What We Do
How We Do
Get Started

Why HIPAA Security Rule Compliance is Challenging for Healthcare Providers

BY eSentire

February 8, 2022 | 6 MINS READ

Regulatory Compliance

Want to learn more on how to achieve Cyber Resilience?



The HIPAA Security Rule can get challenging. It covers what your organization needs to do for compliance, but not how it should be done. That’s a crucial piece left to the interpretation of the entities covered under HIPAA.

So, it’s no surprise that most healthcare providers think they are in compliance with the HIPAA Security Rule, while the audit reports by Office for Civil Rights (OCR) tell a different story. According to the OCR, since the HIPAA Security Rule came into effect in April 2003, the most common violations have been:

Common HIPAA Security Rule Violations

These HIPAA Security Rule violations are not limited to new boutique clinics that may not know any better. In reviewing the frequency of violations, general hospitals top the charts followed by outpatient facilities, pharmacies, and community health centers.

Why is healthcare struggling with HIPAA Security Rule Compliance issues almost two decades later?

HIPAA Security Rule compliance isn’t straightforward. Take a quick glance at the HIPAA Security checklist and you’ll realize that you need a dedicated team to work on it. There are many safeguards to follow, and it can seem like a never-ending list of requirements. So, why do the aforementioned violations keep occurring?

Common HIPAA Compliance Challenges

Inadequate risk analysis and risk management

Risk analysis is the first item on the HIPAA Security Rule and it requires healthcare organizations to be very thorough. You need to create a detailed inventory of all the ePHI that you receive, transmit, create, or maintain; and this should be done at least every year or as soon as any new information system or application is added to your environment. The number of moving parts involved, coupled with limited resources to keep track of everything makes it challenging for healthcare organizations to conduct a thorough risk analysis.

Our recommendation: Leverage the Security Risk Assessment (SRA) Tool developed by the Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS Office of Civil Rights (OCR) to help guide your IT and cybersecurity team through the risk analysis process.

Insufficient IT and/or cybersecurity resources

From zero-days to brute force and ransomware attacks, cybercriminals have become more specialized and sophisticated in their use of cyberattacks. While there are a growing number of cyber threat actors constantly trying to infiltrate healthcare systems and steal ePHI, most healthcare organizations have only a handful of IT resources in-house to monitor and defend against these cyberattacks alongside troubleshooting day-to-day system or network issues. So, it’s likely that your healthcare practice may need external support to augment your team and help you contain and respond to threats before they become business-disrupting events.

Our recommendation: Engage a Managed Detection and Response (MDR) service provider to help your team effectively detect malicious activity, maintain 24/7 threat hunting, carry out deeper investigation, and a Mean Time to Contain of 15 minutes that ensures cyberattackers don’t have enough time to action on their objectives before being stopped.

Inefficient phishing and security awareness training

Unfortunately, data breaches aren’t purely an external affair. Cyberattackers are betting on luring your staff to download fraudulent files or click malicious links, making your staff the weakest link. Plus, due to the stressful environment of hospitals and clinics, and your staff being focused on patient care, there’s a high probability they will fall prey to a phishing email or accidentally disclose ePHI to the wrong recipient.

Our recommendation: Implement a phishing and security awareness training program to help your team manage an effective user resiliency program, continuously test your staff, and ensure that your weakest link is hardened against the most sophisticated phishing attempts. Additionally, periodically evaluate the quality of your phishing and security awareness training program to stay ahead of evolving cyber threats and minimize the risk of accidental ePHI leaks. HIPAA isn’t the be-all and end-all for cybersecurity. It’s the minimum federal standard to ensure the availability, confidentiality, and integrity of all electronic protected health information (ePHI). There are state laws with more stringent standards that could apply over HIPAA. For example, the Texas Health and Safety code for medical records takes precedence over HIPAA in some cases as it applies to a broader range of entities, has stricter training requirements for staff, prohibits unconsented release of PHI for marketing purposes, and does not allow re-identification of de-identified individuals.

How eSentire MDR helps healthcare providers be more than just HIPAA compliant

Complying with the HIPAA Security Rule while mitigating cyber risk from an expanding threat surface with constrained resources is challenging. While most healthcare providers have traditional perimeter defenses in place, many lack the advanced defenses required to detect and contain modern cyber threats.

As healthcare cybersecurity breaches continue to make national headlines, many healthcare providers are outsourcing their cybersecurity to an MDR service provider that can protect their patients and critical business operations with 24/7 threat detection, investigation, and response.

At eSentire, we work with healthcare delivery organizations ranging from individual practices to major hospitals and their business associates to ensure they have the systems, processes, and controls in place to protect their practice, patient data, and most importantly, critical operations from known and unknown cyber threats

eSentire MDR helps healthcare providers become HIPAA compliant, and maintain their compliance by:

To discuss your security risk assessment and learn about how eSentire can help strengthen your HIPAA Security Rule strategies, book a meeting with one of our security specialists.


eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire