HITRUST CSF Meaningful use risk assessment

Meaningful Use Privacy
and Security Risk Assessment:
What it is and How to Approach it

Leveraging the CSF and CSF Assurance Program

June 2011

Introduction

HITRUST continues to receive questions on performing a risk assessment for
meaningful use. This document is being released as guidance to provide the
healthcare industry with a clear process to satisfy the privacy and security
requirements of meaningful use.

This guidance is intended for security and compliance professionals of healthcare
providers and is divided into three sections:
1. Quick start guide to conducting a risk assessment for Stage 1 meaningful use
security and privacy requirements
2. Background on meaningful use and the Stage 1 security and privacy
requirements for conducting a risk assessment
3. The recommended approach for conducting an efficient and effective risk
assessment leveraging the CSF Assurance program

1 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.

Conducting your Meaningful Use Risk Assessment

Five steps to getting started with the CSF Assurance Program:
1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your
meaningful use risk assessment.*
2. Identify your scope
– Details on slides 15 and 40
3. Perform an assessment using the Common Health Information Protection
Questionnaire (CHIP) and Compliance Worksheet.**
– Details on slides 16-20 and 42-43
4. Submit your CHIP to HITRUST
5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP
6. Register and attest for meaningful use Stage 1
– Details on slides 26-30
*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visit
http://www.hitrustalliance.net/assurance/
**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g.,
HIPAA Security Rule)
© 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.
2

Meaningful Use Stage 1 Requirements for
Privacy and Security


What is Meaningful Use?

• The use of a certified EHR [system/technology] in [a] meaningful way:
– For the electronic exchange of health information to improve the quality of
health care, and
– To submit clinical quality and other measures (to federal and state agencies)
• Stage 1 requirements (2011 and 2012)
– For eligible hospitals and critical access hospitals
• 25 MU objectives
– 15 core objectives that are required
» Includes the protection of electronic health information
– 5 of 10 menu set objectives that are optional
– For eligible professionals
• 24 MU objectives
– 14 core objectives that are required
» Includes the protection of electronic health information
– 5 of 10 menu set objectives that are optional
Source: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asp


Why Pursue Meaningful Use?
• Medicare and Medicaid provide financial incentives for the meaningful use of
certified EHR technology to achieve health and efficiency goals.
• By [implementing] and meaningfully using an EHR system, providers:
– Receive financial incentives (complex formula)
• Hospitals (Health System = Hospital)
– Base of $2 million—up to 1,149 acute inpatient discharges for prior
12 months
– Maximum of $6,370,200—$200 for each additional discharge up to
23,000
• Critical Care Hospitals will be paid “on reasonable costs”
• Eligible Providers
– Between $24K and $44K based on first calendar year submitted
– Avoid reductions in Medicare and Medicaid payments beyond 2015
– Reap benefits beyond financial incentives (e.g., reduction in errors, availability
of records/data, reminders and alerts, clinical decision support, and e-
prescribing/refill automation)
Source: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asp
http://journal.ahima.org/2010/08/26/meaningful-use%E2%80%94incentive-payments-and-program-requirements

What are the Security & Privacy Requirements?

• Stage 1 MU Measure
– Protect [ePHI] created or maintained by the certified EHR technology
through the implementation of appropriate technical capabilities
• Stage 1 MU Objective
– As part of [an overall] risk management process
• Conduct or review a security risk analysis [per the HIPAA Security
Rule] (45 CFR 164.308(a)(1))
• Implement security updates as necessary
• Correct identified security deficiencies
• Stage 1 MU Attestation
– Organizations must conduct a risk analysis at least once prior to the end
of the EHR reporting period with supporting documentation and updates
implemented as necessary
– You’re attesting to the government, which implies civil and/or criminal
penalties for false statements … so take attestation very seriously!
Source: http://www.cms.gov/EHRIncentivePrograms/Downloads/14HC-ProtectElectronicHealthInformation.pdf

What is a Security Risk Analysis?

• The Security Rule describes a “risk analysis” as “an accurate and thorough
assessment of the potential risks and vulnerabilities to the confidentiality,
integrity, and availability of electronic protected health information [ePHI]”
• Conducting a risk analysis is the first step in identifying and implementing
safeguards that comply with and carry out the standards and implementation
specifications in the Security Rule
• Additionally, the Security Rule requires entities to implement reasonable and
appropriate security measures to protect against reasonably anticipated
threats or hazards to the security or integrity of ePHI
• However the Security Rule does not prescribe a specific risk analysis
methodology …

Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf

What are the Elements of a Risk Analysis?

