RSI Security

Rethinking Your Cybersecurity

Category: Compliance Standards

Staying informed about all of the cyber security compliance standards is essential to keeping your company safe from hackers. Read on to learn about the various steps you can take to stay up to date with your industry’s compliance standards.

  • What Are the Different Types of HITRUST Assessments?

    What Are the Different Types of HITRUST Assessments?

    Ever since 1996, with the passage of the Health Insurance Portability and Accountability Act (HIPAA), healthcare organizations have been assessing the risks that are associated with electronic health records (EHRs). Now, with nearly every hospital utilizing the latest gadgets in healthcare technology from cloud storage to automation to mobile tablets and devices, the need for protecting patient data is at an all-time high.

    To help manage and reduce the risk of data breaches, healthcare organizations promote the use of security frameworks. One such framework is the HITRUST community security framework (CSF). The reason this framework is among the most trusted in the healthcare industry is how it can be adjusted to fit any HIPAA mandate or new healthcare law — thus never leaving room for penalties due to security issues.

    In fact, it’s for this very reason healthcare organizations are starting to require their business associates to be HITRUST certified. If you’re considering HITRUST CSF, then you should be aware of the different types of HITRUST assessment.

    (more…)

  • How Long Does it Take to Get HITRUST Certified?

    How Long Does it Take to Get HITRUST Certified?

    Over the past two decades, many healthcare companies have struggled to transition from physical to digital record keeping as mandated by the HITECH Act. Naturally, the convoluted changes, standards, and stringencies outlined therein have left businesses confused, scratching their heads, wondering how best to wade through this quagmire. As a result, the total overhaul of such a massive system has moved at a glacial pace. 

    To make matters more complicated, as the healthcare industry develops, growing evermore dependent upon emerging and expanding technologies in order to cache and deliver electronic healthcare records [EHR], ensuring compliance and maintaining cybersecurity has become an increasingly intricate ballet. A large aspect of compliance involves obtaining your HITRUST certification, which is no simple process. So, to help you prepare for the obstacles ahead, below, you’ll find our comprehensive guide on the HITRUST certification process and timeline.

    (more…)

  • How HITECH Protects Private Patient Information

    How HITECH Protects Private Patient Information

    2019 seems to be the year of information breaches. 2019 is reaching the fourth quarter soon, but this year has already seen at least 25 million patient records breached; this is a staggering ten million more than in 2018. 

    The breaches seem to be getting larger as well according to the ten biggest healthcare data breaches, with more than 200,000 records breached at a time. Additionally, not all healthcare companies are reporting the breaches in a timely manner as required by law. 

    How can you establish trust as a healthcare provider or entity that safeguards patient data? 

    (more…)

  • How Are E-Commerce Websites Affected By GDPR Regulations?

    How Are E-Commerce Websites Affected By GDPR Regulations?

    E-Commerce websites are constantly under scrutiny for a myriad of reasons. Whether it be from consumers or regulatory committees, these websites need to play defense 24/7 to ensure their networks remain compromise-free from the threat of hackers. This is one of the main reasons why the General Data Protection Regulation (GDPR) was adopted in Europe in 2006.

    Although GDPR may be somewhat of a regulatory headache for e-commerce websites, it is also important for keeping consumer data secure. With an estimated average of 4,800 e-commerce websites every month becoming compromised by hackers inserting malicious code into their website to steal payment information such as credit card numbers, names, and more – there is no denying that a strong defense is the perfect solution.  

    This is why having a GDPR compliance checklist for e-commerce companies is incredibly advantageous in helping overcome these malicious network intruders. Let’s walk you through our GDPR e-commerce checklist that helps online retailers understand the importance of GDPR and what rules and regulations they should familiarize themselves and their IT teams with.

    (more…)

  • HITRUST Scoring Guide: What is it and How Does it Work?

    HITRUST Scoring Guide: What is it and How Does it Work?

    In 2007, the Health Information Trust Alliance (HITRUST) took the world of healthcare security by storm when it introduced a framework that does not only protect sensitive information but also manage risks for global organizations across third-party supply chains. 

    Technically-speaking, the HITRUST Common Security Framework (CSF) characterizes and transforms HITECH and HIPAA requirements into a standard functional procedure which is subsequently documented and compared to other data privacy and security regulations. 

    This allows healthcare organizations to effectively cultivate compliance and be able to meet an extensive range of regulatory requirements. Apart from bringing together HIPAA and HITECH, the HITRUST CSF also boasts globally-recognized security standards such as PCI, COBIT, FTC, ISO, Red Flags, and NIST which work together to take a visionary approach to risk mitigation and data protection.

