Although some of us may wish for simpler times, it would be nearly impossible for today’s health systems to be self-contained as they were in the past. Now that patients seek a more seamless and personalized care experience, hospitals need a way to meet their demand while improving efficiencies and profitability. Enter the third-party vendor. Whether it’s technology suppliers, service providers, partners, consultants, contractors, or all of the above, these vendors serve as a valuable part of your organization’s ecosystem. But with that comes an expanded risk footprint as the number of opportunities to encounter, manage, transmit and compromise your confidential patient information grows. How do you balance the value of these relationships with the increased risk?
The Realities of Third-Party Risk
Healthcare data breaches now occur at record-setting pace. In 2018, 15 million patient records were compromised in 503 breaches—three times the amount seen in 20171. In just the first half of 2019, the number of compromised patient records has skyrocketed to more than 25 million2.
You’re not the only one wary of these headlines; your patients are too. They’re entrusting you with their most personal and private information. How confident are you that your third-party vendors can be trusted to keep that information secure and compliant? If your answer isn’t 100 percent, you may need to rethink your approach to vendor compliance. Achieving an optimal level of compliance with your vendors is not just a goal; it is a prerequisite for protecting your hospitals and your patients.
Third-party vendors accounted for at least 30 percent of the total security incidents in 2018, impacting 5.3 million patient records2.
The Challenges of Risk Management
It is essential for the security and compliance of your organization that your third-party vendors adhere to agreed upon controls. But making sure this happens requires a stringent process for holding them accountable. It can be a painstaking process that, without a clear-cut remediation path, can be fraught with challenges including:
- Self-reported vendor ‘procedures’ that differ from practice
- Lack of testing, monitoring or verification of data provided
- Vendor data stored in disparate locations that requires resource-intensive processes to manage and makes evaluating risk across the enterprise difficult.
- Evaluations that produce a list of issues, but no insight or context with which to prioritize risk in a way that ensures long-term improvements.
Four Steps Forward
Employing industry best practices can help you streamline and simplify third-party vendor management while reducing vulnerabilities, risks and threats to your organization. Following is a proven four-phase approach:
- Establish requirements during procurement and contracting.
- Conduct a thorough onboarding assessment.
- Provide feedback regarding risks and require remediation if applicable.
- Conduct ongoing risk assessment and management.
Breaches cost healthcare organizations nearly $6.5 million on average—over 60% more than other industries.3
To achieve optimal results, it is important to integrate these best practices with a comprehensive risk management platform. The best solutions are those that automate processes to improve resource management, reduce inefficiencies, and allow for easy delegation. It is important to choose a platform that is flexible and scales as your organizational needs change. WaveFire, a leading risk-management technology company, is the answer. WaveFire enhances an organization’s ability to reduce risk, increase security, and maintain regulatory compliance—including third-party vendor compliance. The WaveFire platform streamlines and simplifies risk management through its proven cybersecurity, compliance, and audit solutions. Flexible and scalable, WaveFire supports multiple frameworks including HIPAA, PCI, NIST, GDPR, and many more.
Partnering with third-party vendors is a necessity in today’s complex healthcare environment. Holding those vendors accountable is essential to protecting both your organization and your patients from the devastating impact of security breaches. Partnering with risk-management experts like WaveFire improves data transparency and enhances your ability to assess and mitigate risk in both the short- and long-term.
If you are interested in learning more about our platform or are concerned about third-party risk, we can help. We invite you to contact us at info@wavefire.com or 877-583-2477.
_____________________________________________________________________________________
1 https://www.prnewswire.com/news-releases/breached-patient-records-tripled-in-2018-vs-2017-as-health-data-security-challenges-worsen-300793374.html
2 https://healthitsecurity.com/news/15-million-patient-records-breached-in-2018-hacking-phishing-surges
3 https://newsroom.ibm.com/2019-07-23-IBM-Study-Shows-Data-Breach-Costs-on-the-Rise-Financial-Impact-Felt-for-Years