Strategies for Integra.ng the HIPAA Security Rule

Transcription

1 Strategies for Integra.ng the HIPAA Rule Kaiser Permanente: Charles Kreling, Execu.ve Director Sherrie Osborne, Director Paulina Fraser, Director Professional Strategies S Fall Conference Sail to Success CRISC CGEIT CISM CISA

2 Agenda 1 About Kaiser Permanente 2 The Regulatory Compliance Challenge 3 Integrating Regulatory Compliance 4 Key Learnings Page 2

3 About Kaiser Permanente Nation s largest nonprofit health plan Integrated health care delivery system 9.1 million members 17,000 physicians 175,000 employees Serving 9 states and the District of Columbia 37 hospitals 618 medical offices and other facilities $50.6 billion operating revenue (2012) Page 3

4 Integrated Regulatory & Information Services (IRISS) Mission* Provide an integrated roadmap to simplify compliance with multiple security regulations in the Information area Vision* Integrated strategic solutions for SOX, HIPAA & PCI Integrated requirements, guidance, and how-to manuals Exceptional customer service to Kaiser Permanente information security clients Charles Kreling Executive Director Integrated Regulatory & Information Services (IRISS) Sherrie Osborne Director Integrated Regulatory & Information Services (IRISS) Paulina Fraser Director Integrated Regulatory & Information Services (IRISS) * IRISS was formed August 2013; mission & vision are draft. Page 4

5 The Regulatory Compliance Challenge SOX, HIPAA /HITECH, & PCI at Kaiser Permanente Other National Compliance Office (NCO) Business Application Owners (BAOs) Application Access Lifecycle Management (AALM) HIPAA/HITECH, SOX, PCI, and Other Information Technology Risk Office (TRO) Infrastructure Management Group (IMG) Meaningful Use Program Office (MU PMO) SOX PMO Business Information Officers (BIOs) 5 Page 5

6 Sarbanes-Oxley (SOX) at Kaiser Permanente Computer Operations Change Management Page 6

7 Sarbanes-Oxley (SOX) at Kaiser Permanente : Access Controls (Host & Database) (Provision) , , (De-provision) (QAR) Configurations (Host & Database) SOD (Segregation of Duties) (Logical separation of duties) Physical (Review Physical Access to Production Hardware security control - data center aspect) (Application Access Lifecycle Management - Business Application Access Controls): (Provision) (De-provision) (QAR) Intersection (Activity Monitoring): & Change Management (Application, Host & Database) (Application) Intersection (ALL): Population Management (Supporting function critical to success execution of controls) (Network monitoring) (Self Assessment monitoring) Computer Operations: Backup & Batch Jobs (Backup / Batch Approval) (Backup recoverable) (Backup / Batch Jobs Monitored) IT Incident Resolution (Problem & Incident) Computer Operations Change Management Change Management: Change Management & Configuration Management (Changes authorized) (Version control) (Changes tested) (Changes approved prior to migration) (Review Logical Access to Production) Page 7

8 HIPAA Rule/HITECH at Kaiser Permanente The HIPAA Rule aims to protect the confidentiality, integrity and availability of electronic protected health information (ephi). The HIPAA Rule comprises: 1) Administrative Safeguards 2) Physical Safeguards 3) Technical Safeguards Some safeguards are required while others are addressable Meaningful Use Core Set Objective 14/15: Privacy and Objective: Protect electronic health information created or maintained by the certified EHR technology through the implementation of appropriate technical capabilities. Measure: Conduct or review a security risk analysis per 45 CFR (a)(1) and implement updates as necessary and correct identified security deficiencies as part of the Eligible Professionals (EP), Eligible Hospitals (EH), or Critical Access Hospitals (CAH) risk management process. Page 8

