Control analysis is a way for healthcare organizations to test the technical safeguards required by the HIPAA Security Rule. The test itself extends to the most common sources of unauthorized access, helping improve email policies and cybersecurity protocols.
What is a control analysis?
Control analysis requires the scrutiny of the technical and nontechnical safeguards designed to reduce the likelihood of a threat exploiting system vulnerabilities. The analysis identifies whether the controls are functioning as intended and determines their adequacy in addressing the identified risks.
NIST Special Publication 800-30 assesses the degree of vulnerability by using an overall likelihood rating, “To derive an overall likelihood rating that indicates the probability that a potential vulnerability may be exercised within the construct of the associated threat environment, the implementation of current or planned controls must be considered.”
The analysis categorizes controls into two main types: preventive and detective. Preventive controls are the proactive mechanisms that stop a threat from materializing. Detective controls on the other hand focus on identifying and alerting when security violations occur like intrusion detections or audit trails. The goal is focused less on prevention, and more on detecting incidents early enough that only minimal damage is caused.
How it works
- Control analysis identifies existing or planned security controls to reduce risks.
- It evaluates both technical and nontechnical controls.
- Controls are categorized as preventative (to stop the threat) or detective (to detect the threat).
- A security requirements checklist helps systematically assess control effectiveness.
- The analysis checks if the controls meet security standards and address vulnerabilities.
- It identifies any gaps or weaknesses in current controls.
- The findings guide decisions to improve or replace inadequate controls.
- The process helps reduce the likelihood of threats exploiting system vulnerabilities.
Can control analyses be applied to assess the efficacy of email policies in healthcare?
Control analysis complements the use of HIPAA compliant email platforms like Paubox to help uncover any gaps or weaknesses in both the procedural aspects of email policies. If the analysis, for example, reveals that employees are not sufficiently trained to recognize phishing attempts, the organization might update its training program.
If the policy suffers from inadequate encryption or fails to monitor outbound emails for protected health information (PHI), the organizations could improve these controls to reduce the risk of data breaches. Control analysis provides healthcare organizations with a systematic framework to assess and improve the security of their practices.
How to apply control analyses
- Evaluate technical controls: Assess the effectiveness of technical controls like PHI by taking into account measures like email encryption, secure access, email filtering, anti-phishing controls, and data loss prevention tools.
- Examine nontechnical controls: Analyze the components of email security that relate to organizational policies. This portion of the analysis looks at email usage policies, employee training (frequency and depth of training programs), and incident response procedures.
- Apply preventive and detective control framework: Preventive controls include restricting access to email servers while detective controls consist of real-time monitoring to detect unusual patterns.
- Conduct compliance checks and vulnerability assessments: Perform routine audits and vulnerability assessments on email systems to check if they are up to date and applied uniformly.
- Test the system: Conduct pen tests or simulated phishing attacks to see how well employees comply with email security practices.
- Assess gaps and make improvements: If control analysis reveals deficiencies like weak password enforcement or missing encryption take corrective actions.
FAQs
What are technical safeguards?
They are the security measures built into the technology itself to protect PHI, particularly in electronic health records (EHRs).
How are systems defined within healthcare organizations?
It typically refers to the various technologies, software, and networks that manage, store, and transmit PHI.
Kirsten Peremore
