HITRUST CSF Meaningful use risk assessment

Meaningful Use Privacy and Security Risk Assessment:

What it is and How to Approach it

Leveraging the CSF and CSF Assurance Program

June 2011

Introduction

HITRUST continues to receive questions on performing a risk assessment for meaningful use. This document is being released as guidance to provide the healthcare industry with a clear process to satisfy the privacy and security requirements of meaningful use.

This guidance is intended for security and compliance professionals of healthcare providers and is divided into three sections: 1. Quick start guide to conducting a risk assessment for Stage 1 meaningful use

security and privacy requirements2. Background on meaningful use and the Stage 1 security and privacy

requirements for conducting a risk assessment3. The recommended approach for conducting an efficient and effective risk

assessment leveraging the CSF Assurance program

© 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.1

Conducting your Meaningful Use Risk Assessment

Five steps to getting started with the CSF Assurance Program:1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your

meaningful use risk assessment.*2. Identify your scope

– Details on slides 15 and 403. Perform an assessment using the Common Health Information Protection

Questionnaire (CHIP) and Compliance Worksheet.**– Details on slides 16-20 and 42-43

4. Submit your CHIP to HITRUST5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP

– Details on slides 23-24 and 46-486. Register and attest for meaningful use Stage 1

– Details on slides 26-30

2 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.

*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visit http://www.hitrustalliance.net/assurance/**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g., HIPAA Security Rule)

http://www.hitrustalliance.net/selfassessment/�

https://www.cms.gov/EHRIncentivePrograms/20_RegistrationandAttestation.asp�

http://www.cms.gov/EHRIncentivePrograms/32_Attestation.asp�

http://www.hitrustalliance.net/assurance/�


Meaningful Use Stage 1 Requirements for Privacy and Security


What is Meaningful Use?

• The use of a certified EHR [system/technology] in [a] meaningful way:– For the electronic exchange of health information to improve the quality of

health care, and– To submit clinical quality and other measures (to federal and state agencies)

• Stage 1 requirements (2011 and 2012)– For eligible hospitals and critical access hospitals

• 25 MU objectives – 15 core objectives that are required

» Includes the protection of electronic health information – 5 of 10 menu set objectives that are optional

– For eligible professionals• 24 MU objectives

– 14 core objectives that are required» Includes the protection of electronic health information

– 5 of 10 menu set objectives that are optional

© 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.

Source: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asp

4

Why Pursue Meaningful Use?

• Medicare and Medicaid provide financial incentives for the meaningful use of certified EHR technology to achieve health and efficiency goals.

• By [implementing] and meaningfully using an EHR system, providers:– Receive financial incentives (complex formula)

• Hospitals (Health System = Hospital)– Base of $2 million—up to 1,149 acute inpatient discharges for prior

12 months– Maximum of $6,370,200—$200 for each additional discharge up to

23,000• Critical Care Hospitals will be paid “on reasonable costs”• Eligible Providers

– Between $24K and $44K based on first calendar year submitted– Avoid reductions in Medicare and Medicaid payments beyond 2015– Reap benefits beyond financial incentives (e.g., reduction in errors, availability

of records/data, reminders and alerts, clinical decision support, and e-prescribing/refill automation)


Source: https://www.cms.gov/EHRIncentivePrograms/30_Meaningful_Use.asphttp://journal.ahima.org/2010/08/26/meaningful-use%E2%80%94incentive-payments-and-program-requirements

5

What are the Security & Privacy Requirements?

• Stage 1 MU Measure– Protect [ePHI] created or maintained by the certified EHR technology

through the implementation of appropriate technical capabilities• Stage 1 MU Objective

– As part of [an overall] risk management process• Conduct or review a security risk analysis [per the HIPAA Security

Rule] (45 CFR 164.308(a)(1))• Implement security updates as necessary• Correct identified security deficiencies

• Stage 1 MU Attestation– Organizations must conduct a risk analysis at least once prior to the end

of the EHR reporting period with supporting documentation and updates implemented as necessary

– You’re attesting to the government, which implies civil and/or criminal penalties for false statements … so take attestation very seriously!


Source: http://www.cms.gov/EHRIncentivePrograms/Downloads/14HC-ProtectElectronicHealthInformation.pdf

6

What is a Security Risk Analysis?

