HITRUST - 2018 and Beyond

Today, looming data breach threats are top of mind for any organization that holds customer data in the cloud. While most businesses aim to be prepared in the event of a data breach, many end up spending a disproportionate amount of time and resources responding to incidents that have already occurred, rather than proactively safeguarding for future attacks

In fact, the lack of proactive security planning and investment can often end up costing a company more money in the long run. IBM’s 2018 “Cost of a Data Breach” study reports the global average cost of a single data breach is up 6.4 percent from 2017 to $3.86 million. The average cost for each lost or stolen record containing sensitive and confidential information also rose by 4.8 percent to $148. Massive clean-up costs are not the only thing at stake for businesses — experiencing a data breach often results in the significant loss of customers as well.

Businesses today are seeking solutions that provide comprehensive data protection to avoid a data breach altogether. Looking specifically at the healthcare industry, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) was created to better protect patient data; however, with the lack of an industry-standard cybersecurity framework, it isn’t accomplishing its intended goal.

This leaves organizations wondering how much they should invest in cybersecurity to protect internal and external data. Every organization takes a different approach, confusing customers and internal agents alike. The current ambiguous systems don’t work, leaving a strong need for a standardized security framework that ensures confidentiality of sensitive consumer data.

 HITRUST CSF Certification: A Comprehensive Approach to Securing Data

 The HITRUST (Health Information Trust) Alliance offers the HITRUST CSF (Common Security Framework), which provides organizations with a comprehensive approach to regulatory compliance and risk management, normalizing over 20 of the most common security and privacy standards, including PCI, ISO2700, HIPAA, NIST and COBIT. Unlike HIPAA regulations, which describe essential practices without providing certification for protecting sensitive data, the HITRUST CSF certification classifies a vendor as compliant with the strictest and most prevalent security standards.

HITRUST certification provides organizations with an efficient, robust framework for both logical and physical security requirements. Although HIPAA remains a valuable tool in protecting sensitive data (especially for healthcare organizations), the HITRUST CSF certification goes above and beyond the bare minimum — thereby providing both organizations and their consumers peace of mind that confidential data is fully secure and protected from cyber-attacks. Most importantly, because the HITRUST CSF designation integrates many data protection frameworks, a consistent and universal protection standard is created.

Organizations that select HITRUST CSF-certified IT providers and partners can take advantage of best-in-class security, policies, procedures and technology, while offloading the demanding responsibilities and high costs of becoming certified. HITRUST CSF essentially provides both covered entities and business associates with a universal, industry-designed cybersecurity framework. HITRUST-certified IT providers deliver a much-needed peace of mind: valuable reassurance when handling sensitive data susceptible to data breaches.

 The Future of Safeguarding Sensitive Data

Digital transformation shows no signs of stopping or even slowing down, and therefore a solid framework for security to protect against cyberattacks is critical for the years ahead. The importance of security for healthcare cloud offerings is only growing, and software/IT vendors will need to shift to meet these expanding requirements.

As of today, Revation Systems is the only authorized cloud contact center for one of the top three healthcare providers in the world because they adhere to HITRUST CSF standards.

Though HITRUST’s inception was in the healthcare industry, the future of the security framework will likely expand to other industries. In addition to complying with HIPAA, healthcare organizations have the need to be Payment Card Industry (PCI) compliant. The future of the HITRUST certification model could likely include an overarching framework to include PCI, similar to how the certification already includes compliance with other regulations like NIST, ISO 27001 and COBIT — making the HITRUST CSF certification of interest to the financial industry. As nearly every industry today has a need to protect customer data, cross-industry adoption of HITRUST is certain to occur in the near future.