Preparing for a Cyber Security Audit: Part X

EDITOR’S NOTE: Edward Roche, in association with RACmonitor, is writing a series of articles on the need for U.S. healthcare facilities to protect themselves from cybercriminals demanding ransoms for patient records. This is the tenth installment in the series.

The U.S. Department of Health and Human Services (HHS) recently defined a security rule formally known as its Security Standards for the Protection of Electronic Protected Health Information (e-PHI).

This rule sets standards for information and communications technology (ICT) in any healthcare organization. Compliance with the rule is mandatory. Enforcement powers of the government are codified at 45 C.F.R. Part 160, Subparts C, D, and E. If there is a violation, then civil money penalties (CMP) may be imposed.

One part of the rule calls for identification of and protection against “reasonably anticipated threats to the security or integrity” of e-PHI. What does “reasonably anticipated” mean? In particular, does it refer only to the psychological side of “anticipation,” or does it translate deeper into organizational actions?

Here, we will argue that “reasonably anticipate” means not only the purely psychological side, but it also implies that your organization must take specific tangible steps to anticipate a ransomware or other form of cyberattack, and effectively deal with it should it occur.

Preparing for a Cyber Audit

In previous articles in this series, we have reviewed the high-level steps of a cyber audit. First comes a “desk audit,” in which the healthcare provider is given a number of questions that must be answered in writing within 10 business days. Second, it is possible for certain providers to be chosen for more in-depth, on-site audits that can last for 3-5 days. Third, if necessary, the organization can be subjected to even more detailed audits that may lead to penalties.

Section §160.410 of this rule sets forth the “affirmative defenses” that might be used by the healthcare provider. For example, the provider might attempt to show that it demonstrated “reasonable diligence” in combatting hacking. What follow are a few of the steps that might be taken to demonstrate “reasonable diligence” in protecting against malware attacks.

Tabletop Exercise 

The tabletop exercise is a simulation of how your organization would respond to a cyberattack. The U.S. Department of Homeland Security offers generous documentation on how to conduct these exercises. In addition, there are a number of commercial security consulting organizations that can help you conduct this type of drill – for a fee.

The purpose of the tabletop is twofold: First, it is designed to raise awareness of the issues that must be dealt with, and to clarify who is responsible for handling them; second, it is designed to find glitches or flaws in how the organization responds. These glitches are particularly important to understand because only once they are identified, they can be fixed.

In many cases, a tabletop exercise is the first time an organization is forced to think through how it might respond to a cyberattack, and who is responsible for doing what.

Document Everything

The entire tabletop exercise and all of the details must be scrupulously documented. Of particular concern is documentation of any issues found in the organizational response, and exactly what steps were taken to rectify the problem(s) and mitigate the potential for serious damage.

For even the most hard-headed auditor, it is music to the ears to see well-organized documentation illustrating how your organization has been systematic in anticipation of a threat and responsible in the formulation of an effective response.

Strictly Enforce Security Protocols

The auditors will be looking not only for security protocols that are on the books – everyone has those – but also for evidence that the protocols are being used. Because of this, it is necessary to maintain a log of every single breach of a security protocol, including the date, time, systems affected, persons involved, how it was discovered, and what actions were taken to make sure it does not happen again.

It goes without saying, however, that in order to enforce a security protocol, an organization must have one in the first place, and everyone must understand how it applies to them personally.

Book of Security Protocols

Your organization should be able to present documentation of each security protocol. This includes how to log on to a system, how to log off, how to choose passwords, how to keep passwords safe, how to respond to phishing emails, how to handle email attachments, and so on.

Not only is it necessary to have complete documentation of your security protocols, but it also is useful to have documentation verifying that each employee in the organization is fully aware of all protocols that they might need in the event of a security breach.

Standing Patient Notification Protocol

In the case of any substantial security breach, your organization will be required to notify patients that their records have been compromised. In order to prepare for this, your organization must have documentation of drafts of the notification letter, with specification of the principles that will govern exactly when (and to whom) notifications will be sent.

Documentation of Security Maintenance 

Each modification or maintenance made to your information system with an aim of improving cyber security must be completely documented. In particular, there must be a clean record showing the date, time, and other report of any security patch that is applied to your information system.

After all, it is difficult to conclude that an organization is not taking “reasonable steps” towards effective cyber security when the documentation shows otherwise.

In some cases, an information systems organization may resist the adding of an additional “bureaucratic” step of recording their every move, but be assured, it is necessary, because it proves due diligence on the part of your organization.