• The Security Rule describes a “risk analysis” as “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information [ePHI]”

• Conducting a risk analysis is the first step in identifying and implementing safeguards that comply with and carry out the standards and implementation specifications in the Security Rule

• Additionally, the Security Rule requires entities to implement reasonable and appropriate security measures to protect against reasonably anticipated threats or hazards to the security or integrity of ePHI

• However the Security Rule does not prescribe a specific risk analysis methodology …


Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf

7

What are the Elements of a Risk Analysis?

• Scope the Analysis– Include the potential risks and vulnerabilities to the confidentiality, availability and

integrity of all ePHI that an organization creates, receives, maintains, or transmits (45 CFR § 164.306(a))

• Collect Data– Identify where ePHI is stored, received, maintained or transmitted (See 45 CFR §§

164.308(a)(1)(ii)(A) and 164.316(b)(1))• Identify and Document Potential Threats and Vulnerabilities

– Identify and document reasonably anticipated threats to ePHI (See 45 CFR §§164.308(a)(1)(ii)(A) and 164.316(b)(1)(ii))

• Assess Current Security Measures– Assess and document the security measures an entity uses to safeguard ePHI

(See 45 CFR §§ 164.306(b)(1), 164.308(a)(1)(ii)(A) and 164.316(b)(1))– In other words, conduct an information security risk assessment


Source: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/radraftguidance.pdf

8

Guide to Meaningful Use Risk Assessments

1. Demonstrate reasonable practicesA. Select a sound risk assessment methodology B. Align controls with industry standards and best practices

2. Be efficient—you’ll need resources for remediation effortsA. Meaningful use focuses on your certified EHR not the whole environmentB. Use sampling techniques in your environment for similar implementationsC. Don’t forget physician practices—they are an entry point into your

environment

3. Take remediation seriouslyA. Develop prioritized corrective action plans, but be careful not to over-

commit or under-commit resources, as this could expose you to cost overruns or non-compliance with regulatory requirements

B. Actively manage remediation as a portfolio of projects and initiatives


Demonstrate Reasonable Practices


Select a Sound Risk Assessment Methodology

• Identify an information security risk assessment approach that– Scopes (tailors) the assessment– Prepares for the assessment– Reports assessment results– Tracks and measures progress (corrective actions)

• If you use a third party to assist with or conduct the assessment, ensure their “proprietary” methodology incorporates the above-listed items

• Identify standard templates for documenting results and developing corrective action plans

• Many organizations confuse a technical evaluation of controls with a risk assessment, however, these are different concepts and different requirements under HIPAA


Fundamental Risk Assessment Approach

1. Determine Scope

- Applications, interfaces,

infrastructure

2. Prepare for Assessment

- Focus on high risk areas

- Identify individuals responsible for key

control areas- Conduct top down enterprise control

analysis- Do not get stuck in the

weeds

3. Report

- Report of findings

- Remediation plan

4. Track and

Measure Progress

- Establish a PM over the remediation

- Track progress against industry

benchmarks- Focus on measures


Align Control Decisions with Industry Standards

• Seek an integrated information security and compliance framework

• Choose a controls-based approach that is– Comprehensive– Prescriptive– Certifiable

• Define control practices tailored for use in a healthcare environment


ISO 27001/2

PCI

COBIT

NIST800-53

HIPAASecurity

HITECH Act

Mngfl.Use

StateReqs.

Be Efficient


Focus on the Certified EHR System

• Within scope of a review– All servers that run any module of the certified EHR– The wide area and local networks supporting the EHR– Information/data exchange interfaces with other systems– Workstations, laptops or portable media used to access the EHR– Vendors that support or have access to data in the EHR– People, process, policies and standards that are related to the control of

the above components• Potentially out of scope

– Third party applications that do not interface with the EHR (for example, payroll system would not be included in scope)

– Network environments that are isolated from the wide area network or the network connected to the EHR


Testing

• Testing of controls to identify risks may include one or all of the following components:– Interview of key personnel responsible for security, IT and key business

processes– Review of documentation related to the security practices of the

organization and systems– Technical testing of application, system and hardware configurations


Example Interviews

• Types of roles to interview:– Web application manager– Internal audit– Security assurance manager (risk management, business continuity

management, vulnerability management, training and awareness, security policies)

– Monitoring and response manager– Server engineering– Desktop engineering– Human resources– Access and identity management– Application developer– Operations/office manager– Legal counsel


Example Documents to Review (i)

• Asset inventory with risk classification• Network diagram• Organization chart• Business associate agreement template• Risk assessment program