9 HIPAA Rule/HITECH at Kaiser Permanente Risk and Control Matrix The HIPAA Rule and Privacy Rule (data de-identification only) requirements (58 and 1 requirements, respectively) were organized into 24 control categories, aligned with SOX IT General Controls as applicable. DATA DE-IDENTIFICATION WORK TRACK APPLICATION AND INFRASTRUCTURE WORK TRACKS INFRASTRUCTURE WORK TRACK NON- APPLICATION / NON-TECHNICAL CONTROLS Uses and Disclosures Access, Activity Review, and Configuration Emergency Management Data (In Transit and At Rest) Physical Enterprise Data De-Identification System Activity Review and Audit Controls Disaster Recovery Plan Encryption Facility Access Contracts and Business Associate Agreements Incident Procedures Business Continuity Plan Data Transmission Facility Access Termination and Review Policies and Governance User Access Provisioning Facility Plan Risk Management User Access Termination Facility Maintenance Records Training and Awareness User Access Review Device and Media Controls Evaluation Configuration Workstations and Other Devices These controls ensure Workforce management Clearance directives pertaining to the entire Change Management (Integrity) Business is involvement is required in order to meet control objectives (e.g., application access controls, business continuity planning, etc.) Page 9

10 PCI-DSS at Kaiser Permanente PCI-DSS The Dirty Dozen Objectives Keep your network secure Protect cardholder data Maintain a vulnerability management program Control access to data and data systems Monitor and test Have an information security policy 1. Protect data with a firewall 2. Do not use default passwords 3. Protect stored data 4. Encrypt data over public networks 5. Perform regular anti-virus updates 6. Secure systems and applications 7. Restrict access to data 8. Assign unique IDs to each person 9. Restrict physical entry 10. Monitor all data access 11. Test security systems and processes 12. Maintain an information security policy Translates to more than 200 specific requirements. PCI is a 100% Compliance requirement à failing one requirement means overall non-compliance. Page 10

11 The Regulatory Compliance Challenge Control Design & Implementation Variation Testing Methods & Schedules Not Aligned/ Integrated Multiple Risk & Control Assessment Methods & Tools HIPAA/HITECH, SOX, PCI, and Other Information Risk Governance Performed by Multiple Organizations Various Risk Models & Standards Metrics & Reporting Not Consistently Integrated High Cost of Compliance Organizational Frustration & Compliance Fatigue Multiple Risk & Control Frameworks Page 11

12 Integrating Regulatory & Information Compliance Technology Risk & Controls (TRC) Framework Sustainment Info Sec Policies & Standards HIPAA/HITECH, SOX, PCI, and Other Information Common Services Assessment Methods & Tools & Guidance 12 Page 12

13 Integrating Regulatory & Information Compliance IRISS (Monitoring) Technology Risk & Controls (TRC) Framework TRM TRM ITC (Control Self- Assessments) Sustainment Info Sec Policies & Standards IRISS (System Activity Review, Data De- Identification, other) Common Services HIPAA/HITECH, SOX, PCI, and Other Information Assessment Methods & Tools ITC (Assessments) TRM (Tools) IAM (Central Authentication) IRISS & Guidance Cyber (PLSE & technical / threat assessments) 13 Page 13

14 Integrating Regulatory & Information Compliance Technology Risk & Controls (TRC) Framework Technology Risk & Controls (TRC) Framework Benefits Single framework encompassing all applicable regulations (including HIPAA, SOX, and PCI) Sustainment Common Services HIPAA/ HITECH, SOX, PCI, and Other Information & Guidance Info Sec Policies & Standards Assessment Methods & Tools Based on industry standards, but customized for Kaiser Permanente Basis for TRO risk assessment Status Being rationalized for consistency 14 Page 14

15 Integrating Regulatory & Information Compliance Technology Risk & Controls (TRC) Framework (example) Technology Risk and Controls Framework Technology Risk & Controls (TRC) Framework Enables aggregated, comprehensive management of multiple factors Sustainment HIPAA/HITECH, SOX, PCI, and Other Information Info Sec Policies & Standards Captures key data such as: Common Services Assessment Methods & Tools Domain & Guidance Process description Control objectives Industry best practices Integrates SOX, HIPAA & PCI 15 Page 15

16 Integrating Regulatory & Information Compliance Info Sec Policies & Standards Technology Risk Standard (TRS) Technology Risk & Controls (TRC) Framework Provides common language and integration for all regulatory terms Sustainment HIPAA/ HITECH, SOX, PCI, and Other Information Info Sec Policies & Standards Maps provisions to regulatory requirements, creating 100% traceability Common Services & Guidance Assessment Methods & Tools Aligns Assessment methods and tools with TRS requirements Policies Ongoing refinement of policies to assure inclusivity and reduce redundancy 16 Page 16