Preparing for a cyber audit involves taking tangible steps to improve the security of your information system. But being secure is not adequate, for the purposes of an audit.

Instead, it is necessary to be able to show documentation of everything you have done. In this way, you can feed the audit monster before it bites off your hand.

In future issues of this series, we will go into greater detail about cyber audits.

Facebook
Twitter
LinkedIn

Edward M. Roche, PhD, JD

Edward Roche is the director of scientific intelligence for Barraclough NY, LLC. Mr. Roche is also a member of the California Bar. Prior to his career in health law, he served as the chief research officer of the Gartner Group, a leading ICT advisory firm. He was chief scientist of the Concours Group, both leading IT consulting and research organizations. Mr. Roche is a member of the RACmonitor editorial board as an investigative reporter and is a popular panelist on Monitor Mondays.

Related Stories

The Enigma of Sepsis

The Enigma of Sepsis

Sepsis is one of the most (if not the most) challenging concepts in the International Classification of Diseases, 10th Edition, Clinical Modification (ICD-10-CM), the Health Insurance Portability and Accountability

Read More

Leave a Reply

Please log in to your account to comment on this article.

Featured Webcasts

2026 IPPS Masterclass 3: Master MS-DRG Shifts and NTAPs

2026 IPPS Masterclass Day 3: MS-DRG Shifts and NTAPs

This third session in our 2026 IPPS Masterclass will feature a review of FY26 changes to the MS-DRG methodology and new technology add-on payments (NTAPs), presented by nationally recognized ICD-10 coding expert Christine Geiger, MA, RHIA, CCS, CRC, with bonus insights and analysis from Dr. James Kennedy.

August 14, 2025
2026 IPPS Masterclass Day 2: Master ICD-10-PCS Changes

2026 IPPS Masterclass Day 2: Master ICD-10-PCS Changes

This second session in our 2026 IPPS Masterclass will feature a review the FY26 changes to ICD-10-PCS codes. This information will be presented by nationally recognized ICD-10 coding expert Christine Geiger, MA, RHIA, CCS, CRC, with bonus insights and analysis from Dr. James Kennedy.

August 13, 2025
2026 IPPS Masterclass 1: Master ICD-10-CM Changes

2026 IPPS Masterclass Day 1: Master ICD-10-CM Changes

This first session in our 2026 IPPS Masterclass will feature an in-depth explanation of FY26 changes to ICD-10-CM codes and guidelines, CCs/MCCs, and revisions to the MCE, presented by presented by nationally recognized ICD-10 coding expert Christine Geiger, MA, RHIA, CCS, CRC, with bonus insights and analysis from Dr. James Kennedy.

August 12, 2025

Trending News

Featured Webcasts

The Two-Midnight Rule: New Challenges, Proven Strategies

The Two-Midnight Rule: New Challenges, Proven Strategies

RACmonitor is proud to welcome back Dr. Ronald Hirsch, one of his most requested webcasts. In this highly anticipated session, Dr. Hirsch will break down the complex Two Midnight Rule Medicare regulations, translating them into clear, actionable guidance. He’ll walk you through the basics of the rule, offer expert interpretation, and apply the rule to real-world clinical scenarios—so you leave with greater clarity, confidence, and the tools to ensure compliance.

June 19, 2025
Open Door Forum Webcast Series

Open Door Forum Webcast Series

Bring your questions and join the conversation during this open forum series, live every Wednesday at 10 a.m. EST from June 11–July 30. Hosted by Chuck Buck, these fast-paced 30-minute sessions connect you directly with top healthcare experts tackling today’s most urgent compliance and policy issues.

June 11, 2025
Open Door Forum: The Changing Face of Addiction: Coding, Compliance & Care

Open Door Forum: The Changing Face of Addiction: Coding, Compliance & Care

Substance abuse is everywhere. It’s a complicated diagnosis with wide-ranging implications well beyond acute care. The face of addiction continues to change so it’s important to remember not just the addict but the spectrum of extended victims and the other social determinants and legal ramifications. Join John K. Hall, MD, JD, MBA, FCLM, FRCPC, for a critical Q&A on navigating substance abuse in 2025.  Register today and be a part of the conversation!

July 16, 2025

Trending News

Happy National Doctor’s Day! Learn how to get a complimentary webcast on ‘Decoding Social Admissions’ as a token of our heartfelt appreciation! Click here to learn more →

CYBER WEEK IS HERE! Don’t miss your chance to get 20% off now until Dec. 2 with code CYBER24