– Application assessment questionnaires– Sample web application assessments– Sample network vulnerability assessments– Sample attack and penetration report

• Project/engagement hierarchy• System configuration checklists


Example Documents to Review (ii)

• Business continuity management program– Business impact analysis templates– Business continuity plan template– Disaster recovery plan template– Sample business continuity and disaster recovery plans

• Sample security awareness and training materials• Policies and standards framework

– Policy and standards third party review report• Incident monitoring and response program and associated procedures• Security council charter


Use Sampling Techniques Where Appropriate

• General rule of thumb– Use sampling when:

• Environment is under the same management control• Departments/facilities/systems are subject to the same policies and procedures• Portions of hybrid enterprise/local environments are under enterprise control

– Assess everything if sample indicates excessive variability• Multi-facility systems

– Scope is directly impacted by the level of standardization• Highly standardized with enterprise level controls

– Select a random sample of like facilities to assess risks (e.g., assess a sample of large acute care, smaller acute care and of outpatient facilities)

• Little standardization – Select a sample of facilities to assess any enterprise wide or centrally

managed controls (e.g., assess how effectively the enterprise wide patch management function is operating at a sample of facilities)

– Assess non-standard controls at every facility (e.g., if facilities contract and manage data disposal independently, then assess this process at every facility)


Assist Physician Practices

• Physician practices: – Introduce significant vulnerabilities into an EHR system of a hospital or health

system– Generally do not have the expertise or resources to conduct a risk assessment

• To assist:– Physician practices that run on a hospital’s EHR and are subject to hospital policies

• Leverage hospital assessment for any controls under direct control of the hospital (e.g., the patching and configuration of the EHR servers)

• Select a sample of practices to assess how effectively hospital policies are implemented (e.g., clear desk policy, password management policies)

– Physician practices that run on a hospital’s EHR, but aren’t subject to hospital policies

• Leverage hospital assessment for any controls under direct control of the hospital (e.g., the patching and configuration of the EHR servers)

• For each practice, assess controls under the management of the physician practice (e.g., security policies, workstation security)


Take Remediation Seriously


Develop Sound Corrective Action Plans

• Develop a methodology for the development of corrective action plans (CAPs) … what the federal government refers to as “Plans of Action and Milestones”– Integrate CAP development into existing processes where possible

• Project management• Ticketing systems (or other workflow management)• Change control

– Automate with a governance, risk and compliance (GRC) system/tool when possible

• Obtain or develop training materials for control owners and other stakeholders (e.g., management) to understand and implement the CAP methodology

• Train your control owners and other stakeholders


Actively Manage Remediation

• HIPAA (in general) and meaningful use (in particular) requires the remediation of identified security deficiencies

– It’s sufficient for Stage 1 meaningful use to develop formal corrective action plans– However, there is an expectation that these corrective actions will be taken– Failure to take reasonable and appropriate measures to remediate deficiencies

would be a violation of the HIPAA Security Rule and could make an organization subject to federal and state civil and criminal penalties for making false statements

• Use project management principles and techniques to actively manage remediation activities as a single portfolio

– Management should formally approve all corrective action plans– Remediation activities should be actively monitored and CAPs updated accordingly– CAP status should be reported to senior management on a regular and timely basis

(along with other security risk metrics), such as:• Number of CAPs developed and approved as a percentage of identified

deficiencies• CAP progress such as percentage on-time or behind schedule sorted by risk• Number of CAPs remediated over time as a percentage of all CAPs actively

managed24 © 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.

Additional Information:Attestation of Meaningful Use


Attestation … How to get the money

• Medicare hospitals’ EPs must attest, through “secure mechanism approved by CMS,” that they have “satisfied the required objectives and associated measures” of §495.6

• Calendar years 2011 and after (no provision for demonstration), except that EPs using certified EHR need not attest until 2012 (42 CFR §§ 495.8; 495.210)

• Medicaid providers must attest:“This is to certify that the foregoing information is true, accurate, and complete. I understand that Medicaid EHR incentive payments submitted under this provider number will be from Federal funds, and that any falsification, or concealment of a material fact may be prosecuted under Federal and State laws.” (42 CFR §§ 495.368)


Attestation … Associated Risks (i)

• Comment: “A commenter indicated that attestation is an insufficient means to hold providers accountable for the expenditure of public funds and to protect against fraud and abuse.” (Federal Register Vol. 75, No. 144, p. 44324)

• Response: “We likewise are concerned with the potential fraud and abuse. However, Congress for the HITECH Act specifically authorized submission of information as to meaningful use through attestation. CMS is developing an audit strategy to ameliorate and address the risk of fraud and abuse.” (Ibid.)

