HIPAA Compliance and SIEM: Meeting Standards in 2020

Cybersecurity Risks must be handled seriously in 2020, especially by organizations that process sensitive patient data as defined by HIPAA, the Health Insurance Portability and Accountability Act. The following are the three most critical questions to ask about your organization's HIPAA compliance along with early warning systems, then the three answers you must know to keep your organization prepared and compliant.

What does HIPAA cover, and which types of data fall under it?

HIPAA stands for the Health Insurance Portability and Accountability Act. It is made up of two core rules; the Privacy Rule and the Security Rule.

First, the Privacy Rule establishes which data and whose data are protected under the Act. All individually identifiable health information must be safeguarded, and the Office for Civil Rights, the appropriate agency, must be notified of any breach or incident, along with related violations.

Second, HIPAA's Privacy Rule sets mandatory safeguards in three categories; Administrative, the workplace security culture; Physical, control over tangible access to secure areas; and Technical, where data is protected digitally.

As we have entered the always-connected digital age, the volume of data processed by healthcare, educational, and corporate systems has grown exponentially, and with it simple reactive monitoring against unsophisticated criminals has become outdated. Threats from inside and outside are real and can become buried in towering mountains of individual logging events.

In a technical sense, what practices does HIPAA require of my CISO?

At a minimum, HIPAA requires audit logging policies with six-year retention to serve as a technical reference for users, apps, and systems. This means all actions related to policies and documents covered by the Act must be logged, and those logs retained for at least six years from their last modification or reference date.

While it may seem manageable at first, manually checking logging events for all your systems and applications are not only inefficient, it just cannot give you the insights that a SIEM will provide real-time, comprehensive risk analysis. Even if you choose to go the extra mile and manually create a couple hundred rules for classifying events, your already stretched team will soon be overwhelmed by sorting through thousands upon thousands of logging events by hand, with many false positives and limited, if any, meaningful statistics.

What is the purpose of a SIEM, and what can it accomplish that manual rules and analysis cannot?

A SIEM ensures that the statistics you need most, such as details required to comply with different regulations, are current and easily accessible. What sets SIEMs apart, however, is their 24/7, behind-the-scenes analysis of the hundreds of thousands of logs for every event.

Smart, next-generation SIEM software, such as Unified Security StackIts Enterprise and Cloud-based solutions aggregate raw logs to uncover normal correlations by organization and role in usage across the Administrative, Physical, and Technical domains set forth by HIPAA's Privacy Act. These usage patterns and events, along with their outliers, are then run through our more than 100,000 industry-tested and proven formulas to identify unusual and potentially unauthorized activity, rather than crude one-step rules with high false-positive and false-negative rates, and to trigger a corresponding response based on the severity of the situation.