17 Integrating Regulatory & Information Compliance Info Sec Policies & Standards (example) Technology Risk & Controls (TRC) Framework Sustainment Common Services HIPAA/ HITECH, SOX, PCI, and Other Information Info Sec Policies & Standards Assessment Methods & Tools & Guidance 17 Page 17

18 Integrating Regulatory & Information Compliance Assessment Methods & Tools Benefits Technology Risk & Controls (TRC) Framework Provides common tools and methodologies based on TRC Framework Lessens compliance fatigue by developing a test once, use many methodology Sustainment Common Services HIPAA/ HITECH, SOX, PCI, and Other Information & Guidance Info Sec Policies & Standards Assessment Methods & Tools Standardizes and integrates HIPAA/HITECH, SOX, and PCI assessments based both on common and unique attributes Improves audit readiness Status Integrated control assessment requirements in the process of being defined 18 Page 18

19 Integrating Regulatory & Information Compliance Assessment Methods & Tools (example) Technology Risk & Controls (TRC) Framework Sustainment Info Sec Policies & Standards HIPAA/ HITECH, SOX, PCI, and Other Information Common Services Assessment Methods & Tools & Guidance 19 Page 19

20 Integrating Regulatory & Information Compliance and Guidance Benefits Rationalizes all regulatory requirements into a single set of compliance instructions Sustainment Technology Risk & Controls (TRC) Framework HIPAA/ HITECH, SOX, PCI, and Other Information Info Sec Policies & Standards Customizable based on regulatory applicability Common Services & Guidance Assessment Methods & Tools Defines control attribute requirements for each regulatory framework Status Utilizes the 9 SOX Domain controls as its basis 20 Page 20

21 Integrating Regulatory and Information Compliance and Guidance (continued) Multiple inputs evaluated to create an integrated set of compliance manuals for HIPAA, SOX, and PCI Collaborate with Stakeholders Identify relevant HIPAA Standards/ Implementation Specifications Align HIPAA- SOX-PCI requirements Draft and Develop HIPAA- SOX-PCI Control Language and Attributes Objective Enhance HIPAA-SOX- PCI and Attributes Deliver Integrated Compliance Manual 9 SOX Domain Controls HIPAA Rule Centers for Medicare and Medicaid Services (CMS) Guidance Docs TRC Framework ITC Mapping Compliance Manuals, Narratives, other documents PCI DSS 2.0 Authoritative Sources (HITRUST, SIG, COBIT, ISO 27002, NIST ) Compliance Manuals, Narratives, other documents Stakeholder feedback/comments on draft HIPAA-SOX- PCI requirements and guidance Manuals, Narratives, other documents Page 21

22 Integrating Regulatory and Information Compliance and Guidance (continued) Making compliance easier Technology Risk & Controls (TRC) Framework Sustainment Info Sec Policies & Standards HIPAA/ HITECH, SOX, PCI, and Other Information Common Services Assessment Methods & Tools & Guidance Page 22

23 Integrating Regulatory & Information Compliance and Guidance (example) Technology Risk & Controls (TRC) Framework Sustainment Info Sec Policies & Standards HIPAA/ HITECH, SOX, PCI, and Other Information Common Services Assessment Methods & Tools & Guidance 23 Page 23

24 Integrating Regulatory & Information Compliance Common Services Benefits Utilizes standardized, centralized, and scalable solutions Provides consistent control execution across all regulatory frameworks Sustainment Common Services Technology Risk & Controls (TRC) Framework HIPAA/ HITECH, SOX, PCI, and Other Information Info Sec Policies & Standards Assessment Methods & Tools Examples & Guidance Identity and Access Management (IAM) Application Access Lifecycle Management (AALM) System Activity Review / Elevated Activity Monitoring Data De-Identification (DDI) 24 Page 24

25 Integrating Regulatory & Information Compliance Sustainment Benefits Technology Risk & Controls (TRC) Framework Provides ongoing reporting of the risk landscape Enhances controls effectiveness and maturity Sustainment Common Services HIPAA/ HITECH, SOX, PCI, and Other Information & Guidance Info Sec Policies & Standards Assessment Methods & Tools Examples IRISS Monitoring services Controls Self-Assessments (CSAs) 25 Page 25

