All Things Newz
Law \ Legal

NIST Releases Draft Cybersecurity Resource Guide On Implementing The HIPAA Security Rule – Security

To print this article, all you need is to be registered or login on

The National Institute of Standards and Technology (NIST) has
released an initial draft of Implementing the Health Insurance Portability and
Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource
(Resource Guide) for public comment. With this Resource
Guide, NIST seeks to help HIPAA regulated entities – covered
entities and business associates – understand and implement the HIPAA Security Rule and provides guidance on
conducting the required periodic risk assessment. Notably, the
Resource Guide is an update to NIST’s 2008 publication on
implementing the HIPAA Security Rule.

The Resource Guide includes a brief overview of the HIPAA
Security Rule, provides guidance on assessing and managing risks to
electronic protected health information (ePHI), identifies typical
activities that a regulated entity might consider implementing as
part of an information security program, and includes additional
resources that regulated entities may find useful in implementing
the Security Rule, such as a crosswalk between the HIPAA Security
Rule standards and NIST Cybersecurity Framework.

Below is an overview of the content covered by the Resource

Considerations When Applying the HIPAA Security Rule

Perhaps most helpful is that NIST has broken each HIPAA Security
Rule standard down by key activities that a regulated entity may
wish to consider implementing, adding a detailed description, and
providing sample questions that a regulated entity might ask itself
to assist in implementing the Security Rule. As an example, for the
standard Assigned Security Responsibility: “Identify the
security official who is responsible for the development and
implementation of the policies and procedures required by this
subpart for the covered entity or business
associate.”1 NIST provides sample questions such

  1. Who in the organization is responsible for overseeing the
    security policies, conducting the risk assessment and risk
    management, handling the results of periodic security evaluations
    and continuous monitoring, and directing IT security purchasing and

  2. Does the security official have adequate access and
    communications with senior officials in the organization?

  3. Who in the organization is authorized to accept risks from
    systems on behalf of the organization?

This detailed guidance for each HIPAA Security Rule standard
will be helpful for regulated entities struggling to adopt it with
only the language in the HIPAA Security Rule and Office for Civil
Rights (OCR) guidance on the same. The Resource Guide should
provide more practical considerations for regulated entities
operating in today’s complicated cybersecurity environment.

Risk Assessment Guidelines

The Risk Assessment Guidelines section of the Resource Guide
provide a methodology for conducting a risk assessment. HIPAA
Security Rules requires that all regulated entities “[c]onduct
an accurate and thorough assessment of the potential risks and
vulnerabilities to the confidentiality, integrity, and availability
of electronic protected health information held by the covered
entity or business associate” and then “[i]mplement
security measures sufficient to reduce risks and vulnerabilities to
a reasonable and appropriate level.”2 This is known
as the risk analysis (often referred to as a risk assessment) and
risk management plan, respectively. The results of the risk
assessment should enable regulated entities to identify appropriate
security controls for reducing risk to ePHI. OCR does not prescribe
any particular risk assessment or risk management methodology, but
has provided guidance such as the Guidance on Risk Analysis and Security Risk Assessment Tool in the past.

NIST’s guidance in this area is similar to previous OCR

  1. Prepare for the Assessment. Before beginning
    the risk assessment, understand where ePHI is created, received,
    maintained, processed, or transmitted. This must include all
    parties and systems to which ePHI is transmitted, including remote
    workers, external service providers, and medical devices that
    process ePHI.

  2. Identify Realistic Threats. Identify potential
    threat events and sources, including (but not limited to)
    ransomware, insider threats, phishing, environmental threats (e.g.,
    power failure), and natural threats (e.g., flood).

  3. Identify Potential Vulnerabilities and Predisposing
    . Identify vulnerabilities or conditions that
    can be exploited for the threats identified in Step 2 to have an

  4. Determine the Likelihood of a Threat Exploiting a
    . For each threat identified in Step 2,
    determine the likelihood of a threat exploiting a vulnerability. A
    low, moderate, or high risk scale is commonly used but not

  5. Determine the Impact of a Threat Exploiting a
    . The regulated entity should select an
    impact rating for each identified threat/vulnerability pair and may
    consider how the threat event can affect the loss or degradation of
    the confidentiality, integrity, and/or availability of ePHI.
    Example impacts would include an inability to perform business
    functions, financial losses, and reputational harm. Again, a low,
    moderate, or high risk scale is commonly used but not

  6. Determine the Level of Risk. The level of risk
    is determined by analyzing the overall likelihood of threat
    occurrence (Step 4) and the resulting impact (Step 5). A risk-level
    matrix can be helpful in determining risk levels for each threat
    event/vulnerability pair.

  7. Document the Results.

Similar to previous OCR guidance, NIST reminds regulated
entities the risk assessment is an ongoing activity, not a
one-time, static task, and must be “updated on a periodic
basis in order for risks to be properly identified, documented, and
subsequently managed.”

Failure to have a thorough and up-to-date risk assessment is one
of the top failures documented by OCR in resolution agreements with regulated entities.
Therefore, regulated entities should take this opportunity to
determine when its last risk assessment was conducted, ensure the
risk assessment meets previous OCR guidance, and consider the NIST
guidance in this Resource Guide as well.

Risk Management Guidelines

NIST states the Risk Management Guidelines introduce a
“structured, flexible, extensible, and repeatable
process” that regulated entities may utilize for managing
identified risks and achieving risk-based protection of ePHI. The
regulated entity will need to determine what risk rating poses an
unacceptable level of risk to ePHI, given the regulated
entity’s risk tolerance and appetite. Ultimately, the regulated
entity’s risk assessment processes should inform its decisions
regarding the implementation of security measures sufficient to
reduce risks to ePHI to levels within organizational risk


The Resource Guide is still in draft form, with NIST continuing
to accept public comment on whether the guide is helpful and where
there could be improvement through September 21, 2022. For more
information or assistance regarding compliance with the HIPAA
Security Rule, please contact the author or any other Partner or
Senior Counsel member of Foley’s Cybersecurity and Privacy


1. See 45 CFR § 164.308(a)(2)

The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.

POPULAR ARTICLES ON: Technology from United States

Source link

Related posts

In India, we are all ‘advocates’: outdated legal traditions in Australia – Marketing

Panasonic Restrained From Selling Fans Deceptively Similar To Havells – Trademark

IP In Sport – A Game Of Branding And Tech Transformations, Transfer And Trickle-downs – Sport