• Scope the Analysis
– Include the potential risks and vulnerabilities to the confidentiality, availability and
integrity of all ePHI that an organization creates, receives, maintains, or transmits
(45 CFR § 164.306(a))
• Collect Data
– Identify where ePHI is stored, received, maintained or transmitted (See 45 CFR §§
164.308(a)(1)(ii)(A) and 164.316(b)(1))
• Identify and Document Potential Threats and Vulnerabilities
– Identify and document reasonably anticipated threats to ePHI (See 45 CFR §§
164.308(a)(1)(ii)(A) and 164.316(b)(1)(ii))
• Assess Current Security Measures
– Assess and document the security measures an entity uses to safeguard ePHI
(See 45 CFR §§ 164.306(b)(1), 164.308(a)(1)(ii)(A) and 164.316(b)(1))
– In other words, conduct an information security risk assessment

Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf

Guide to Meaningful Use Risk Assessments

1. Demonstrate reasonable practices
A. Select a sound risk assessment methodology
B. Align controls with industry standards and best practices

2. Be efficient—you’ll need resources for remediation efforts
A. Meaningful use focuses on your certified EHR not the whole environment
B. Use sampling techniques in your environment for similar implementations
C. Don’t forget physician practices—they are an entry point into your
environment

3. Take remediation seriously
A. Develop prioritized corrective action plans, but be careful not to over-
commit or under-commit resources, as this could expose you to cost
overruns or non-compliance with regulatory requirements
B. Actively manage remediation as a portfolio of projects and initiatives


Demonstrate Reasonable Practices


Select a Sound Risk Assessment Methodology

• Identify an information security risk assessment approach that
– Scopes (tailors) the assessment
– Prepares for the assessment
– Reports assessment results
– Tracks and measures progress (corrective actions)
• If you use a third party to assist with or conduct the assessment, ensure their
“proprietary” methodology incorporates the above-listed items
• Identify standard templates for documenting results and developing corrective
action plans
• Many organizations confuse a technical evaluation of controls with a risk
assessment, however, these are different concepts and different requirements
under HIPAA


Fundamental Risk Assessment Approach

1. 2. 3.
4.
Prepare for Assessment Report Track and
Determine Scope
Measure Progress

- Focus on high risk
areas - Establish a
- Identify individuals PM over the
responsible for key - Report of remediation
- Applications, control areas findings - Track progress
interfaces, against industry
infrastructure - Conduct top down - Remediation
enterprise control plan benchmarks
analysis - Focus on
- Do not get stuck in the measures
weeds


Align Control Decisions with Industry Standards

• Seek an integrated information
security and compliance
framework COBIT
• Choose a controls-based
approach that is
ISO 27001/2
– Comprehensive
HITECH
– Prescriptive Act
– Certifiable HIPAA PCI
Security
• Define control practices tailored Mngfl.
for use in a healthcare State
Use Reqs.
environment NIST
800-53


Be Efficient


Focus on the Certified EHR System

• Within scope of a review
– All servers that run any module of the certified EHR
– The wide area and local networks supporting the EHR
– Information/data exchange interfaces with other systems
– Workstations, laptops or portable media used to access the EHR
– Vendors that support or have access to data in the EHR
– People, process, policies and standards that are related to the control of
the above components
• Potentially out of scope
– Third party applications that do not interface with the EHR (for example,
payroll system would not be included in scope)
– Network environments that are isolated from the wide area network or the
network connected to the EHR


Testing

• Testing of controls to identify risks may include one or all of the following
components:
– Interview of key personnel responsible for security, IT and key business
processes
– Review of documentation related to the security practices of the
organization and systems
– Technical testing of application, system and hardware configurations

16

Example Interviews

• Types of roles to interview:
– Web application manager
– Internal audit
– Security assurance manager (risk management, business continuity
management, vulnerability management, training and awareness, security
policies)
– Monitoring and response manager
– Server engineering
– Desktop engineering
– Human resources
– Access and identity management
– Application developer
– Operations/office manager
– Legal counsel


Example Documents to Review (i)

