Tips for Preparing Your Healthcare Organization for a HITRUST Audit

The Health Information Trust Alliance is a U.S.-based organization that works with healthcare, technology and information security leaders to establish a Common Security Framework (CSF). A CSF is a body of controls for all organizations to follow to create, access, store and exchange private or regulated data. The Health Information Trust Alliance believes security should be a core pillar of health information systems and exchanges, not an obstacle to be hurtled, hence its mission to normalize security controls via the CSF. The CSF includes:

• 14 control categories
• 49 objectives
• 149 total control specifications (64 of which must be in place and operating effectively for organizations to achieve certification)

Today, 83 percent of hospitals and 82 percent of health plans implement the CSF framework to protect private information, and this number will grow. The payer industry has mandated an expansion of the healthcare industry’s use of their CSF due to an alarming number of cybercrime threats and breaches. As a result, 7,500 business associates will be required to garner certification within the next year and a half.

For most organizations, certification isn’t easy. There are numerous gaps to close in the handling, storing and sharing of information, and the reason organizations have avoided or don’t complete certification is lack of time and resources. Especially considering they must first have a HIPAA Risk Assessment performed, and then another round of assessments for HITRUST certification that often involves duplicate effort and expenses.

Why Healthcare Organizations Need HITRUST Certification?

Healthcare organizations are under scrutiny today as the value of personal data far exceeds a credit card or bank account number. By receiving their HITRUST certification, organizations can demonstrate that they are trustworthy business partners. Likewise, HITRUST certification boosts customer confidence in your organization because it lets customers know their personal health information is protected by a protocol that harmonizes privacy and security standards.

From an internal standpoint, HITRUST certification can also save your organization an average of $300,000 each time you use your certification instead of undergoing an external assessment requested by a client or customer. Overall, HITRUST certification will reduce your number of audit requests and the time it takes to perform an internal assessment. It will also simplify compliance and position your organization to take a more proactive approach to security management.

4 Tips for Preparing for a HITRUST Audit:

1. Get support from the top.
   HITRUST certification is an extensive undertaking that will require both time and manpower to complete and uphold. For this reason, you need executive buy-in and support.
2. Establish open communication between employees, management, executives, assessor and HITRUST.
   Certification is going to require all hands on deck and (once the CSF is in place) everyone must understand what is expected of them regarding the implementation of the framework. The CSF won’t work properly to protect information without adherence from all employees.
3. Prepare you IT department for heavy lifting.
   Your IT department will be shouldering a large amount of the weight during and after HITRUST certification. Make certain they are closely involved in the planning and scheduling of certification phases.
4. Implement a formal HITRUST support program.
   Certification is only good for two years from the certification date. For long term success and recertification, your best bet is obtaining certification through a formal program. While self assessment options are available through HITRUST, using a qualified CSF assessor organization will help ensure the most thorough evaluation and certification process.

Work with a globally licensed and qualified security assessor to close risky gaps in your information management process, safeguard your data and position yourself as a leader in healthcare information security.