Understanding the NIST Cybersecurity Framework to HIPAA Crosswalk

With the increase in threats targeting sensitive protected health information (PHI), organizations within and adjacent to healthcare must step up their data security controls. One way to do so is with the help of the guidelines listed in the NIST cybersecurity framework, which can be mapped to HIPAA’s data privacy safeguards. Read on to learn about this NIST to HIPAA crosswalk.

Guide to the NIST Cybersecurity Framework to HIPAA Crosswalk

The security standards in the NIST cybersecurity framework are widely implemented across security programs, regardless of industry—and can help improve the effectiveness of HIPAA safeguards. Our guide to the NIST cybersecurity framework to HIPAA crosswalk will cover:

The importance of mapping the NIST security framework controls onto HIPAA ones
A breakdown of the NIST CSF categories outlined in the crosswalk

Whether you are new to the NIST cybersecurity framework to HIPAA crosswalk or looking to optimize your cyberdefenses, working with a HIPAA compliance partner will streamline the process and help you remain compliant year-round.

NIST CSF to HIPAA Crosswalk – Streamlined Risk Management

As a robust risk management framework, NIST’s Framework for Improving Critical Infrastructure Cybersecurity—also called the NIST cybersecurity framework or CSF—provides standardized controls for managing cybersecurity risks, regardless of industry, organization size, or type of security infrastructure. However, optimizing risk management and tailoring security controls to the specific needs of each organization and industry is critical to mitigating cybersecurity risks.

In high-risk industries like healthcare, there are gaps in mapping the controls recommended by the NIST cybersecurity framework to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) framework. To fully achieve the effectiveness of a healthcare data security program, organizations should tap into and implement the controls listed in both frameworks.

Organizations whose security program is fully compliant with HIPAA can leverage the NIST CSF to improve overall risk management, for PHI and other data that falls outside HIPAA’s scope.

Request a Free Consultation

The HIPAA Security Rule

Although HIPAA contains four primary Rules, the controls listed in the NIST cybersecurity framework to HIPAA crosswalk are adopted from the Security Rule. Under the HIPAA Security Rule, covered entities and business associates must safeguard PHI with three types of controls:

Administrative safeguards
Physical safeguards
Technical safeguards

However, compliance with all the HIPAA Rules is critical to keeping PHI safe from various threats and vulnerabilities throughout the lifecycle of a security program. Mapping the controls outlined in the HIPAA Security Rule to those in the NIST cybersecurity framework will help enhance your security posture in the short and long term.

Laptop

Breakdown of the NIST CSF Categories

The NIST CSF categories listed in the NIST cybersecurity framework to HIPAA crosswalk are spread across five functions:

Identify (ID)
Protect (PR)
Detect (DE)
Respond (RS)
Recover (RC)

Healthcare and healthcare-adjacent organizations can leverage these risk management controls to identify gaps within their security programs. However, it is critical for these organizations to view the crosswalk simply as a reference, and not the sole baseline for regulatory compliance.

So, let’s review the various NIST CSF categories.

ID.AM – Asset Management

To achieve business purposes and manage security risks, HIPAA Security Rule-compliant organizations must:

Conduct inventories of physical devices and software applications
Map out data flows for internal and external communications
Catalogue external information systems
Prioritize asset risk management based on asset type, business value, or operational criticality
Designate internal and external roles and responsibilities for cybersecurity management

Proper management of assets will help identify critical risks early on before they can develop into full-blown attacks and compromise data integrity.

ID.BE – Business Environment

When operating in any business environment, healthcare organizations and their partners must develop roles, responsibilities, and activities that effectively manage risk.

To meet or surpass the minimum healthcare risk management standards, organizations must:

Identify and communicate their roles in the supply chain
Establish and communicate mission priorities and objectives
Outline critical dependencies necessary for service delivery
Meet the resilience requirements to deliver essential services

Streamlining risk management in the healthcare business environment will help mitigate threats to PHI at rest and in transit across covered entities and their business associates.

