The National Institute of Standards and Technology (NIST) has released an initial draft of Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (Resource Guide) for public comment. With this Resource Guide, NIST seeks to help HIPAA regulated entities - covered entities and business associates - understand and implement the HIPAA Security Rule and provides guidance on conducting the required periodic risk assessment. Notably, the Resource Guide is an update to NIST’s 2008 publication on implementing the HIPAA Security Rule.
The Resource Guide includes a brief overview of the HIPAA Security Rule, provides guidance on assessing and managing risks to electronic protected health information (ePHI), identifies typical activities that a regulated entity might consider implementing as part of an information security program, and includes additional resources that regulated entities may find useful in implementing the Security Rule, such as a crosswalk between the HIPAA Security Rule standards and NIST Cybersecurity Framework.
Below is an overview of the content covered by the Resource Guide:
Perhaps most helpful is that NIST has broken each HIPAA Security Rule standard down by key activities that a regulated entity may wish to consider implementing, adding a detailed description, and providing sample questions that a regulated entity might ask itself to assist in implementing the Security Rule. As an example, for the standard Assigned Security Responsibility: “Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate."1 NIST provides sample questions such as:
This detailed guidance for each HIPAA Security Rule standard will be helpful for regulated entities struggling to adopt it with only the language in the HIPAA Security Rule and Office for Civil Rights (OCR) guidance on the same. The Resource Guide should provide more practical considerations for regulated entities operating in today’s complicated cybersecurity environment.
The Risk Assessment Guidelines section of the Resource Guide provide a methodology for conducting a risk assessment. HIPAA Security Rules requires that all regulated entities “[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate” and then “[i]mplement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level."2 This is known as the risk analysis (often referred to as a risk assessment) and risk management plan, respectively. The results of the risk assessment should enable regulated entities to identify appropriate security controls for reducing risk to ePHI. OCR does not prescribe any particular risk assessment or risk management methodology, but has provided guidance such as the Guidance on Risk Analysis and Security Risk Assessment Tool in the past.
NIST’s guidance in this area is similar to previous OCR guidance:
Similar to previous OCR guidance, NIST reminds regulated entities the risk assessment is an ongoing activity, not a one-time, static task, and must be “updated on a periodic basis in order for risks to be properly identified, documented, and subsequently managed.”
Failure to have a thorough and up-to-date risk assessment is one of the top failures documented by OCR in resolution agreements with regulated entities. Therefore, regulated entities should take this opportunity to determine when its last risk assessment was conducted, ensure the risk assessment meets previous OCR guidance, and consider the NIST guidance in this Resource Guide as well.
NIST states the Risk Management Guidelines introduce a “structured, flexible, extensible, and repeatable process” that regulated entities may utilize for managing identified risks and achieving risk-based protection of ePHI. The regulated entity will need to determine what risk rating poses an unacceptable level of risk to ePHI, given the regulated entity’s risk tolerance and appetite. Ultimately, the regulated entity’s risk assessment processes should inform its decisions regarding the implementation of security measures sufficient to reduce risks to ePHI to levels within organizational risk tolerance.