Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health Information

© Eric C. Thompson 2017

Eric C. Thompson, Building a HIPAA-Compliant Cybersecurity Program, https://doi.org/10.1007/978-1-4842-3060-2_14

14. Third-Party Risk: Beyond the BAA

Eric C. Thompson¹ 

(1)Lisle, Illinois, USA

Of all the ways to apply risk-based cybersecurity principles, analyzing risks to ePHI related to engaging third parties is very important. Failing to evaluate cyber risk at service providers is dangerous, and recent examples, such as the breach reported by Anthem in August of 2017, and risks to ePHI resulting from these relationships must be included on the risk register as well. In terms of patient data, business associates (BAs) are entities that perform services on behalf of covered entities and have access to ePHI. Business associates ...