If you work in the healthcare industry, chances are that you’re no stranger to HIPAA regulation. The Health Insurance Portability and Accountability Act of 1996 required the creation of national standards to protect sensitive patient health information from being disclosed without the patient's consent or knowledge.
Fast forward to today, maintaining HIPAA compliance is the cornerstone of a strong security posture for organizations working in or with the healthcare industry. Especially as they begin to scale and address electronic protected health information (ePHI) gaps - having a comprehensive asset inventory tool becomes essential.
Asset Management Challenges of HIPAA Compliance
Asset management is critical for healthcare organizations to demonstrate compliance to the HIPAA Security Rule. Healthcare organizations must have reliable, up-to-date asset inventories so they can understand where ePHI is stored, maintained, received, or transmitted.
Some of the most common asset management challenges related to HIPAA compliance stem from using outdated methods to track assets, a lack of process controls and policies, and redundant asset collection.
Many companies today rely on manual processes and spreadsheets to track assets, which leads to a lack of visibility. This trickles down to further compound issues of policy validation and enforcement.
In today’s rapidly evolving IT environment, lacking the proper visibility into all assets and how they are configured means it’s harder to track and secure ePHI. And without a means to track all assets that process ePHI, healthcare organizations potentially face HIPAA noncompliance, with a maximum penalty of $1.5 million for covered entities.
Download the white paper now to see how Axonius can help evaluate compliance with HIPAA.
How Axonius Can Help Evaluate Compliance With HIPAA
Axonius delivers a modern approach to asset management that makes it easier for healthcare organizations to evaluate HIPAA compliance. This approach starts with aggregating data to get comprehensive asset inventory, discovering which devices are unmanaged or misconfigured, and understanding whether every asset adheres to or deviates from policies.
Axonius engaged Tevora, a security and risk management consulting firm, and an accredited HITRUST Assessor, to conduct an independent, in-depth evaluation of Axonius against the applicable HIPAA Security Rule requirements.
Protecting Against Malicious Software
Standard 164.308(a)(5)(ii)(B) requires that there must be procedures for guarding against, detecting, and reporting malicious software. Using queries in Axonius, you can continuously validate that malware detection tools are running. The following is an example of a query that can be used to identify antivirus agents that aren’t actively running and may be broken or corrupted:
“Show ALL assets that have a McAfee ID AND have reported back to Axonius in the last three days AND have NOT been seen in the last three days by McAfee”
Identifying and Tracking User Identity
Standard 164.312(a)(2)(i) requires assigning a unique name and/or number for identifying and tracking user identity. Axonius allows administrators to keep a detailed inventory of all unique assets including users, devices, and cloud instances. On the “users” page, administrators have visibility into all user accounts. User account attributes will vary by sources connected, but often include emails, employee ID, organizational unit, and more.
Beyond those two security rules, Axonius can also be used to evaluate compliance with more HIPAA security requirements.
