What We Do
How we do it
Resources
SECURITY ADVISORIES
May 11, 2022
CVE-2022-26923 - Active Directory Domain Services Elevation of Privilege Vulnerability
THE THREAT Microsoft has disclosed a new vulnerability impacting Active Directory Certificate Services (ADCS) tracked as CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). If exploited successfully, an authenticated attacker can escalate privileges in environments where ADCS is running on the domain. eSentire is aware of technical details and tooling [2] for…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Feb 08, 2022

Why HIPAA Compliance is Challenging for Healthcare Providers

Speak With A Security Expert Now

The HIPAA Security Rule can get challenging. It covers what your organization needs to do for compliance, but not how it should be done. That’s a crucial piece left to the interpretation of the entities covered under HIPAA.

So, it’s no surprise that most healthcare providers think they are in compliance with the HIPAA Security Rule, while the audit reports by Office for Civil Rights (OCR) tell a different story. According to the OCR, since the HIPAA Security Rule came into effect in April 2003, the most common violations have been:

These violations are not limited to new boutique clinics that may not know any better. In reviewing the frequency of violations, general hospitals top the charts followed by outpatient facilities, pharmacies, and community health centers.

Why is healthcare struggling with HIPAA Compliance issues almost Two decades later?

HIPAA Security Rule compliance isn’t straightforward. Take a quick glance at the HIPAA Security checklist and you’ll realize that you need a dedicated team to work on it. There are many safeguards to follow, and it can seem like a never-ending list of requirements. So, why do the aforementioned violations keep occurring?

Inadequate risk analysis and risk management

Risk analysis is the first item on the HIPAA Security Rule and it requires healthcare organizations to be very thorough. You need to create a detailed inventory of all the ePHI that you receive, transmit, create, or maintain; and this should be done at least every year or as soon as any new information system or application is added to your environment. The number of moving parts involved, coupled with limited resources to keep track of everything makes it challenging for healthcare organizations to conduct a thorough risk analysis.

Our recommendation: Leverage the Security Risk Assessment (SRA) Tool developed by the Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS Office of Civil Rights (OCR) to help guide your IT and cybersecurity team through the risk analysis process.

Insufficient IT and/or cybersecurity resources

From zero-days to brute force and ransomware attacks, cybercriminals have become more specialized and sophisticated in their use of cyberattacks. While there are a growing number of cyber threat actors constantly trying to infiltrate healthcare systems and steal ePHI, most healthcare organizations have only a handful of IT resources in-house to monitor and defend against these cyberattacks alongside troubleshooting day-to-day system or network issues. So, it’s likely that your healthcare practice may need external support to augment your team and help you contain and respond to threats before they become business-disrupting events.

Our recommendation: Engage a Managed Detection and Response (MDR) service provider to help your team effectively detect malicious activity, maintain 24/7 threat hunting, carry out deeper investigation, and a Mean Time to Contain of 15 minutes that ensures cyberattackers don’t have enough time to action on their objectives before being stopped.

Inefficient phishing and security awareness training

Unfortunately, data breaches aren’t purely an external affair. Cyberattackers are betting on luring your staff to download fraudulent files or click malicious links, making your staff the weakest link. Plus, due to the stressful environment of hospitals and clinics, and your staff being focused on patient care, there’s a high probability they will fall prey to a phishing email or accidentally disclose ePHI to the wrong recipient.

Our recommendation: Implement a phishing and security awareness training program to help your team manage an effective user resiliency program, continuously test your staff, and ensure that your weakest link is hardened against the most sophisticated phishing attempts. Additionally, periodically evaluate the quality of your phishing and security awareness training program to stay ahead of evolving cyber threats and minimize the risk of accidental ePHI leaks. HIPAA isn’t the be-all and end-all for cybersecurity. It’s the minimum federal standard to ensure the availability, confidentiality, and integrity of all electronic protected health information (ePHI). There are state laws with more stringent standards that could apply over HIPAA. For example, the Texas Health and Safety code for medical records takes precedence over HIPAA in some cases as it applies to a broader range of entities, has stricter training requirements for staff, prohibits unconsented release of PHI for marketing purposes, and does not allow re-identification of de-identified individuals.

How eSentire MDR helps healthcare providers be more than just HIPAA compliant

Complying with the HIPAA Security Rule while mitigating cyber risk from an expanding threat surface with constrained resources is challenging. While most healthcare providers have traditional perimeter defenses in place, many lack the advanced defenses required to detect and contain modern cyber threats.

As healthcare cybersecurity breaches continue to make national headlines, many healthcare providers are outsourcing their cybersecurity to an MDR service provider that can protect their patients and critical business operations with 24/7 threat detection, investigation, and response.

At eSentire, we work with healthcare delivery organizations ranging from individual practices to major hospitals and their business associates to ensure they have the systems, processes, and controls in place to protect their practice, patient data, and most importantly, critical operations from known and unknown cyber threats

eSentire MDR helps healthcare providers become HIPAA compliant, and maintain their compliance by:

To discuss your security risk assessment and learn about how eSentire can help strengthen your security strategies, book a meeting with one of our security specialists.

Skip To:

  • Why is healthcare struggling with HIPAA Compliance issues almost Two decades later?
  • How eSentire MDR helps healthcare providers be more than just HIPAA compliant
View Most Recent Blogs
eSentire
eSentire

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.