What’s the Difference Between HITRUST and NIST?

Are you looking for a way to ensure that your organization is maintaining HIPAA compliance? If so, NIST and HITRUST are security frameworks that can help you uphold compliance, prevent breaches, and avoid non compliance penalties. But many companies get caught up in the debate of HITRUST vs NIST.

Do you have to stick to one or the other? Are they compatible together?

In truth, it’s not really an “either, or” proposition. HITRUST is simply an optimized and augmented version of NIST. Here’s how.

 

What is NIST? 

The National Institutes of Standards and Technology (NIST) is a non-regulatory governmental agency that develops policies, standards, and guidance with regards to cybersecurity. The NIST Framework is a computer and IOT security guidance created to help businesses—both private organizations and federal agencies—gauge and strengthen their cybersecurity perimeter. It’s built around three pillars:

1. Prevention of cyber attacks
2. Detection of cyber attacks
3. Reaction to and mitigation of cyber attacks

NIST creates a set of standards and security controls for ensuring and maintaining the security of critical information systems. They’re endorsed by a wide range of private companies and federal agencies because they have been so effective.

A large reason for their efficacy is attributable to the fact that the standards are an amalgamation of various cybersecurity best practices and frameworks. Over the years, they’ve been meticulously updated and adjusted in response to the ever changing threat landscape.

By complying with NIST, you can ensure compliance with other regulations such as the Health Insurance Portability and Accountability ACT (HIPAA) or Federal Information and Security Management Act (FISMA).

 

Assess your HITRUST compliance

 

What is NIST Cybersecurity Framework? 

According to the NIST, “The Framework not only helps organizations understand their cybersecurity risks (threats, vulnerabilities and impacts), but how to reduce these risks with customized measures. The Framework also helps them respond to and recover from cybersecurity incidents, prompting them to analyze root causes and consider how they can make improvements.”

The NIST framework is built around five ideals: identify, protect, detect, respond, recover. To accomplish those things and maintain compliance with HIPAA and FISMA, there are six overarching organizational steps the NIST recommends:

1. Risk categorization – Every one of your organization’s information systems need to be categorized according to risk level and given proper security protections. Sensitive information (whether business or customer) requires the highest level of security.  You must identify all equipment, software, and data you use and then take steps to protect them from an attack and be able to mitigate the severity of an attack should it occur.
2. Set minimum baseline controls – Organizations need to meet minimum security requirements, but don’t have to follow them all. The relevant controls should be customized to their organization and system.
3. Document the controls – All of the information and systems used need to be identified, including the interfaces connecting systems and networks. After, the baseline controls can be used to protect systems.
4. Refine controls via risk assessment – This methodology helps verify that security controls are effective and to see if other controls are required.
5. Conduct annual security reviews – To receive a security certification, regular audits must be conducted on an annual basis.
6. Monitor the security controls continuously – By continually monitoring systems and controls, you can help your organization respond quickly and effectively to incidents or data breaches. This includes status reporting, configuration management, and adding new security controls if necessary.

What is HITRUST?

After it was first published in 2009, the HITRUST control security framework (CSF) quickly became the standard for information security in the healthcare industry. It was based on the International Organization for Standardization (ISO) 27001, but then took those steps further.

In many ways, it’s a complement to the NIST framework, while still making some important changes. Namely, it simplifies the implementation and streamlines compliance actions. According to the HITRUST Alliance:

[HITRUST] exists to ensure that information security becomes a core pillar of, rather than an obstacle to, the board adoption of health information systems and exchanges by addressing specific challenges such as concern over current breaches, numerous and sometimes inconsistent requirements and standards, compliance issues, and the growing risk and liability associated with information security in the healthcare industry.

HITRUST takes the baseline security controls found in NIST and then adds various controls and best practices from the following standards and frameworks:

•  Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health Act (HITECH)
• ISO 27799
• NIST RMF
• Control Objectives for Information and related Technology (COBIT)
• Payment Card Industry (PCI) Data Security Standard

So, by adopting HITRUST, you’re effectively adopting NIST, while ensuring compliance with HIPAA.

What is the HITRUST CSF? 

The HITRUST CSF certification process involves four steps. Your business must successfully apply them before an official assessment can occur. It looks like:

1. CSF Self-Assessment
2. CSF Validated Assessment
3. CSF HITRUST Alliance Certification
4. Repeat Annually

To achieve the framework certification, you must achieve the 135 CSF controls, which are divided into 19 different security domains:

1. Access Control – Access to information systems need to be managed, authorized, and protected.
2. Audit Logging & Monitoring – Sets controls on audit logging and monitoring.
3. Business Continuity & Disaster Recovery – Creates contingencies for business continuity and disaster recovery, with planning, implementation, and testing.
4. Configuration Management – Ensures configuration management of environments used for development and testing.
5. Data Protection & Privacy – Addresses the organization’s compliance and privacy program as well as their related controls.
6. Education, Training & Awareness – Enforced education and training for security personnel and standard users.
7. Endpoint Protection – Installs anti viruses, firewalls, patches, and updates to all information systems in order to protect sensitive information.
8. Incident Management – Informs response to incident monitoring, detection, and breaches.
9. Information Protection Program – Requires that processes are set to ensure the confidentiality, integrity, and availability of sensitive data.
10. Mobile Device Security – Sets requirements for mobile devices, including smartphones, tablets, and laptops.
11. Network Protection – Creates network-based application-level fireworks and intrusion detection systems for internal network security.
12. Password Management – Covers all issues surrounding password security and two-factor authentication.
13. Physical & Environmental Security – Instills requirements for physical and environmental security for data centers.
14. Portable Media Security – Controls mobile storage security.
15. Risk Management – Sets up risk assessment, risk analysis, and other controls related to risk management.
16. Third-Party Security – Helps manage risks related to third parties, including business associates and vendors.
17. Transmission Protection – Protects web and network connections.
18. Vulnerability Management – Includes vulnerability scanning and patching, and penetration detection systems.
19. Wireless Protection – Ensures that both corporate and guest wireless networks and devices that connect to other networks.

This framework enables the HIPAA mandate and HITECH regulations are incorporated, ensuring that you fortify your security measures while avoiding the hefty penalties associated.

 

HITRUST vs NIST

When it comes to HITRUST vs NIST, although the NIST CSF is useful, HITRUST is the superior framework.

Why?

Because it incorporates the best practices from NIST, HIPAA, HITECH, and ISO, as well as many other regulations into its overall framework. Especially when it comes to healthcare organizations, HITRUST accomplishes the following:

• Ensures HIPAA compliance
• Grants greater security to sensitive patient information
• Optimizes and streamlines security operations
• Sets better data regulation on security operations

So, how do you ensure that your business is HITRUST certified?

This is where RSI Security comes in. If you need a HITRUST CSF Certification and Assessment, we’re a certified HITRUST CSF Assessor and full service security service provider, we’ve decades of experience providing data security compliance, information security program implementation, and testing services.

Start taking the steps you need to ensure HITRUST compliance and protect your organization.

 

 

---

Download Our HITRUST Compliance Checklist

Assess where your organization currently stands with being HITRUST compliant by completing this checklist. Upon filling out this brief form you will receive the checklist via email.