• CMS (Medicare) and states may “review an EP, eligible hospital or CAH’s demonstration of meaningful use.” (42 CFR § 495.8)

• States required to “annually collect and verify information regarding the efforts to adopt, implement, or upgrade certified EHR technology and the meaningful use of said technology before making any payments to providers.” (42 CFR §495.366)


Attestation … Associated Risks (ii)

• States are required to ensure the qualifications of the providers who request Medicaid EHR incentive payments– Detect and take corrective action for improper payments to providers– Refer suspected cases of fraud and abuse to Medicaid Fraud Control Unit

(42 CFR § 495.368)• HITECH incentives audits• HIPAA compliance investigations• Security breach investigations• Federal/state false claims act penalties• Whistleblower (qui tam) lawsuits• Federal/state program disqualification• Criminal/civil fraud actions


Attestation … Manage the Risks

• Risk analysis is a process, not a product• Follow HIPAA “flexible factors” and “reasonable and appropriate” standards in

determining updates and corrections• Show due diligence in risk identification and update and correction

implementation– Use appropriate professional expertise– Incorporate “reasonable practice” information from industry, professional

communities – Strongly consider the use of outside expertise


Attestation … Perform “Due Diligence”

• Make sure attesting officer is properly informed about risks, updates, corrections, etc. – Create and retain supporting documentation file– In any field where officer does not have appropriate expertise, ensure s/he

is briefed and provided with supporting documentation from appropriate experts

– Good “business judgment” is the attesting officer’s best friend• Show your work!

– Document risk analysis process and findings– Document implementation of updates and corrections– Providers must retain “documentation supporting their demonstration of

meaningful use for 6 years” after attestation• Note HIPAA has same document retention period


Source: John R. Christiansen, Esq., Christiansen IT Law

30

Meaningful Use Privacy and Security Risk Assessment: Leveraging the HITRUST CSF Assurance Program


Guide to Meaningful Use Risk Assessments

1. Demonstrate reasonable practicesA. Select a sound risk assessment methodology B. Align control decisions with industry standards/practices

2. Be efficient—you’ll need resources for remediationA. Meaningful use focuses on your certified EHR

not the whole environmentA. Use sampling techniques in your environment for similar implementationsB. Assist physician practices—they are an entry point into your environment

3. Take remediation seriouslyA. Develop sound corrective action plans but be careful not to over-commit

or under-commit resources, as this could expose you to cost overruns or non-compliance with regulatory requirements

B. Actively manage remediation as a portfolio of projects and initiatives

32

HITRUST Common Security

Framework

HITRUST CSF Assurance

HITRUST CSF Assurance


Demonstrate Reasonable Practices


Select a Sound Risk Assessment Methodology

• HITRUST risk areas• Based upon analysis

of breach data • Significantly simplified

for organizations • HITRUST Common Security Framework

• Reasonable practice


The CSF Assurance assessment is based on NIST and ISO standards for evaluating risk

Likelihood Impact Risk

Risk ControlsResidual

Risk

34

High Risks for Healthcare Organizations*

• Insecure and/or unauthorized removable/transportable media and laptops (internal and external movements)

• Insecure and/or unauthorized external electronic transmissions of covered information

• Insecure and/or unauthorized remote access by internal and third-party personnel• Insider snooping and data theft• Malicious code and inconsistent implementation and update of prevention software• Inadequate and irregular information security awareness for the entire workforce• Lack of consistent network isolation between internal and external domains• Insecure and/or unauthorized implementation of wireless technology • Lack of consistent service provider, third-party and product support for information

security• Insecure web development and applications• Ineffective password management and protection• Ineffective disposal of system assets

*Based on loss and breach data analyzed by HITRUST© 2011 HITRUST LLC, Frisco, TX. All Rights Reserved.35

Overview of CSF Assurance Risk Assessments

• Referenced by Office of Civil Rights in risk assessment guidancehttp://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidance.pdf

• Designed to cost-effectively gather the information about security controls needed to appropriately understand and mitigate risk

