Q
Get started Bring yourself up to speed with our introductory content.

Is information security gap analysis important for HIPAA compliance?

Security gap analysis is a strong, reliable technique for enterprises looking to assure HIPAA compliance. Expert Mike Chapple explains how to perform the analysis.

Some sources say healthcare organizations should perform "gap analysis" to find weak spots in HIPAA compliance....

Is this a good idea? How should we go about performing compliance gap analysis?

It is absolutely a good idea. Security gap analysis is a time-tested compliance technique that is well-suited for organizations subject to HIPAA, PCI DSS and other security and privacy regulations. A gap analysis or assessment basically consists of measuring the performance of IT assets to see if they are meeting the expected performance metrics. A security or compliance gap analysis, therefore, would measure the current compliance efforts of an organization against the stated requirements of a regulatory body or standards group.

Organizations conducting an information security gap analysis should first decide who will perform the assessment. If the assessment is for internal use, it may be appropriate to have internal staff conduct the assessment, if they are qualified to evaluate regulatory compliance. On the other hand, if the assessment will be shared with external stakeholders, the organization may wish to leverage the independence of a third-party audit firm.

The meat of the information security gap analysis is a requirement-by-requirement assessment of the organization's compliance with the HIPAA rules. The assessor should document how the organization complies with each part of the regulation and then identify any gaps that require remediation before the organization is fully compliant. This gap assessment then provides the organization's leadership with a roadmap to full compliance.

Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)

Next Steps

Find out what privacy regulations enterprises should follow

Learn how companies should handle SaaS compliance

Discover who should perform HIPAA and HITECH compliance assessments

This was last published in March 2016

Dig Deeper on Security audit, compliance and standards

PRO+

Content

Find more PRO+ content and other member only offers, here.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Join the conversation

1 comment

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

This really is a necessity for any organization subject to HIPAA rules. Each rule needs to be evaluated, and research done to make sure that the requirement is being met in all cases. 
Cancel

-ADS BY GOOGLE

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close