Some sources say healthcare organizations should perform "gap analysis" to find weak spots in HIPAA compliance....
Is this a good idea? How should we go about performing compliance gap analysis?
It is absolutely a good idea. Security gap analysis is a time-tested compliance technique that is well-suited for organizations subject to HIPAA, PCI DSS and other security and privacy regulations. A gap analysis or assessment basically consists of measuring the performance of IT assets to see if they are meeting the expected performance metrics. A security or compliance gap analysis, therefore, would measure the current compliance efforts of an organization against the stated requirements of a regulatory body or standards group.
Organizations conducting an information security gap analysis should first decide who will perform the assessment. If the assessment is for internal use, it may be appropriate to have internal staff conduct the assessment, if they are qualified to evaluate regulatory compliance. On the other hand, if the assessment will be shared with external stakeholders, the organization may wish to leverage the independence of a third-party audit firm.
The meat of the information security gap analysis is a requirement-by-requirement assessment of the organization's compliance with the HIPAA rules. The assessor should document how the organization complies with each part of the regulation and then identify any gaps that require remediation before the organization is fully compliant. This gap assessment then provides the organization's leadership with a roadmap to full compliance.
Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)
Find out what privacy regulations enterprises should follow
Learn how companies should handle SaaS compliance
Discover who should perform HIPAA and HITECH compliance assessments
Dig Deeper on Security audit, compliance and standards
Related Q&A from Mike Chapple
It's not possible to eradicate the risk of DoS attacks, but there are steps infosec pros can take to reduce their impact. Mike Chapple shares ...continue reading
The HHS OCR ruled that healthcare ransomware attacks are HIPAA violations, so these covered entities need to react according to the HHS's guidance. ...continue reading
HIPAA regulations incorporate NIST guidelines and standards, so do healthcare organizations need to be compliant with both? Expert Mike Chapple ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.