• Leverages defined, reasonable controls in the HITRUST CSF– The most broadly adopted security control framework in the healthcare

industry• Streamlines risk determination analysis by prioritizing areas based on analysis

for breach data for the healthcare industry• Provides formal and credible report for internal and external reporting• Utilizes benchmarking data • Provides recommendations for remediation


http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidance.pdf�

http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/rafinalguidance.pdf�

CSF Assurance Assessment Approach

1.Determine Scope

- Applications, interfaces,

infrastructure

- HITRUST Scoping Template

2. Prepare for Assessment

- Focus on high risk areas- Identify individuals responsible

for key control areas- Conduct top down enterprise

control analysis- Do not get stuck in the weeds

- HITRUST High Risk List- HITRUST CHIP Questionnaire

3. Report

- Report of findings and remediation plan

- HITRUST CSF Validated Report

- Corrective Action Plan Template

4. Track and

Measure Progress

- Track progress against industry

benchmarks- Focus on measures

- HITRUST CSF Validated Report


Align Control Decisions with Industry Standards, Regulations and Best Practices

• Healthcare-specific security initiative

• Openly available framework• Comprehensive requirements

– Focused on high risk controls• Integrated control set• Prescriptive and certifiable• Value-added services

– Industry-reviewed control practices

– Vendor product certification– “Trusted broker” third–party

assurance


HITRUST CSF

Be Efficient


Focus on the Certified EHR System

• HITRUST CSF assessments are broken out into two types of assessment– Organizational: assesses the general information security controls that

may impact the confidentiality, integrity or availability of ePHI– System: assess the administrative, technical and physical controls specific

to the implementation of a certified EHR technology• Each type of assessment is further scoped (tailored) based on very specific

factors related to risk and an entity’s ability to implement appropriate and reasonable security measures– Organizational: includes type of organization, size, and revenue – System: includes average number of transactions and external interfaces

• Assessments are further focused on high risk areas– Based on HITRUST’s analysis of breach data and feedback from over 200

healthcare and security experienced professionals– Focus on these risks first, adjust for your environment, and expand as

dollars and resources allow (i.e., follow the 80/20 rule)


Key Components of the CSF Assurance Program

• Standardized tools and processes– Questionnaire

• Focus assurance dollars to efficiently assess risk exposure• Measured approach based on risk and compliance requirements• Ability to escalate assurance level based on risk

– Worksheet for reporting compliance– Report that is consistently interpreted across the industry

• Cost effective and rigorous assurance– Multiple assurance options based on risk

• Self reporting• Remote testing—conducted by a CSF Assessor; includes interviews with

key personnel and review of policies, procedures and other relevant documentation

• On-site assessment—conducted by a CSF Assessor; includes remote testing and the review of system configurations and physical walkthroughs

– Quality control processes to ensure consistent quality/output from CSF Assessors


Questionnaire

Common Healthcare Information Protection (CHIP) Questionnaire:• Innovative approach to assess the

quality of information protection practices in an efficient manner

• Focus on the security capabilities and outcomes of an organization

• Leverages key measures and supports benchmarking

• Structured according to the high-risk areas identified in the CSF, which reflect the controls required to mitigate the most common sources of breaches for the industry


Use Sampling Techniques Where Appropriate

• HITRUST CSF Assurance supports sampling when– Practices/locations are governed by one set of policies and procedures– Environments and administrative/technology controls are similar

• There must be a basis for concluding the practices/locations are similar– Some dissimilarity may support sub-grouping and sampling within sub-groups

• HITRUST recommended sample sizes

• Sampling should be random but other methods could be supported• Inconsistent results from the sample imply …

– All practices/locations may need to be addressed / assessed• Exceptions/deviations should be investigated to determine root cause(s)• If isolated instance or human error, may be able to select a replacement• Decision and rationale should be documented as part of the assessment

43

Number of Practices in Population/Group Minimum Number of Practices at Which to Perform Security Risk Assessments

>50 10%, Maximum of 25 Practices 15-50 Minimum of 5/Use Judgment <15 Minimum of 3/All Practices


Assist Physician Practices

• HITRUST recognizes the constraints and limitations of physician practices and other small healthcare organizations

44

• Small Organization Health Information Assurance Questionnaire (SOHIA)

– Simplified questionnaire • Intended for self assessment• Assesses general organizational

security for high risk factors– Automated technical assessment

• Simple agent-based tool downloaded from vendor Web site

• Assessment of current vulnerabilities

• Re-assessment provides proof of corrective action


Take Remediation Seriously


• Meaningful use only requires a focus on the certified EHR, but….