• Asset inventory with risk classification
• Network diagram
• Organization chart
• Business associate agreement template
• Risk assessment program
– Application assessment questionnaires
– Sample web application assessments
– Sample network vulnerability assessments
– Sample attack and penetration report
• Project/engagement hierarchy
• System configuration checklists


Example Documents to Review (ii)

• Business continuity management program
– Business impact analysis templates
– Business continuity plan template
– Disaster recovery plan template
– Sample business continuity and disaster recovery plans
• Sample security awareness and training materials
• Policies and standards framework
– Policy and standards third party review report
• Incident monitoring and response program and associated procedures
• Security council charter


Use Sampling Techniques Where Appropriate
• General rule of thumb
– Use sampling when:
• Environment is under the same management control
• Departments/facilities/systems are subject to the same policies and procedures
• Portions of hybrid enterprise/local environments are under enterprise control
– Assess everything if sample indicates excessive variability
• Multi-facility systems
– Scope is directly impacted by the level of standardization
• Highly standardized with enterprise level controls
– Select a random sample of like facilities to assess risks (e.g., assess a
sample of large acute care, smaller acute care and of outpatient facilities)
• Little standardization
– Select a sample of facilities to assess any enterprise wide or centrally
managed controls (e.g., assess how effectively the enterprise wide patch
management function is operating at a sample of facilities)
– Assess non-standard controls at every facility (e.g., if facilities contract and
manage data disposal independently, then assess this process at every
facility)

Assist Physician Practices

• Physician practices:
– Introduce significant vulnerabilities into an EHR system of a hospital or health
system
– Generally do not have the expertise or resources to conduct a risk assessment
• To assist:
– Physician practices that run on a hospital’s EHR and are subject to hospital policies
• Leverage hospital assessment for any controls under direct control of the
hospital (e.g., the patching and configuration of the EHR servers)
• Select a sample of practices to assess how effectively hospital policies are
implemented (e.g., clear desk policy, password management policies)
– Physician practices that run on a hospital’s EHR, but aren’t subject to hospital
policies
• Leverage hospital assessment for any controls under direct control of the
hospital (e.g., the patching and configuration of the EHR servers)
• For each practice, assess controls under the management of the physician
practice (e.g., security policies, workstation security)


Take Remediation Seriously


Develop Sound Corrective Action Plans

• Develop a methodology for the development of corrective action plans (CAPs)
… what the federal government refers to as “Plans of Action and Milestones”
– Integrate CAP development into existing processes where possible
• Project management
• Ticketing systems (or other workflow management)
• Change control
– Automate with a governance, risk and compliance (GRC) system/tool
when possible
• Obtain or develop training materials for control owners and other stakeholders
(e.g., management) to understand and implement the CAP methodology
• Train your control owners and other stakeholders


Actively Manage Remediation

• HIPAA (in general) and meaningful use (in particular) requires the remediation of
identified security deficiencies
– It’s sufficient for Stage 1 meaningful use to develop formal corrective action plans
– However, there is an expectation that these corrective actions will be taken
– Failure to take reasonable and appropriate measures to remediate deficiencies
would be a violation of the HIPAA Security Rule and could make an organization
subject to federal and state civil and criminal penalties for making false statements
• Use project management principles and techniques to actively manage remediation
activities as a single portfolio
– Management should formally approve all corrective action plans
– Remediation activities should be actively monitored and CAPs updated accordingly
– CAP status should be reported to senior management on a regular and timely basis
(along with other security risk metrics), such as:
• Number of CAPs developed and approved as a percentage of identified
deficiencies
• CAP progress such as percentage on-time or behind schedule sorted by risk
• Number of CAPs remediated over time as a percentage of all CAPs actively
managed

Additional Information:
Attestation of Meaningful Use


Attestation … How to get the money

• Medicare hospitals’ EPs must attest, through “secure mechanism approved by
CMS,” that they have “satisfied the required objectives and associated
measures” of §495.6
• Calendar years 2011 and after (no provision for demonstration), except that
EPs using certified EHR need not attest until 2012 (42 CFR §§ 495.8;
495.210)
• Medicaid providers must attest:
“This is to certify that the foregoing information is true, accurate, and
complete. I understand that Medicaid EHR incentive payments submitted
under this provider number will be from Federal funds, and that any
falsification, or concealment of a material fact may be prosecuted under
Federal and State laws.” (42 CFR §§ 495.368)