ID.GV – Governance

When it comes to regulatory, legal, risk, and environmental governance, the NIST cybersecurity framework recommends that organizations implement:

An organization-specific information security policy
Processes to designate security roles and responsibilities both internally and externally
Procedures to oversee regulatory compliance
Risk management for the cybersecurity risks identified in a security assessment

With the help of an up-to-date governance structure, your organization will effectively manage security risks to PHI and keep it safe in the short and long term.

ID.RA – Risk Assessment

Based on the NIST cybersecurity framework to HIPAA crosswalk, you can conduct risk assessments by:

Identifying and documenting threats and vulnerabilities to assets
Leveraging open-source threat intelligence to learn about threats
Evaluating the potential impact and likelihood of threats to business operations
Analyzing the outcomes of risk assessments
Developing and prioritizing risk responses

Risk assessments will help safeguard the privacy and integrity of PHI and keep assets well-protected from internal and external threats.

ID.RM – Risk Management Strategy

Per the NIST cybersecurity framework to HIPAA crosswalk, deploying an effective risk management strategy requires:

Developing processes for risk management, ensuring all the participant stakeholders agree and support their establishment and management
Identifying and clearly defining your organization’s risk tolerance
Basing your risk tolerance on an analysis of risks to your critical infrastructure

A risk management strategy is essential for conducting meaningful risk assessments and ensuring robust management of operational risks.

incident

PR.AC – Access Control

Access to sensitive PHI environments must be restricted by implementing measures like:

Managing credentials and user identities for all authorized users and devices
Protecting assets from unauthorized physical access
Establishing processes to manage remote access to PHI
Instituting access management via principles of least privilege or separation of duties
Safeguarding the integrity of networks that transmit PHI

Access control vulnerabilities are some of the most common causes of PHI breaches and must be minimized when complying with the HIPAA Security Rule.

PR.AT – Awareness and Training

The NIST cybersecurity framework to HIPAA crosswalk requires all internal and external personnel with access to PHI to receive security awareness training.

Security roles and responsibilities must be clearly defined for:

Users with privileged access
Third-party stakeholders (e.g., suppliers, partners)
Staff in senior leadership positions
Physical and IT security personnel

To safeguard PHI environments, you should schedule routine security awareness training to keep staff cyber vigilant year-round.

PR.DS – Data Security

Data security controls revolve around safeguarding the privacy, integrity, and confidentiality of PHI and include:

Protecting data at rest and in transit
Managing assets to ensure prompt removal, transfer, or disposal
Keeping assets fully functional and available to end-users
Implementing data leak safeguards
Verifying the integrity of software and data
Developing test environments separately from production ones

Implementing data security controls will reduce the gaps available for cybercriminals to exploit during a cyberattack aimed at compromising the integrity of PHI.

PR.IP – Information Protection Processes and Procedures

Establishing organization-specific security policies helps align high-level strategic guidelines with controls such as:

Creating a baseline configuration of all operational IT systems
Implementing a System Development Life Cycle (SDLC) to manage systems
Establishing configuration change control management
Managing regular backups of data and system files
Ensuring PHI is destroyed per policy guidelines
Optimizing incident response and recovery plans
Streamlining processes for vulnerability management

With the help of a security policy, you will achieve your desired cybersecurity outcomes and keep PHI safe, even as your organization evolves.

PR.MA – Maintenance

Based on the security policies established in compliance with HIPAA and the NIST CSF controls, you can conduct timely repairs of assets using industry-standard tools.

Whether you use sophisticated industrial-level assets to handle PHI or less sophisticated ones, routine maintenance will help control access to sensitive PHI environments—mitigating unauthorized attempts to access these environments.

agreement

PR.PT – Protective Technology

If you leverage technical solutions to safeguard the privacy and integrity of PHI, a HIPAA-compliant security policy can help:

Keep records of security audits and logs installed on assets
Protect the use of and access to removable media containing PHI
Control access to systems via least privilege principles
Safeguard the networks used to communicate and transmit PHI

As security threats advance in today’s IT landscape, implementing industry-standard technology to safeguard PHI will keep you ahead of cybercriminal attempts to steal PHI from your systems.