• Organizations are expected to routinely perform a risk analysis under HIPAA and manage/implement corrective actions

• If a HIPAA risk assessment was not performed in over two years, consider a broader risk assessment to stay aligned with HIPAA requirements

• HITRUST includes a HIPAA Compliance Scorecard produced for each HIPAA security requirement

• Ratings and benchmarks for high risk controls can help organizations prioritize remediation efforts


Develop a Sound Corrective Action Plan

46

Benchmark Data PR

ISM

A SC

OR

E

Organization

Benchmark Orgs


Higher PriorityCAPs

Lower PriorityCAPs

47

Actively Manage Remediation

• HITRUST CSF Validated and Certified provide a standard assessment report, compliance scorecard and corrective action plans

• Remediation of security deficiencies is required to maintain CSF Validated status– No gaps with prioritized requirements (controls) are allowed with CSF

Certified status

48

HITRUST Common Security Framework CSF Assurance Toolkit 2010 / v1.0 Corrective Action Plan [TEMPLATE]

The weakness identifier will be used to track and correlate weaknesses that are ongoing throughout quarterly submissions within the organization. A rule of thumb is to use an abbreviated system name, the quarter, the year, and a unique number.

Ex. SYSX_3_2009_1

Weaknesses represent any program or system-level information security vulnerabil ity that poses an unacceptable risk of compromising confidentiality, integrity or availabil ity of information.

Ex. 1—Granting, transfer and termination procedures for user access are not established

Related HITRUST CSF Control Specification for the identified weakness.

Ex. 01.b User Registration

A POC is the organization, department or title of the position within the organization that is directly responsible for mitigating the weakness.

Ex. System X Director of IT Security

Resources required include the funding (denoted in dollars) or man-hours necessary for mitigating a weakness. The type of funding (current, new or reallocated) should be noted.

Ex. 120 hours, current staff

Completion dates should be set based on a realistic estimate of amount of time it wil l take to collect the resources for the corrective action and implement/test the corrective action.

Ex. 8/31/2009

Milestones with completion dates outline the specific high-level steps to be executed in mitigating the weakness and the estimated completion date for each step.

Ex. Develop user registration procedures for granting, transferring, and terminating access, 8/1/2009Submit to System X Administrator for review and input, 8/15/2009

Changes to milestones indicate the new estimated future date of a milestone’s completion if the original date is not met.

Ex. None noted to-date

Scheduled Completion Date

Milestones with Completion Dates Changes to MilestonesOrganizational Point of Contact (PoC)

Resources Required

Instructions

Use this spreadsheet to document the corrective action plan to remediate any findings resulting from an assessment under the CSF Assurance Program.

Weakness Identifier Weakness Description HITRUST CSF Control Reference(s)


Conducting your Meaningful Use Risk Assessment

Five steps to getting started with the CSF Assurance Program:1. Visit http://www.hitrustalliance.net/selfassessment/ for performing your

meaningful use risk assessment.*2. Identify your scope

– Details on slides 15 and 403. Perform an assessment using the Common Health Information Protection

Questionnaire (CHIP) and Compliance Worksheet.**– Details on slides 16-20 and 42-43

4. Submit your CHIP to HITRUST5. Obtain a HITRUST CSF Validated Report with benchmarking data and CAP

– Details on slides 23-24 and 46-486. Register and attest for meaningful use Stage 1

– Details on slides 26-30


*For other assurance options, including remote and on-site assessments via a third party CSF Assessor, please visit http://www.hitrustalliance.net/assurance/**A Compliance Worksheet is required for assessments conducted by a CSF Assessor or when a compliance scorecard is requested (e.g., HIPAA Security Rule)

http://www.hitrustalliance.net/selfassessment/�

https://www.cms.gov/EHRIncentivePrograms/20_RegistrationandAttestation.asp�

http://www.cms.gov/EHRIncentivePrograms/32_Attestation.asp�



For more information on the CSF Assurance Program visit:www.HITRUSTAlliance.net/assurance

For a list of HITRUST CSF Assessors visit:www.HITRUSTAlliance.net/Assessors_List.pdf

HITRUST Central professional subscribers, can contact customer support for questions:[email protected]

For More Information:


http://www.hitrustalliance.net/assurance�

http://www.hitrustalliance.net/Assessors_List.pdf�

mailto:[email protected]?subject=Question on MU Presentation