Attestation … Associated Risks (i)

• Comment: “A commenter indicated that attestation is an insufficient means to
hold providers accountable for the expenditure of public funds and to protect
against fraud and abuse.” (Federal Register Vol. 75, No. 144, p. 44324)
• Response: “We likewise are concerned with the potential fraud and abuse.
However, Congress for the HITECH Act specifically authorized submission of
information as to meaningful use through attestation. CMS is developing an
audit strategy to ameliorate and address the risk of fraud and abuse.”
(Ibid.)
• CMS (Medicare) and states may “review an EP, eligible hospital or CAH’s
demonstration of meaningful use.” (42 CFR § 495.8)
• States required to “annually collect and verify information regarding the efforts
to adopt, implement, or upgrade certified EHR technology and the meaningful
use of said technology before making any payments to providers.” (42 CFR §
495.366)


Attestation … Associated Risks (ii)

• States are required to ensure the qualifications of the providers who request
Medicaid EHR incentive payments
– Detect and take corrective action for improper payments to providers
– Refer suspected cases of fraud and abuse to Medicaid Fraud Control Unit
(42 CFR § 495.368)
• HITECH incentives audits
• HIPAA compliance investigations
• Security breach investigations
• Federal/state false claims act penalties
• Whistleblower (qui tam) lawsuits
• Federal/state program disqualification
• Criminal/civil fraud actions


Attestation … Manage the Risks

• Risk analysis is a process, not a product
• Follow HIPAA “flexible factors” and “reasonable and appropriate” standards in
determining updates and corrections
• Show due diligence in risk identification and update and correction
implementation
– Use appropriate professional expertise
– Incorporate “reasonable practice” information from industry, professional
communities
– Strongly consider the use of outside expertise


Attestation … Perform “Due Diligence”

• Make sure attesting officer is properly informed about risks, updates,
corrections, etc.
– Create and retain supporting documentation file
– In any field where officer does not have appropriate expertise, ensure s/he
is briefed and provided with supporting documentation from appropriate
experts
– Good “business judgment” is the attesting officer’s best friend
• Show your work!
– Document risk analysis process and findings
– Document implementation of updates and corrections
– Providers must retain “documentation supporting their demonstration of
meaningful use for 6 years” after attestation
• Note HIPAA has same document retention period
Source: John R. Christiansen, Esq., Christiansen IT Law


Meaningful Use Privacy and Security Risk
Assessment: Leveraging the HITRUST
CSF Assurance Program


Guide to Meaningful Use Risk Assessments

1. Demonstrate reasonable practices
HITRUST Common
A. Select a sound risk assessment methodology Security
B. Align control decisions with industry standards/practices Framework

2. Be efficient—you’ll need resources for remediation HITRUST CSF
A. Meaningful use focuses on your certified EHR Assurance
not the whole environment
A. Use sampling techniques in your environment for similar implementations
B. Assist physician practices—they are an entry point into your environment
HITRUST CSF
3. Take remediation seriously Assurance
A. Develop sound corrective action plans but be careful not to over-commit
or under-commit resources, as this could expose you to cost overruns or
non-compliance with regulatory requirements
B. Actively manage remediation as a portfolio of projects and initiatives


Demonstrate Reasonable Practices


Select a Sound Risk Assessment Methodology

The CSF Assurance assessment is based on NIST and ISO standards for
evaluating risk

Likelihood Impact Risk

Residual
Risk Controls Risk
• HITRUST risk areas
• Based upon analysis
of breach data
• Significantly simplified
for organizations • HITRUST Common
Security Framework
• Reasonable practice


High Risks for Healthcare Organizations*

• Insecure and/or unauthorized removable/transportable media and laptops (internal
and external movements)
• Insecure and/or unauthorized external electronic transmissions of covered
information
• Insecure and/or unauthorized remote access by internal and third-party personnel
• Insider snooping and data theft
• Malicious code and inconsistent implementation and update of prevention software
• Inadequate and irregular information security awareness for the entire workforce
• Lack of consistent network isolation between internal and external domains
• Insecure and/or unauthorized implementation of wireless technology
• Lack of consistent service provider, third-party and product support for information
security
• Insecure web development and applications
• Ineffective password management and protection
• Ineffective disposal of system assets

