Addressing Common Security Gaps Before You Get Audited

The key to avoiding this kind of devastating blow to your organization is to understand HIPAA regulations around protecting sensitive health information and PHI. A good first step to protecting your organization is with a security risk assessment (SRA). An SRA has always been a good idea, but now it is more than that – it is also a requirement from the Office of Civil Rights who protects personal health information via HIPAA, and it helps demonstrate that you have a culture of compliance and are not being neglectful with PHI.
​
One of the primary reasons organizations struggle with understanding their security gaps is because they struggle to understand where their PHI actually is. This holds as true for a small clinic using on premise legacy infrastructure as it does for a larger organization in the public cloud. Because of data sprawl and shadow IT, as well as the sheer growing volume of healthcare data, it’s very difficult for most organizations to state with any certainty where ALL of their PHI is. And let’s face it, if you don’t know where it is, how can you protect it?