What We Do
How we do it
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
Jan 19, 2023
Increased Activity in Google Ads Distributing Information Stealers
THE THREAT On January 18th, 2023, eSentire Threat Intelligence identified multiple reports, both externally and internally, containing information on an ongoing increase in Google advertisements…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Dec 13, 2022
eSentire Named First Managed Detection and Response Partner by Global Insurance Provider Coalition
Waterloo, ON – December 13, 2022 – eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced it has been named the first global MDR partner by Coalition, the world’s first Active Insurance provider designed to prevent digital risk before it strikes. Like Coalition, eSentire is committed to putting their customers’ businesses ahead of disruption by improving their…
Read More
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Feb 08, 2022

Why HIPAA Compliance is Challenging for Healthcare Providers

6 minutes read
Speak With A Security Expert Now

The HIPAA Security Rule can get challenging. It covers what your organization needs to do for compliance, but not how it should be done. That’s a crucial piece left to the interpretation of the entities covered under HIPAA.

So, it’s no surprise that most healthcare providers think they are in compliance with the HIPAA Security Rule, while the audit reports by Office for Civil Rights (OCR) tell a different story. According to the OCR, since the HIPAA Security Rule came into effect in April 2003, the most common violations have been:

These violations are not limited to new boutique clinics that may not know any better. In reviewing the frequency of violations, general hospitals top the charts followed by outpatient facilities, pharmacies, and community health centers.

Why is healthcare struggling with HIPAA Compliance issues almost Two decades later?

HIPAA Security Rule compliance isn’t straightforward. Take a quick glance at the HIPAA Security checklist and you’ll realize that you need a dedicated team to work on it. There are many safeguards to follow, and it can seem like a never-ending list of requirements. So, why do the aforementioned violations keep occurring?

Inadequate risk analysis and risk management

Risk analysis is the first item on the HIPAA Security Rule and it requires healthcare organizations to be very thorough. You need to create a detailed inventory of all the ePHI that you receive, transmit, create, or maintain; and this should be done at least every year or as soon as any new information system or application is added to your environment. The number of moving parts involved, coupled with limited resources to keep track of everything makes it challenging for healthcare organizations to conduct a thorough risk analysis.

Our recommendation: Leverage the Security Risk Assessment (SRA) Tool developed by the Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS Office of Civil Rights (OCR) to help guide your IT and cybersecurity team through the risk analysis process.

Insufficient IT and/or cybersecurity resources

From zero-days to brute force and ransomware attacks, cybercriminals have become more specialized and sophisticated in their use of cyberattacks. While there are a growing number of cyber threat actors constantly trying to infiltrate healthcare systems and steal ePHI, most healthcare organizations have only a handful of IT resources in-house to monitor and defend against these cyberattacks alongside troubleshooting day-to-day system or network issues. So, it’s likely that your healthcare practice may need external support to augment your team and help you contain and respond to threats before they become business-disrupting events.

Our recommendation: Engage a Managed Detection and Response (MDR) service provider to help your team effectively detect malicious activity, maintain 24/7 threat hunting, carry out deeper investigation, and a Mean Time to Contain of 15 minutes that ensures cyberattackers don’t have enough time to action on their objectives before being stopped.

Inefficient phishing and security awareness training

Unfortunately, data breaches aren’t purely an external affair. Cyberattackers are betting on luring your staff to download fraudulent files or click malicious links, making your staff the weakest link. Plus, due to the stressful environment of hospitals and clinics, and your staff being focused on patient care, there’s a high probability they will fall prey to a phishing email or accidentally disclose ePHI to the wrong recipient.

Our recommendation: Implement a phishing and security awareness training program to help your team manage an effective user resiliency program, continuously test your staff, and ensure that your weakest link is hardened against the most sophisticated phishing attempts. Additionally, periodically evaluate the quality of your phishing and security awareness training program to stay ahead of evolving cyber threats and minimize the risk of accidental ePHI leaks. HIPAA isn’t the be-all and end-all for cybersecurity. It’s the minimum federal standard to ensure the availability, confidentiality, and integrity of all electronic protected health information (ePHI). There are state laws with more stringent standards that could apply over HIPAA. For example, the Texas Health and Safety code for medical records takes precedence over HIPAA in some cases as it applies to a broader range of entities, has stricter training requirements for staff, prohibits unconsented release of PHI for marketing purposes, and does not allow re-identification of de-identified individuals.

How eSentire MDR helps healthcare providers be more than just HIPAA compliant

Complying with the HIPAA Security Rule while mitigating cyber risk from an expanding threat surface with constrained resources is challenging. While most healthcare providers have traditional perimeter defenses in place, many lack the advanced defenses required to detect and contain modern cyber threats.

As healthcare cybersecurity breaches continue to make national headlines, many healthcare providers are outsourcing their cybersecurity to an MDR service provider that can protect their patients and critical business operations with 24/7 threat detection, investigation, and response.

At eSentire, we work with healthcare delivery organizations ranging from individual practices to major hospitals and their business associates to ensure they have the systems, processes, and controls in place to protect their practice, patient data, and most importantly, critical operations from known and unknown cyber threats

eSentire MDR helps healthcare providers become HIPAA compliant, and maintain their compliance by:

To discuss your security risk assessment and learn about how eSentire can help strengthen your security strategies, book a meeting with one of our security specialists.

Skip To:

  • Why is healthcare struggling with HIPAA Compliance issues almost Two decades later?
  • How eSentire MDR helps healthcare providers be more than just HIPAA compliant
View Most Recent Blogs

eSentire is the Authority in Managed Detection and Response, protecting the critical data and applications of 1500+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, 24/7 Threat Hunting, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts & Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Incident Response services. For more information, visit www.esentire.com and follow @eSentire.