*Based on loss and breach data analyzed by HITRUST

Overview of CSF Assurance Risk Assessments

• Referenced by Office of Civil Rights in risk assessment guidance
http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidanc
e.pdf
• Designed to cost-effectively gather the information about security controls
needed to appropriately understand and mitigate risk
• Leverages defined, reasonable controls in the HITRUST CSF
– The most broadly adopted security control framework in the healthcare
industry
• Streamlines risk determination analysis by prioritizing areas based on analysis
for breach data for the healthcare industry
• Provides formal and credible report for internal and external reporting
• Utilizes benchmarking data
• Provides recommendations for remediation


CSF Assurance Assessment Approach

1. 2. 3. 4.
Track and
Determine Scope Prepare for Assessment Report Measure Progress

- Focus on high risk areas
- Identify individuals responsible - Track progress
- Applications, for key control areas against industry
- Report of findings
interfaces, benchmarks
- Conduct top down enterprise and remediation plan
infrastructure
control analysis - Focus on measures
- Do not get stuck in the weeds

- HITRUST CSF
- HITRUST Scoping - HITRUST High Risk List Validated Report - HITRUST CSF
Template - HITRUST CHIP Questionnaire - Corrective Action Validated Report
Plan Template


Align Control Decisions with Industry Standards,
Regulations and Best Practices
HITRUST CSF
• Healthcare-specific security
initiative
• Openly available framework
• Comprehensive requirements
– Focused on high risk controls
• Integrated control set
• Prescriptive and certifiable
• Value-added services
– Industry-reviewed control
practices
– Vendor product certification
– “Trusted broker” third–party
assurance


Be Efficient


Focus on the Certified EHR System

• HITRUST CSF assessments are broken out into two types of assessment
– Organizational: assesses the general information security controls that
may impact the confidentiality, integrity or availability of ePHI
– System: assess the administrative, technical and physical controls specific
to the implementation of a certified EHR technology
• Each type of assessment is further scoped (tailored) based on very specific
factors related to risk and an entity’s ability to implement appropriate and
reasonable security measures
– Organizational: includes type of organization, size, and revenue
– System: includes average number of transactions and external interfaces
• Assessments are further focused on high risk areas
– Based on HITRUST’s analysis of breach data and feedback from over 200
healthcare and security experienced professionals
– Focus on these risks first, adjust for your environment, and expand as
dollars and resources allow (i.e., follow the 80/20 rule)


Key Components of the CSF Assurance Program
• Standardized tools and processes
– Questionnaire
• Focus assurance dollars to efficiently assess risk exposure
• Measured approach based on risk and compliance requirements
• Ability to escalate assurance level based on risk
– Worksheet for reporting compliance
– Report that is consistently interpreted across the industry
• Cost effective and rigorous assurance
– Multiple assurance options based on risk
• Self reporting
• Remote testing—conducted by a CSF Assessor; includes interviews with
key personnel and review of policies, procedures and other relevant
documentation
• On-site assessment—conducted by a CSF Assessor; includes remote
testing and the review of system configurations and physical walkthroughs
– Quality control processes to ensure consistent quality/output from CSF
Assessors

Questionnaire

Common Healthcare Information
Protection (CHIP) Questionnaire:
• Innovative approach to assess the
quality of information protection
practices in an efficient manner
• Focus on the security capabilities
and outcomes of an organization
• Leverages key measures and
supports benchmarking
• Structured according to the high-
risk areas identified in the CSF,
which reflect the controls required
to mitigate the most common
sources of breaches for the
industry


Use Sampling Techniques Where Appropriate

• HITRUST CSF Assurance supports sampling when
– Practices/locations are governed by one set of policies and procedures
– Environments and administrative/technology controls are similar
• There must be a basis for concluding the practices/locations are similar
– Some dissimilarity may support sub-grouping and sampling within sub-groups
• HITRUST recommended sample sizes
Number of Practices in Population/Group Minimum Number of Practices at Which to
Perform Security Risk Assessments
>50 10%, Maximum of 25 Practices
15-50 Minimum of 5/Use Judgment
<15 Minimum of 3/All Practices

• Sampling should be random but other methods could be supported
• Inconsistent results from the sample imply …
– All practices/locations may need to be addressed / assessed
• Exceptions/deviations should be investigated to determine root cause(s)
• If isolated instance or human error, may be able to select a replacement
• Decision and rationale should be documented as part of the assessment


