2. Presenter Gene Geiger, A-LIGN Partner -HITRUST Practitioner -CPA -CISSP -CCSK -QSA -PCIP -ISO 27K LA

3. AGENDA 1.HITRUST Overview 2.Steps to Certification/Compliance 3.Integration with Existing Audits

4. HITRUST Overview Need for HITRUST – Increased risk to healthcare data – Increased use of technology – Increased concern from consumers – Lack of standardized certification – Lack of standard implementation of existing standards

5. HITRUST Overview What is HITRUST CSF – Certifiable framework for the healthcare industry – Based on ISO 27001 – Integrates HIPAA, HITECH, NIST 800-53, ISO 27001, PCI DSS, FTC, COBIT and State Laws – Tailorable based on the organization

6. HITRUST Overview Control Framework 1.Identify risks and define protection requirements 2.Specify Controls 3.Implement and manage controls 4.Assess and report

7. HITRUST Overview CSF Components – Control Categories Based on ISO 27001 Appendix A 14 control categories (13 security/1 privacy) – Control objectives Desired outcome/Risk reduction 46 control objectives – Implementation requirements Prescriptive (required) control statement 149 implementation requirements

8. HITRUST Overview Implementation requirements – Three levels of requirements – Level 1 is the base level requirement – Levels 2 and 3 build on each other – Based on risk Organizational factors System factors Regulatory factors – Level 1 meets the HIPAA Security Rule Addressable and Required Level 3 Level 2 Level 1

9. Certification/Compliance Scoring of Implementation – Is a policy in place? – Is there a process or procedures to support the policy? – Has it been implemented? – Is it being measured and tested by management to ensure it is operating? – Are the measured results being managed to ensure corrective actions are taken as needed?

10. Certification/Compliance Assessment types – CSF Security Assessment – CSF Security Assessment + Privacy – CSF Comprehensive Security Assessment – Comprehensive Security Assessment + Privacy – NIST Cyber Security Assessment

11. Certification/Compliance Assessment methods – Self Assessment – Validated Assessment – SOC 2 Plus HITRUST – SOC 2 Plus HITRUST Plus HITRUST Certification Self Assessment Validated Assessment SOC 2 Plus HITRUST SOC 2 Plus HITRUST Plus HITRUST Certification

12. Certification/Compliance MyCSF Tool Costs – Paid directly to HITRUST – Self Assessment Reports are $2,500. – Validated Assessment Reports range from $3,750-$7,500 Based on organizations annual revenue – Annual subscription starts at $12,500 for most Not required Unlimited access Results are stored in MyCSF to be used for the following year

13. Integration with Existing Audits Establish your compliance roadmap Identify overlap in controls – HITRUST supplied mapping – Additional mapping resources Synchronize audit timing Consolidate audit evidence Consolidate audit firms Save time and money Reduce audit fatigue

14. Questions? 888.702.5446 | www.A-LIGN.com | info@a-lign.com