Covered entities and business associates are increasingly vulnerable to data loss incidents and HIPAA penalties. The Safe Harbor Bill (H.R.7898) can help insulate organizations from HIPAA penalties if they adopt recognized security practices like CMMC.

Covered entities and business associates are increasingly vulnerable to data loss incidents and HIPAA penalties. The Safe Harbor Bill (H.R.7898) can help insulate organizations from HIPAA penalties if they adopt recognized security practices like CMMC.

Healthcare organizations face unique challenges in protecting sensitive data in our digital age. Covered entities and business associates must process more sensitive data than ever before. With increasingly sophisticated cyber threats on the rise, many healthcare organizations worry that despite best efforts, a data loss incident is inevitable. 

The HIPAA Safe Harbor Bill (H.R.7898) recognizes this new reality. The 2021 bill amended the Health Information Technology for Economic and Clinical Health (HITECH) Act to encourage covered entities and business associates to adopt recognized security practices by providing 'safe harbor' protection from penalties and sanctions for data breaches. 

Thanks to H.R.7898, the U.S. Department of Health and Human Services, Office of Civil Rights (HHS-OCR) considers an organization's security posture when determining penalties. If an organization can demonstrate it has been following recognized security practices for 12+ months, it may face significantly reduced penalties.

What Are Recognized Security Practices?

Recognized security practices refer to well-established and widely accepted security measures, procedures, and guidelines for protecting organizations and information against cyber threats. In H.R.7898, recognized security practices are defined as "...the standards, guidelines, best practices, methodologies, procedures, and processes developed under section 2(c)(15) of the National Institute of Standards and Technology [NIST] Act, the approaches promulgated under section 405(d) of the 2015 Cybersecurity Act, and other programs that address cybersecurity and that are developed, recognized, or promulgated through regulations...consistent with the HIPAA Security Rule..." 

In short, if you follow a widely recognized security framework, you should qualify for this consideration. 

Choosing Recognized Security Practices

While there are several choices for recognized security practices, some options are better than others. What constitutes recognized security practices can be confusing or unclear. If you are serious about protecting your organization, using well-recognized and widely accepted practices is best.

It's also important to consider

• How a prospective set of practices align with your organization's existing compliance obligations, policies, and practices

• What security practices or compliance framework might be most beneficial given your organization's verticals

• Whether your prospective security practices have been recently updated or may be due for an overhaul in the next couple of years

One promising set of security practices is the Department of Defense's (DoD) new framework for military contractors, the Cybersecurity Maturity Model Certification (CMMC). Why? 

📊Market Specialization and Opportunities 

It's important to understand that CMMC can apply to covered entities and business associates. When CMMC enforcement goes live, it will apply to healthcare entities under contract with the DoD. If your organization is involved in veteran or military-adjacent healthcare or wants to be (the contracts are lucrative!), CMMC is a particularly important, if not mandatory, investment. 

✅Guaranteed 

CMMC cannot be doubted. Unlike alternative prospective security practices, CMMC offers a formal certification process. CMMC certification proves without a doubt that you are following recognized security requirements, so organizations can be confident that they will stand up to scrutiny.

🥇The Gold Standard 

CMMC represents the best cybersecurity practices available. In cases where a covered entity or business associate can demonstrate CMMC, OCR investigators will likely use their newfound discretion to forgive penalties.

🔮Future-Proof 

Given their thought-leading and change-making status, the DoD's move to CMMC signals that regulations in other industries will change, too. By achieving CMMC, organizations can future-proof their cybersecurity and compliance. Whereas other standards may be due for a significant overhaul, CMMC will be the example they look toward.

🔢Straightforward 

Because CMMC is based on NIST controls, it shares many requirements with the similarly NIST-heavy HIPAA and HITECH. For many healthcare organizations, fulfilling CMMC requirements may require only a few additional steps. 

How to Follow Recognized Security Practices 

Unless your organization doubles as a cybersecurity and compliance firm, seeking outside support is a good idea to ensure you achieve your security goals. That's where XQ Message comes in. As a data security, oversight, and compliance platform, XQ supports HIPAA compliance and can help organizations meet up to 79 of the 110 CMMC requirements required for Level 2 (the level healthcare organizations should target). 

Why XQ?

📋 Compliance +: XQ can help you meet CMMC and HIPAA requirements. Enforce compliance using our Policy Manager's Policy Packs tool, plus implement custom, automated rules to meet your unique needs and ensure you're following best practices beyond regulatory mandates.

⏰Efficiency: Meeting CMMC requirements are intensive and can require advanced technical skills. Instead of wasting months attempting to implement requirements independently, let XQ do it for you. Our solutions are affordable, and using them means you can be up and running compliantly in under a day. 

⏩Future-Proofing on Future-Proofing: Our Zero Trust Data Protection Platform is based on the same Zero Trust Data concept that the DoD is actively investing in today. XQ is the first working Zero Trust Data implementation following the DoD's Zero Trust Strategy design. We're meeting the DoD's standards before they even released the standards! With XQ, organizations will stay compliant through any DoD tweaks to CMMC.

🔬Innovation: Cybersecurity and compliance solutions have become stale. Traditional solutions aren't working against increasingly advanced threats. That's where XQ comes in. Our Zero Trust Data Protection Platform beats traditional cybersecurity solutions on cost, simplicity, ease of use, strength, and effectiveness because we turn conventional cybersecurity on its head. Instead of obsessing over network security, we focus on protecting what matters: the data.

🔏Insecure Network? Irrelevant: XQ transforms risky communications into secure ones. The COVID-19 pandemic taught us about the importance of telehealth. Unfortunately, things like insecure networks or poor patient cyber hygiene can make communicating with patients and sharing protected health information (PHI) risky. XQ has a solution. Using quantum-safe encryption to wrap data packets in individually secured 'envelopes' means data itself is protected, so no matter where it travels, data stays locked down until it reaches its intended recipient.

XQ is ushering in a new era of worry-free sharing and collaboration while supporting the wide-ranging compliance needs of today and tomorrow. Don't wait to safeguard sensitive data. Future-proof your organization today. Connect with us to discover how XQ can solve your unique security and compliance challenges. Email us, book a call, or visit us at HIMSS! We're located in Ingram Micro's Booth, #2279. 

Bonus! How to Prove Your Organization is Following Recognized Security Practices

While you can attempt to collect, organize, and explain documentation proving your organization has been following recognized security practices, it's not wise. Hiring a reputable assessment organization dramatically improves your chances of success. 

If you're looking for a compliance assessor, check out our partner, Captiva!