Assist Physician Practices

• HITRUST recognizes the constraints and limitations of physician practices and other
small healthcare organizations

• Small Organization Health Information
Assurance Questionnaire (SOHIA)
– Simplified questionnaire
• Intended for self assessment
• Assesses general organizational
security for high risk factors
– Automated technical assessment
• Simple agent-based tool
downloaded from vendor Web site
• Assessment of current
vulnerabilities
• Re-assessment provides proof of
corrective action


Take Remediation Seriously


Develop a Sound Corrective Action Plan

• Meaningful use only requires a focus on
the certified EHR, but….
• Organizations are expected to routinely
perform a risk analysis under HIPAA
and manage/implement corrective
actions
• If a HIPAA risk assessment was not
performed in over two years, consider a
broader risk assessment to stay aligned
with HIPAA requirements
• HITRUST includes a HIPAA Compliance
Scorecard produced for each HIPAA
security requirement
• Ratings and benchmarks for high risk
controls can help organizations
prioritize remediation efforts

Benchmark Data
Higher Priority Lower Priority
CAPs CAPs
PRISMA SCORE

Organization
Benchmark Orgs


Actively Manage Remediation

• HITRUST CSF Validated and Certified provide a standard assessment report,
compliance scorecard and corrective action plans
HITRUST Common Security Framework CSF Assurance Toolkit 2010 / v1.0 Corrective Action Plan [TEMPLATE]

Instructions
Use this spreadsheet to document the corrective action plan to remediate any findings resulting from an assessment under the
CSF Assurance Program.

The weakness identifier will be Weaknesses represent any program or system-level Related HITRUST CSF Control A POC is the organization, Resources required include the Completion dates should Milestones with completion dates outline the Changes to milestones indicate the new estimated
used to track and correlate information security vulnerability that poses an unacceptable Specification for the identified department or title of the funding (denoted in dollars) or be set based on a specific high-level steps to be executed in future date of a milestone’s completion if the
weaknesses that are ongoing risk of compromising confidentiality, integrity or availability of weakness. position within the man-hours necessary for realistic estimate of mitigating the weakness and the estimated original date is not met.
throughout quarterly information. organization that is directly mitigating a weakness. The type amount of time it will completion date for each step.
submissions within the Ex. 01.b User Registration responsible for mitigating the of funding (current, new or take to collect the Ex. None noted to-date
organization. A rule of thumb is Ex. 1—Granting, transfer and termination procedures for user weakness. reallocated) should be noted. resources for the Ex. Develop user registration procedures for
to use an abbreviated system access are not established corrective action and granting, transferring, and terminating access,
name, the quarter, the year, and Ex. System X Director of IT Ex. 120 hours, current staff implement/test the 8/1/2009
a unique number. Security corrective action. Submit to System X Administrator for review and
input, 8/15/2009
Ex. SYSX_3_2009_1 Ex. 8/31/2009

Weakness Identifier Weakness Description HITRUST CSF Control Organizational Point of Resources Required Scheduled Milestones with Completion Dates Changes to Milestones
Reference(s) Contact (PoC) Completion Date

• Remediation of security deficiencies is required to maintain CSF Validated
status
– No gaps with prioritized requirements (controls) are allowed with CSF
Certified status


Conducting your Meaningful Use Risk Assessment

Five steps to getting started with the CSF Assurance Program:
1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your
meaningful use risk assessment.*
2. Identify your scope
– Details on slides 15 and 40
3. Perform an assessment using the Common Health Information Protection
Questionnaire (CHIP) and Compliance Worksheet.**
4. Submit your CHIP to HITRUST
5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP
6. Register and attest for meaningful use Stage 1
– Details on slides 26-30
*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visit
http://www.hitrustalliance.net/assurance/
**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g.,
HIPAA Security Rule)
49

For More Information:

For more information on the CSF Assurance Program visit:
www.HITRUSTAlliance.net/assurance

For a list of HITRUST CSF Assessors visit:
www.HITRUSTAlliance.net/Assessors_List.pdf

HITRUST Central professional subscribers, can contact customer
support for questions:
support@HITRUSTalliance.net


HITRUST CSF Meaningful use risk assessment

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (6)

Semelhante a HITRUST CSF Meaningful use risk assessment

Semelhante a HITRUST CSF Meaningful use risk assessment (20)

HITRUST CSF Meaningful use risk assessment