Maintaining HIPAA compliance can prove time-consuming and resource-intensive for medical groups. Yet many organizations are spending too much time proving they’re compliant and not enough time improving their security, according to James Winebrenner, CEO of Elisity.
In an extensive HIPAA Q&A,
"Aim for measurable outcomes, risk management," appearing in the Oct. 26 issue of
Part B News, Winebrenner dives into current regulatory alignment, compliance pressures and supply chain risk (
subscription required).
In a continuation of the Q&A below, Winebrenner addresses areas that take first focus based on current federaul regulations.
Question: If organizations could implement three cybersecurity priorities immediately based on the federal strategy, what should they focus on first?
Winebrenner: First, gain complete visibility into every device on your network. You can’t protect what you can’t see, and most health systems significantly undercount their connected device inventory. Discovery that covers managed and unmanaged IT, internet of things (IoT), internet of medical things and operational technology assets is the foundation everything else depends on.
Second, implement microsegmentation to contain lateral movement. Segment medical devices from workstations, workstations from servers, IoT from clinical systems. Shrink your blast radius from organization-wide to floor-level or device-level. Do this on your existing network infrastructure without waiting for a multi-year redesign.
Third, enforce identity-based access policy at the network layer for every vendor connection, remote access session, and third-party integration. Supply chain compromise is the attack vector that keeps CISOs up at night, and most hospitals have no technical enforcement of vendor access boundaries beyond VPN credentials and contractual language.
None of these efforts need a regulatory mandate to justify. Each one directly reduces the risk of a patient safety incident caused by a cyberattack, and they can be operational within weeks, not years. Federal strategy provides a policy tailwind. Execution speed separates the health systems that get ahead of the next major incident from those that become it.
Get timely news, expert insights and more — subscribe to
Part B News today.