NIST Releases Draft Cybersecurity Resource Guide on Implementing the HIPAA Security Rule

The National Institute of Standards and Technology (NIST) has released an initial draft of Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (Resource Guide) for public comment. With this Resource Guide, NIST seeks to help HIPAA regulated entities - covered entities and business associates - understand and implement the HIPAA Security Rule and provides guidance on conducting the required periodic risk assessment. Notably, the Resource Guide is an update to NIST’s 2008 publication on implementing the HIPAA Security Rule.

The Resource Guide includes a brief overview of the HIPAA Security Rule, provides guidance on assessing and managing risks to electronic protected health information (ePHI), identifies typical activities that a regulated entity might consider implementing as part of an information security program, and includes additional resources that regulated entities may find useful in implementing the Security Rule, such as a crosswalk between the HIPAA Security Rule standards and NIST Cybersecurity Framework.

Below is an overview of the content covered by the Resource Guide:

Considerations When Applying the HIPAA Security Rule

Perhaps most helpful is that NIST has broken each HIPAA Security Rule standard down by key activities that a regulated entity may wish to consider implementing, adding a detailed description, and providing sample questions that a regulated entity might ask itself to assist in implementing the Security Rule. As an example, for the standard Assigned Security Responsibility: “Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the covered entity or business associate."¹ NIST provides sample questions such as:

1. Who in the organization is responsible for overseeing the security policies, conducting the risk assessment and risk management, handling the results of periodic security evaluations and continuous monitoring, and directing IT security purchasing and investment?
2. Does the security official have adequate access and communications with senior officials in the organization?
3. Who in the organization is authorized to accept risks from systems on behalf of the organization?

This detailed guidance for each HIPAA Security Rule standard will be helpful for regulated entities struggling to adopt it with only the language in the HIPAA Security Rule and Office for Civil Rights (OCR) guidance on the same. The Resource Guide should provide more practical considerations for regulated entities operating in today’s complicated cybersecurity environment.

Risk Assessment Guidelines

The Risk Assessment Guidelines section of the Resource Guide provide a methodology for conducting a risk assessment. HIPAA Security Rules requires that all regulated entities “[c]onduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate” and then “[i]mplement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level."² This is known as the risk analysis (often referred to as a risk assessment) and risk management plan, respectively. The results of the risk assessment should enable regulated entities to identify appropriate security controls for reducing risk to ePHI. OCR does not prescribe any particular risk assessment or risk management methodology, but has provided guidance such as the Guidance on Risk Analysis and Security Risk Assessment Tool in the past.

NIST’s guidance in this area is similar to previous OCR guidance:

1. Prepare for the Assessment. Before beginning the risk assessment, understand where ePHI is created, received, maintained, processed, or transmitted. This must include all parties and systems to which ePHI is transmitted, including remote workers, external service providers, and medical devices that process ePHI.
2. Identify Realistic Threats. Identify potential threat events and sources, including (but not limited to) ransomware, insider threats, phishing, environmental threats (e.g., power failure), and natural threats (e.g., flood).
3. Identify Potential Vulnerabilities and Predisposing Conditions. Identify vulnerabilities or conditions that can be exploited for the threats identified in Step 2 to have an impact.
4. Determine the Likelihood of a Threat Exploiting a Vulnerability. For each threat identified in Step 2, determine the likelihood of a threat exploiting a vulnerability. A low, moderate, or high risk scale is commonly used but not required.
5. Determine the Impact of a Threat Exploiting a Vulnerability. The regulated entity should select an impact rating for each identified threat/vulnerability pair and may consider how the threat event can affect the loss or degradation of the confidentiality, integrity, and/or availability of ePHI. Example impacts would include an inability to perform business functions, financial losses, and reputational harm. Again, a low, moderate, or high risk scale is commonly used but not required.
6. Determine the Level of Risk. The level of risk is determined by analyzing the overall likelihood of threat occurrence (Step 4) and the resulting impact (Step 5). A risk-level matrix can be helpful in determining risk levels for each threat event/vulnerability pair.
7. Document the Results.

Similar to previous OCR guidance, NIST reminds regulated entities the risk assessment is an ongoing activity, not a one-time, static task, and must be “updated on a periodic basis in order for risks to be properly identified, documented, and subsequently managed.”

Failure to have a thorough and up-to-date risk assessment is one of the top failures documented by OCR in resolution agreements with regulated entities. Therefore, regulated entities should take this opportunity to determine when its last risk assessment was conducted, ensure the risk assessment meets previous OCR guidance, and consider the NIST guidance in this Resource Guide as well.

Risk Management Guidelines

NIST states the Risk Management Guidelines introduce a “structured, flexible, extensible, and repeatable process” that regulated entities may utilize for managing identified risks and achieving risk-based protection of ePHI. The regulated entity will need to determine what risk rating poses an unacceptable level of risk to ePHI, given the regulated entity’s risk tolerance and appetite. Ultimately, the regulated entity’s risk assessment processes should inform its decisions regarding the implementation of security measures sufficient to reduce risks to ePHI to levels within organizational risk tolerance.

Conclusion