Healthcare Law Blog

New Guidance Maps HIPAA Security Rule to NIST Cybersecurity Framework to Help Providers Manage Cybersecurity Risk

In a world of looming data breaches and significant penalties for the release of protected health information, the complexities of cybersecurity and compliance with the HIPAA Security Rule can be incredibly daunting. In 2014, in response to the growing threat of data breaches, the National Institute of Standards and Technology (“NIST”) released the Framework for Improving Critical Infrastructure Cybersecurity (“the Framework”) as a means to standardize best practices in cybersecurity across organizations. To assist providers with implementing the Framework while remaining in compliance with the HIPAA Security Rule, the Department of Health and Humans Services Office for Civil Rights (“OCR”) published a HIPAA Security Rule Crosswalk (“the Crosswalk”) to tie the standards together and help strengthen cybersecurity preparedness.

The Framework is a set of voluntary guidelines based on existing technical standards and best practices that assists organizations with hardening their IT infrastructure. It consists of simple and overarching components that then break down along paths into multiple levels of subcomponents that provide organizations of every size and at any level of cybersecurity strength with tools to assess and fortify their systems. The Framework acts as a one-stop resource that provides assessment of current strength along with a roadmap and tools to achieve higher levels of security as well as recover from breaches.

Rather than leaving healthcare IT professionals at the mercy of separate standards (the Framework, which is voluntary, and the HIPAA Security Rule, which is not), OCR partnered with NIST and the Office of the National Coordinator for Health IT (“ONC”) to create the Crosswalk and help providers understand the overlap between the two standards. Specifically, the Crosswalk “maps each administrative, physical and technical safeguard standard and implementation specification in the HIPAA Security Rule to a relevant NIST Cybersecurity Framework Subcategory.” The expected result is that the new guidance will aid both compliance with the Security Rule and overall cybersecurity of healthcare organizations.

This guidance should not be taken lightly by healthcare IT professionals. The Framework is an attempt to create simple and easily determined standards for all, and the Crosswalk now brings it home for healthcare organizations, simplifying Security Rule compliance immeasurably. The Crosswalk and the Framework are powerful tools in the protection of electronic protected health information, and healthcare organizations would do well to understand the confluence of these guidelines. For more information on cybersecurity and compliance with the HIPAA Security Rule, contact the attorneys at McBrayer. 

Christopher J. Shaughnessy is a member at McBrayer.  Mr. Shaughnessy concentrates his practice area in health care law and is located in the firm’s Lexington office.  He can be reached at cshaughnessy@mcbrayerfirm.com or at
(859) 231-8780, ext. 1251. 

Services may be performed by others.

This article does not constitute legal advice.

.