Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health Information

This comprehensive guide provides a step-by-step plan for conducting a thorough and timely Risk Analysis and Assessment, documenting all risks to the confidentiality, integrity, and availability of electronic Protected Health Information (ePHI).

With the proliferation of cybersecurity breaches, it is not unusual for additional penalties to be levied when victims of breaches cannot demonstrate that an enterprise-wide risk assessment exists.

This book lays out a plan for healthcare organizations of all types to successfully comply with HIPAA requirements and use the output to build upon their cybersecurity program.

By understanding and documenting all known instances where patient data exist, knowing what regulators want and expect from the risk analysis process, assessing and analyzing the level of severity that each risk poses to ePHI, and focusing on the beneficial outcomes of the process, readers will be able to: * Execute a risk analysis and assessment using NIST 800-30 * Meet the expectations of regulators such as the Office for Civil Rights (OCR) * Optimize deployment of resources and alignment with business objectives * Understand real risks and take action to mitigate them * Build a HIPAA compliant cybersecurity program that cuts through confusion and ambiguity of regulatory requirements.