26 Integrating Regulatory & Information Compliance Approach to Compliance Sustainability Kaiser Permanente built a strategy that sustains compliance and includes compliance education, monitoring and enforcement. The fast changing regulatory environment requires that Kaiser Permanente take an aggressive and forward-thinking approach to regulatory compliance. Sarbanes-Oxley Act (SOX) NAIC Model Audit Rule (MAR) HIPAA Rule/ HITECH (MU P&S) and HIPAA Privacy Rule (DDI only) Payment Card Industry Data Standards (PCI-DSS) Effects of Non-Compliance may include: Damage to the Kaiser Permanente reputation and brand Loss of member trust through required breach notification Unable to attest to portions of HIPAA for Meaningful Use purposes Significant civil and/or criminal fines and penalties Increased scrutiny in the form of more enforcement audits Material financial misstatements Page 26

27 Integrating Regulatory & Information Compliance Approach to Compliance Sustainability Current State and Proposed Future State How do we accelerate compliance sustainability? Current State Fragmented sustainment processes Decentralized compliance monitoring and reporting Varied levels of compliance maturity Unclear accountabilities Leveraging SOX approach Proposed Future State Highly integrated compliance model Centralized compliance monitoring and reporting Standardized processes and tools Clearly defined accountabilities. Benefits of Compliance Integration Accelerates and enhances compliance Increases visibility and transparency Drives standardization Leverages existing tools and processes Supports Technology Risk & Control (TRC) framework efforts Page 27

28 Integrating Regulatory & Information Compliance Approach to Compliance Sustainability Control Maturity Levels (example) Business Maturity Level Accountability Documenta.on Evidence Process Monitoring - Accountable - Knowledgeable - Full authority - Engaged/mo9vated - Process documented - Accurate & complete - Updated periodically - Evidence retained - Centrally stored - Complete popula9on - Consistent with narra9ve - Follows internal & external - Team self- monitors best prac9ces - Issues resolved 9mely - Standardized & automated 0 Does Not Exist Does not exist Does not exist Does not exist Does not exist Does not exist 1 Incomplete 2 Inconsistent Exists but unsure & not clearly defined Accountable but no full authority to exercise responsibilikes Exists but inaccurate, incomplete or undefined Accurate & complete but informally managed Exists but inadequate or incomplete Complete & retained but informally managed Exists but does not follow the narrakve or incomplete Complete but very manual, resource intensive & not standardized Ad- hoc monitoring in place, no resolukon management process Periodic monitoring in place, no resolukon management process 3 Consistent & Streamlined Accountable, knowledgeable, & full authority Formally approved by management & centrally stored Complete, retained, & centrally stored Standardized, streamlined and manual or parkally automated Periodic monitoring & resolukon management process in place 4 OpKmized & Sustainable Accountable, knowledgeable, fully authorized & engaged Updated & approved regularly using a formal change management process System- generated & managed using an integrated tool End- to- end process is supported by integrated tools and automakon Automated, conknuous monitoring & resolukon management process in place IT Criteria and Defini.on Maturity Rating (0-4) Accountability Documenta.on Design and Opera.ng Effec.veness Self Assessment Process and Execu.on - IdenKfied and confirmed - Accountability understood - Knowledgeable - Full authority and empowerment - Engaged - Process documented - Reflects control design - Accurate & complete - Reviewed and approved periodically - Retained and readily available Adequate control design (saksfies SOX PMO guidance) - Control is evaluated either through self teskng or management teskng - No design gaps and consistent, effeckve control operakon (no open CAPs) - Standard self assessment process - Self assessment performed for each control/layer - TesKng sufficiently evidenced and documented - Adequate disposikon of test results (e.g. CAP decision) Overall control maturity considers all four criteria and is calculated based on weight of each criterion. (Accountability 5%, Process and Controls Documentation 5%, Design and Operating Effectiveness 80%, and Self Assessment Process and Execution 10%) Page 28

29 Key Takeaways Collaborate, collaborate, collaborate! Clearly define ownership of critical functions and processes Clearly define roles/responsibilities Establish a RACI for organization and lower level RACIs for functions Understand the spirit of the regulation Plan and do the foundational work before diving into the detailed work Leverage and re-use what works Understand your population: Asset inventory What you do and don t know; work to reduce the unknowns Your maturity model; which controls do/do not exist for in scope applications, infrastructure, and enterprise Find and fix early: CSAs self-detect and correct; don t wait for tester to tell you what s wrong Page 29

30 Page 30 Questions