Information Security Blog

ISO 27005 Risk Assessments in Healthcare

healthcare-27005 Although important, it is not often you hear about ISO 27005 in Healthcare Information Security articles. The Health Information Technology for Economic and Clinical Health Act (HITECH) authorized incentive payments through Medicare and Medicaid to clinicians and hospitals when they use EHRs privately and securely to achieve specified improvements in care delivery. The legislation ties payments specifically to the “meaningful use” of Electronic Health Records (EHR) and via the achievement of a set of meaningful use measures.

Meaningful use Core Measure 14 requires: “Conduct or review a security risk analysis in accordance with the requirements under 45 CFR 164.308(a)(1) and implement security updates as necessary and correct identified security deficiencies as part of its risk management process.”

ISO 27005 for the Healthcare Industry

Risk Management requires the adoption or development of a Risk Assessment Methodology. You can roll your own or leverage OCTAVE or NZ-AST4360. We prefer 27005:

It’s an internationally recognized standard.
It’s fully aligned with 27001 and HITRUST Security Frameworks which are the two predominant frameworks used for establishing an Information Security Management Systems (ISMS) and demonstrating compliance with key regulatory requirements in the health care space.
It supports an information and process centric approach (rather than an asset centric approach) which simplifies the process.
It’s scalable from your EMR to your full organization.

ISO 27005 Risk Assessment

Understanding information security risks and developing the right Risk Treatment Plan based on those risks is integral to optimizing your Information Security Program. The process begins with the development of a Secure Data Flow Diagram (SDFD) which details the flow of key information through the environment and the processes that act on it. The SDFD is integral to a Risk Assessment as it facilitates the identification of risks and the controls necessary to “treat” those risks. The SDFD can ultimately be used to provide visual evidence that key EHR risks are being mitigated to an acceptable level by a reasonable and appropriate security design.

If you have any questions about 27005, 27001 or HITRUST please reach out to us and we will be happy to have a conversation about it.

Is ISO 27001 Right for (Y)our Organization?

Thinking about ISO 27001 Certification? View our free On-Demand ISO 27001 Webinar

How to deal with increasing threats
How to manage multiple regulatory requirements
How to handle client requests for attestation
To validate that significant changes did not have unanticipated results

Download: Information Security Attestation Guide

A Best-Practices Guide to Information Security Attestation

Download our proven Information Security Guide to simplify the process of protecting your data, proving you’re secure and growing your business.

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

Simplify compliance monitoring/reporting
Vastly improve Incident Detection & Incident Response
Contextualize event information with other business relevant information

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.