive enough to help organizations successfully build an effective security and compliance program. Audit and assessment engagements with government agencies such as the Office of Civil Rights (OCR) and with state attorney generals during and after reportable data breaches or privacy-related security incidents can be overwhelming for organizations to navigate without previous knowledge or experience.

"I have peers who understand security strategies, but not as much about HIPAA and vice versa. I have already recommended this course to a peer who is more experienced on the HIPAA side and could gain so much on hearing about the technical controls and administrative processes to address those." -Cheryl Hearne, Conway Regional Health Systems

To address tight budget restrictions, many healthcare organizations promote security and compliance team members from within the organization in order to cultivate and retain talent internally. These professionals have a wide range of experience and skill sets. The SANS SEC474 course can help organizations level-set and prepare healthcare compliance and security by sharing first-hand knowledge and experiences.

The goal of this course is to show that HIPAA compliance in itself is neither an antidote nor a cure for the shortcoming of an organization's healthcare security. The ultimate goal is to develop, maintain, and demonstrate a secure environment for the organization by implementing repeatable processes based on industry best practices. When that is achieved, evidence of HIPAA compliance is a result of those efforts.

Healthcare organizations in the United States face two major challenges: first, to properly secure the organization from tactical risk, and second, to achieve compliance with the array of government regulations known as HIPAA. This course will help students develop the skills to make measurable improvements to the overall security posture of their organization's IT infrastructure while also building and maintaining a compliance program. Using the safeguards of the HIPAA Security Rule along with the NIST Framework 800-66 to identify and assess risk, students will learn how to report progress on their compliance activities and their security value in support of the organization's mission.

Students will gain skills and knowledge in SEC474 that they will be able to use on their first day back at work. Students will leave the classroom knowing what it takes to establish and nurture a culture of compliance where both compliance and business objectives are promoted as a singular goal. They will be able not only to assess compliance, but also to measure the maturity and effectiveness of compliance activities.

You Will Be Able To

• Tackle the challenges at hand - many HIPAA compliance regulations run counter to business objectives, so we will explore why this is and how to overcome the issue.
• Interpret the Security Rule text in-depth, including an analysis of every line item of the regulation and what it means to your organization.
• Draft sound policy that supports business as well as compliance objectives.
• Perform a risk assessment, enumerate threat data, analyze vulnerabilities, and select proper safeguards to lower risk.
• Define the value of the compliance program for the organization.
• Create a culture of compliance.
• Establish lines of communication and reporting channels.
• Understand the value of internal monitoring and auditing by learning the key components of a continuous monitoring reporting and improvement program.
• Promote a culture of compliance.

This Course Will Prepare You To

• Take steps to meet compliance standards, particularly those of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and Health Information Technology for Economic and Clinical Health Act (HITECH)
• Protect your healthcare organization from cyber-threats, unintended data disclosures, and mishandling of data in the enterprise
• Understand the most prevalent security concerns specifically around the healthcare industry such as data disclosures, ransomware, unauthorized access and modification, incident response, and business continuity planning
• Apply the HIPAA Security Rule in practice
• Build an organizational security plan
• Understand the job roles in a compliance program

Hands-On Labs

The hands-on labs will teach you practical actions to protect a healthcare-based environment. The labs draw on real-world examples. Each lab has step-by-step instructions that enable you to learn new skills or become even more knowledgeable and skilled with the cybersecurity techniques and procedures you already know.

1. Lab Install: Initial download and installation of lab VM where the referenced software and data reside, ensuring students have the core resources needed to complete the remainder of the labs.
2. Rules of the Road: Use raw field data from a site assessment walk-through and enter results into an assessor in order to ensure that students are comfortable with navigating both the assessor and ticketing provided in lab software, and then enter data into the most appropriate sections.
3. Identifying Vulnerabilities and Threats: Analyze and prioritize vulnerabilities in ticketing systems referencing organizational policies and procedures in order to ensure that students are comfortable with navigating the policy manager software provided in the lab VM.
4. Mapping and Scoring Assessment Maturity Ratings: Analyze assessment report results and enter the appropriate maturity scale (1-4) based on the evidence provided in order to ensure that students are familiar with the rating and scoring process within the assessor software.
5. Safeguards and Storage: Review ticket requests and security incidents common in the healthcare industry and make appropriate decisions based on the evidence and information obtained from key departments outside of security. This lab requires student to use critical thinking based on a number of key factors.
6. Measuring Response Effectiveness: Analyze a recent Ryuk Ransomware security incident report to measure response effectiveness as it relates to current trends in cybersecurity and specifically the healthcare industry. Using the Mitre ATT&CK framework, students will also have an added bonus challenge to unmask the suspected threat group responsible for the attack!
7. Finalizing a Telecommute Policy: Review a drafted telecommute policy that is missing key security and compliance elements. Students will need to address common challenges faced during the COVID-19 pandemic, enabling remote workers to securely continue operations from home.
8. Business Impact Analysis (BIA) for Telehealth Services: Analyze and review a BIA for telehealth services that has been recently updated. Students will respond to an email form the IT Director on overall business impact and recovery time objective score information that is derived from the BIA.
9. Initial Assessment for Telehealth Services: Review and assess three software\hardware platforms to use telehealth services and engage with patients remotely. Students will assess the security controls of each solution proposed and list pros and risks associated with the individual platforms. Then they'll make recommendations on which telehealth platform should be selected with supporting reasoning and taking into consideration the recent guidelines issued by the U.S. Department of Health and Human Services (HHS) during the pandemic.
10. Reporting to Management: Review and complete missing sections of the annual Information Security Report to the executive board by looking up tickets within the ticketing system and contacting key individuals by email to obtain additional information and context to provide to the CIO for an upcoming board meeting. Students will take elements and data points gathered from previous labs to enter in final updates.

What You Will Receive

• Physical and digital workbooks
• Virtual Machine tailored to the course
• HIPAA-Based Risk Assessment Tool

Additional Resources

• Healthcare Security Resources Blog
• Top 6 HIPAA ePHI Exposures Infographic
• HIPAA Compliance Dos and Don'ts Infographic