Survey finds 60% of covered entities and 72% of their vendors believe today’s third-party risk management practices are not effective: new guidance provides a consistent set of practices to reduce cyber risk for the health industry
FRISCO, Texas–July 27, 2023–The Health 3rd Party Trust (Health3PT) Initiative today announced the release of the Health3PT Recommended Practices & Implementation Guide, a key deliverable in its mission to solve the third party cyber risk problem in the healthcare industry. The Health3PT Recommended Practices & Implementation Guide is the result of collaboration among a council representing the nation’s leading healthcare organizations and provides an instructional framework of actionable steps organizations can take to ensure due diligence and due care throughout the healthcare ecosystem—while improving effectiveness, reducing inefficiencies, and leading the way for standardization in Third-Party Risk Management (TPRM).
There is a wide range of TPRM practices adopted across the healthcare industry. Many of these are decades old and adopted from processes used by other industries, making them ill-equipped to meet the modern challenges presented by adopting new technology innovations such as cloud and AI in the healthcare industry and the ensuing cyber threats that follow. These numerous and outdated TPRM approaches result in inconsistent and unclear risk management outcomes, as evidenced by vendor-related security events and breaches of PHI and other sensitive Information by business associates.
An industry survey conducted by Health3PT confirms the challenges facing current healthcare TPRM processes and reveals that both covered entities and vendors are overwhelmed. Sixty-eight percent of covered entities and 79% of vendors believe the current TPRM process is inefficient. Vendors experience audit fatigue from the sheer volume and variability of proprietary security questionnaires they receive from their customers, and covered entities can’t keep pace with the volume of questionnaire responses they receive. The legacy process is a resource and productivity drain for the healthcare industry, and neither covered entities (60%) nor vendors (72%) see the status quo as an effective process to prevent data breaches.
The survey found the aspects of TPRM that covered entities are most dissatisfied with are: Keeping pace with the volume of security assessments they receive (50%); Getting vendors to address and fix identified information security deficiencies (48%); Excessive turnaround time for assessments (43%); and receiving transparent assurances from vendors to satisfy the request the first time (38%).
“The average cost of a healthcare data breach is around $10 million, including significant judgments that have been recently levied against organizations for violations of HIPAA and PHI privacy rules,” said John Houston, VP Information Security and Privacy, UPMC. “Our experience is that 90% of breaches within healthcare involve a third party or a vendor that has a provider’s data. At the end of the day, we’re all spending a lot of money on third-party risk management, and we’re not necessarily sure that we’re getting our value out of the money spent.”
The aspects of TPRM that vendors are most dissatisfied with are: Customers unwilling to accept third-party validated assessments and certifications in lieu of proprietary control questionnaires (47%); Handling the variability of questionnaires and audits (39%); and the resources and time required to meet compliance requirements (27%).
“Smaller organizations are challenged with staffing and affordability. What can we do with the number of people we have within a reasonable budget? So, the fewer questionnaires, the better,” said Glen Braden, Principal, CFO, and CIO, Attest Health Care Advisors. “We embraced the HITRUST standard years ago, and we expect our clients to accept it as well because we don’t have the staff to answer hundreds of separate questionnaires. At the end of the day, it’s about providing reasonable assurance. But we have to be able to do it in a manner that is affordable, that can scale, and responds to the needs of our customers.”
The survey was conducted in coordination with the Health3PT Third Party Risk Virtual Summit, an industry-wide virtual event held on June 7, 2023. Over 400 experts in the healthcare third-party risk management community across covered entities and vendor organizations participated in panel discussions to transparently share their concerns on the inadequacies of current healthcare TPRM practices and work toward new, innovative solutions.
Organizations that implement the recommended practices will meet both the spirit and the letter of Health Insurance Portability and Accountability Act (HIPAA) Security Rule requirements regarding the provision of ‘satisfactory assurances’ from their third parties as well as help qualify for potential mitigations from regulatory fines and penalties.
Six recommended practices are addressed in the Health3PT Recommended Practices & Implementation Guide:
- Concise contract language tying financial terms to a vendor’s transparency, assurance, and collaboration on security matters
- Risk tiering strategy that drives the frequency of reviews, the extent of due diligence, and the urgency of remediation
- Appropriate, reliable, and consistent assurances about the vendor’s security capabilities
- Follow-up through to closure of identified gaps and corrective action plans
- Recurring updates of assurance of the vendor’s security capabilities
- Metrics and reporting on organization-wide vendor risks
At the summit, Health3PT also announced the availability of its Vendor Directory. Over 70 organizations have submitted applications to be qualified and listed in the first release of the directory. The tool makes it easy for healthcare organizations to identify trustworthy vendors that meet their information risk management requirements based on their HITRUST certification status to streamline the vendor selection and contracting process. The directory is now available at health3pt.org/vendor-directory.
To date, over 150 organizations have joined Health3PT. The Initiative is dedicated to bringing standards, credible assurance models, and automated workflows to solve the third-party risk management problem and advance the mission to safeguard sensitive information.
- Download the Health3PT Recommended Practices & Implementation Guide and the Health3PT “The State of Healthcare Third Party Cyber Risk Management” Survey.
- Access the Health3PT Vendor Directory.
- Register to attend the Health3PT Vendor Risk Management Summit, October 2, 2023, in Grapevine, TX.
- To join the Health3PT Initiative and for more details, visit Health3PT.org.
About the Health3PT Initiative
Representing leaders from healthcare providers, payers, and services, the Health3PT Initiative strives to share best practices in managing third-party risk to deliver on their organizations’ mission of safeguarding sensitive information. By driving collaboration with industry and government, the Health3PT Initiative is enabling a standardized approach that organizations can adopt to effectively and efficiently manage third-party risk within their organization and to protect the entire third-party ecosystem. Health3PT is supported by HITRUST, the industry-recognized risk and compliance standards and certification body, and CORL Technologies, the healthcare third-party risk management services and solutions provider.
Source: Health3PT