DE.AE – Anomalies and Events

The NIST cybersecurity framework to HIPAA crosswalk also requires healthcare organizations to identify anomalous security events by:

Establishing and managing network operations and data flow baselines
Analyzing events detected as security threats to understand their nature
Collecting and aggregating event data from various sources
Evaluating the impact of threat events

Timely detection of anomalous security events will help mitigate threats early on before they become full-blown attacks.

DE.CM – Continuous Monitoring

Security monitoring should be a continuous process in any cybersecurity program.

Per the NIST cybersecurity framework to HIPAA crosswalk, organizations within and beyond healthcare are expected to:

Identify potential security vulnerabilities by monitoring:
- Networks that transmit PHI
- Physical environments containing PHI
- Personnel activity, especially those with access to PHI environments
- Unauthorized connections to devices or software
Conduct vulnerability scans of sensitive data environments

Continuous security monitoring is vital to evaluating your security posture as you handle PHI in your day-to-day operations.

DE.DP – Detection Processes

All processes that detect anomalous events must be maintained and tested to ensure robust functionality. To this end, healthcare organizations are required to:

Define roles and responsibilities for all stakeholders involved in threat detection
Ensure regulatory compliance for all detection activities
Test the tools used for threat identification processes
Improve threat detection processes

Implementing the threat and vulnerability detection processes recommended by the NIST CSF framework mapped to HIPAA will streamline overall threat and vulnerability management.

RS.RP – Response Planning

When planning responses to security incidents, they must be prompt to mitigate any compromise to data integrity. Response plans must therefore be implemented during security events or right after they happen to prevent subsequent damage to assets and breaches of PHI.

RS.CO – Response Communications

To secure communication, the NIST cybersecurity framework to HIPAA crosswalk requires:

Personnel to be aware of their security roles and responsibilities during an incident
Proper event reporting mechanisms based on pre-established criteria
Information sharing based on incident response plans

Effective communication between stakeholders is critical to managing security events and mitigating PHI from further compromise.

RS.AN – Analysis

When analyzing security incidents, the NIST CSF framework recommends:

Investigating alerts from detection systems
Understanding the impact of incidents on your assets
Conducting forensics following incidents
Categorizing incidents according to response plans

Proper analysis of security incidents is critical to supporting recovery activities and ensuring a robust response to the incidents.

RS.MI – Mitigation

Should a security event occur, it must be stopped from expanding to affect other assets and causing damage to them. The NIST cybersecurity framework to HIPAA crosswalk requires organizations in and adjacent to healthcare to contain and mitigate incidents as they unfold.

Any newly identified vulnerabilities must be documented as part of risk management efforts.

RS.IM – Improvements

As your organization learns from past security events, it must streamline its defenses in anticipation of future ones. Response plans must incorporate the lessons learned from previous incidents. Likewise, you must optimize security strategies and keep them up-to-date with the current demands of the healthcare industry’s IT landscape.

RC.RP – Recovery Planning

Recovery from security incidents boils down to ensuring that assets are restored to their original state as promptly as possible with the help of a recovery plan. For incident recovery to be effective, it must align with your organization’s security policy.

RC.IM – Improvements

Similarly, realizing improvements to incident recovery processes requires taking the learnings from previous security events and applying them to existing recovery plans. This process also requires updating recovery strategies to meet the demands of the current security environment.

RC.CO – Recovery Communications

Following a security incident, you will likely need to manage public relations and repair your reputation to maintain business relations. To streamline these communications, you will have to communicate with internal and external stakeholders, including management teams, to update them on your current recovery strategy. The best way to navigate the NIST cybersecurity framework to HIPAA crosswalk is to work with a trusted HIPAA compliance and security advisor.

Optimize Your Healthcare Data Safeguards

With the help of the NIST cybersecurity framework to HIPAA crosswalk, you will streamline the implementation of security controls for any PHI you handle. More importantly, partnering with an experienced HIPAA compliance advisor will guide you at each step of the process, minimizing gaps and pain points along the way. Contact RSI Security today to learn more and get started!