With the next 12 months promising to bring "especially aggressive punishment" of violations under the Health Insurance Portability and Accountability Act (HIPAA), in addition to an influx of fresh audits, it's no wonder that health care organizations are thinking more and more about getting compliant.
But before you exclusively switch into check-off-the-box mode, here are five reasons why covered entities and their business associates should first be inspired to impart a deeper focus on security, instead of solely readying themselves for a compliance audit.
Breaches are costly for reasons other than non-compliance:
Ponemon Institute's annual "2014 Cost of a Data Breach Study" found that the average cost to a breached company reached $3.5 million, a 15 percent rise over 2013. The study found that hits to reputation and a loss of customer loyalty drained corporate coffers the most. Specific to health care, while the U.S. Department of Health and Human Services is pledging increased HIPAA fines, corrective action rulings have far outweighed instances of financial penalties.
You'll better understand - and protect - your data:
If you first have a complete understanding of your business' data lifecycle before trying to get compliant, you can create effective policies to control and protect the health information with which HIPAA is concerned. It may seem overwhelming at first, but a systematic approach that breaks the process down into manageable units will help. This will both reduce risk and enable you to be confident that your business is prepared for an audit for when that day comes.
Security invites compliance:
There's a saying that compliance is merely a snapshot in time. While compliance typically isn't won or lost in seconds or minutes, it certainly is difficult to maintain over time without having a proper foundation in place. Focusing instead on mitigating risks and following fundamental security practices will typically lead to an environment that will be harder pressed to lose compliance.
You'll satisfy other compliance mandates in the process:
All federal regulations and industry requirements that relate to protecting data and preventing cyber attacks are different, of course. But in many ways, they share similar guiding principles. Chances are that if you establish a strong security baseline first, compliance will follow suit - and you won't be forced to devote time and resources and toss huge sums of money at every compliance initiative, just so an auditor can give you the green light.
HIPAA is merely the ground floor:
Often compliance rules only speak to organizations implementing basic security controls. But in today's sophisticated threat landscape, where traditional controls often fail, the need for more advanced security is essential, especially in the health care industry, which faces unique security challenges. Companies must turn to technologies such as web security gateways, web application firewalls, network access control, and SIEMs - and services like penetration testing and threat intelligence - to ensure they are keeping up with skilled saboteurs.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.