    (more…)

  • HITECH Enforcement & Penalties

    HITECH Enforcement & Penalties

    When you’re sick and at the doctor’s office, you have to reveal a lot of personal information for the physician to properly treat you. Within your file contains your demographic information, your personal medical history, mental health, tests and lab results, insurance information, and more. All of this falls under a specific category called protected health information (PHI).

    In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in order to protect patients’ PHI. Privacy and security weren’t the only topics covered in HIPAA. It also addressed health insurance prices and changes, encouraged the use of electronic health records (EHRs), and developed the groundwork for a national healthcare standard.

    HIPAA was amended — rather, bolstered — in 2009, when Congress passed the HITECH Act. It addressed many of the problems arising from HIPAA and helped bring the framework into the 21st century. It also brought with it harsher penalties for HIPAA noncompliance. To avoid these fees, healthcare providers and their business associates must understand the HITECH Act penalties and enforcement.

    (more…)

  • What Is HITECH?

    What Is HITECH?

    When asked about the Obama administration’s efforts to reform the American healthcare system, most people will think of the Patient Protection and Affordable Care Act, also known as “Obamacare.” Many forget or fail to realize that a year prior to the ACA’s creation, Congress had already passed the largest healthcare reform measure in decades in the form of the Health Information Technology for Economic and Clinical Health Act (HITECH). 

    One of the reasons why HITECH’s addition went mostly unnoticed and unremarked is that it was a subsection of President Obama’s American Recovery and Reinvestment Act of 2009. Few realized that this stimulus package introduced sweeping changes to the healthcare industry that had far-ranging impacts on the relationship between patients and providers, especially pertaining to healthcare provider treatment of private health information. 

    Do you want to know what is HITECH in healthcare and how it protects your private information? Read on to find out. 

    (more…)

  • What Are the 3 HITRUST Implementation Levels?

    What Are the 3 HITRUST Implementation Levels?

    Healthcare is an industry intertwined with our everyday lives. The young and the old alike rely on doctors to keep them healthy and usually, in that pursuit, reveal personal details to their health practitioners. This means consumers put a lot of trust in healthcare companies. 

    But with technology taking over the mundane tasks of healthcare, threat actors target health institutions for that personal information. The Health Information Trust Alliance (HITRUST) is designed to verify privacy and security compliance combat healthcare fraud. In particular, there are three different levels associated with HITRUST controls. 

    Learn about each HITRUST level and why it’s important with our comprehensive guide. 

    (more…)

  • What Are The PCI DSS Compliance Regulations for the Cannabis Industry?

    What Are The PCI DSS Compliance Regulations for the Cannabis Industry?

    The legalization of recreational and medical marijuana in many states and countries around the world has made the global marijuana market one of the fastest-growing industries. According to a recent report by the Grand View Research, Inc., the global legal marijuana market will grow to $66.3 billion by 2025.

    Cannabis is being widely used as a pharmaceutical product. It is said to be effective in treating severe medical conditions like arthritis, cancer, and Parkinson’s disease. This has contributed to the increased demand for medicinal marijuana.

    Moreover, recreational marijuana or the use of cannabis without medical justification is being legalized in many states and countries. In the United States, 11 states and the District of Columbia have legalized the recreational use of cannabis among adults. Countries like Canada, Belize, Jamaica, Argentina, and the Netherlands have also decriminalized the use of marijuana.

    All these developments point to the expansion of the cannabis industry in the years to come. Marijuana dispensaries can maximize their growth potential by complying with the Payment Card Industry Data Security Standard (PCI DSS), an information security standard for payment processing. Cashless ATM or point of sale (POS) banking is considered a viable and important platform for marijuana dispensaries to grow their sales. With POS banking, online cannabis dispensaries can accept purchases from customers who use their credit and debit cards.

    (more…)

  • What is Service Organization Control (SOC)?

    What is Service Organization Control (SOC)?

    Service Organization Control reports (SOC), in a nutshell, help companies with various aspects of their business. Essentially, these reports outsource different responsibilities within a business, like payroll, medical claims processing, document management and much, much more. Typically, they are aspects of a business that a company or “user entity” is not capable of doing as well as the service organization. It also allows the company or “user entity” to concentrate on other facets of their business. These reports come in various types based on the type of work the user entity does.

    In this article, we’ll discuss the different types of reports in detail, as well as why you might choose one Service Organization Control report over another. To best understand how it works, it’s important to make sense of the system that came before SOC. Prior to the implementation of Service Organization Control, CPAs used a system called SAS 70. 

    (more…)