NIST 800-66r2 is evolving HIPAA incident response guidelines – here’s what you need to know

By Shawn Hays, Senior Product Supervisor – Safety, Compliance, and Id, at Microsoft

When the Biden administration launched its Nationwide Cybersecurity Technique, it was the newest sign that the federal authorities plans to extend its give attention to information safety. NIST 800-66r2 is one other outstanding sign for healthcare organizations specifically.

NIST 800-66r2 offers up to date implementation steering for HIPAA-regulated entities to make use of as they assess and handle digital protected well being info (ePHI) dangers. When mixed with the altering tides of shopper privateness, rising rules just like the Nationwide Cybersecurity Technique and NIST 800-66r2 underscore how essential it’s for healthcare organizations to guard delicate affected person information proactively.

Microsoft has damaged down the proposed revisions to NIST 800-66r2 right into a three-part collection to assist healthcare organizations perceive what is required to attain compliance. This text covers half two of the collection, which is targeted on incident response. For much more perception into the implementation steering, learn the first article in the series that addresses identification and entry administration.

Incident response is changing into extra complete

Concerning implementation steering round incident response, NIST 800-66r2 makes it some extent to state twice that HIPAA-regulated entities should “be sure that the incident response program covers all elements of the group during which ePHI is created, saved, processed, or transmitted.”

This has been – and continues to be – a giant ask for healthcare organizations, because the rising adoption of telehealth and associated virtual-care applied sciences has drastically elevated the variety of areas the place ePHI is created, saved, processed and transmitted. Not can healthcare organizations restrict their efforts to on-premises repositories and bodily recordsdata. As a substitute, they need to broaden their scope to incorporate OT and IoT units, hybrid cloud and multicloud networks, third-party purposes and extra. As well as, the menace vectors created by digital healthcare broaden the scope of “all elements,” and telehealth evokes extra HIPAA compliance implications.

This concern isn’t distinctive to the healthcare sector, both. The rising adoption of hybrid-cloud and multicloud options has created a posh safety panorama for quite a few industries. In accordance with Gartner, 78% of CISOs have 16 or extra instruments of their cybersecurity vendor portfolio, whereas 12% have 46 or extra. This creates an expanded assault floor that may be troublesome for safety groups to watch precisely, with important safety alerts typically getting misplaced within the shuffle. The Orca Safety 2022 Cloud Safety Alert Fatigue Report discovered that as many as 55% of IT professionals say that their crew missed important alerts up to now attributable to ineffective advice prioritization – typically on a weekly, and even each day, foundation.

This creates a possibility for cybercriminals. Cybercrime now prices greater than USD 6.9 billion, in response to IC3, and Microsoft alone tracks a rising record of 35 ransomware households and greater than 250 distinctive nation-states, cybercriminals and different menace actors. Taking a look at ransomware particularly, the healthcare sector accounted for 20% of all of Microsoft’s ransomware incident and restoration engagements in 2022. These figures level to an pressing want for healthcare organizations to develop complete incident response plans.

NIST 800-66r2 breaks incident response down into 4 key elements. In accordance with the steering, organizations ought to:

1. Decide the targets of incident response
2. Develop and deploy an incident response crew or different cheap and applicable response mechanisms
3. Develop and implement insurance policies and procedures to reply to and report safety incidents
4. Incorporate post-incident evaluation into updates and revisions

So, what instruments ought to healthcare organizations be taking a look at to be able to align with NIST 800-66r2?

AI can lighten the safety load

Cybersecurity resolution suppliers have made monumental advances lately. A major issue on this progress is the rising use of synthetic intelligence (AI). With many organizations dealing with a scarcity of assets and a important cybersecurity expertise hole, AI may help alleviate the burden on safety groups whereas enhancing cyber protections total. The secret is to search for safety options that may work holistically throughout the group’s total know-how stack.

As a result of NIST 800-66r2 necessitates that organizations create an incident response plan for all areas during which ePHI is created, saved, processed or transmitted, step one is to establish all of these locations. In spite of everything, healthcare organizations can’t defend one thing in the event that they don’t know that it exists. Unified cloud-native utility safety platforms (CNAPPs) may help.

CNAPPs safe and defend cloud-native purposes in growth and manufacturing by integrating beforehand siloed safety and compliance capabilities right into a single, easy-to-reference platform. This may help scale back the danger of missed safety alerts or gaps in safety by bringing unifying all safety intelligence below a single umbrella. Another choice is to search for a cloud infrastructure entitlement administration (CIEM) resolution that may handle permissions dangers for any identification or useful resource throughout the infrastructure. CIEM options are particularly helpful in understanding what assets are being accessed and guaranteeing that the suitable identities have the suitable permissions to satisfy their safety ranges and wishes.

Cyber threats are extra prevalent than ever, notably within the healthcare sector. Nonetheless, with cybersecurity having made monumental advances lately, AI can go a great distance in the direction of assuaging the burden positioned on safety groups whereas additionally enhancing protections for affected person information. Laws like NIST 800-66r2 function an important place to begin that healthcare organizations can reference to make sure they’re in compliance.