Is information security gap analysis important for HIPAA compliance?

Some sources say healthcare organizations should perform "gap analysis" to find weak spots in HIPAA compliance. Is this a good idea? How should we go about performing compliance gap analysis?

It is absolutely a good idea. Security gap analysis is a time-tested compliance technique that is well-suited for organizations subject to HIPAA, PCI DSS and other security and privacy regulations. A gap analysis or assessment basically consists of measuring the performance of IT assets to see if they are meeting the expected performance metrics. A security or compliance gap analysis, therefore, would measure the current compliance efforts of an organization against the stated requirements of a regulatory body or standards group.

Organizations conducting an information security gap analysis should first decide who will perform the assessment. If the assessment is for internal use, it may be appropriate to have internal staff conduct the assessment, if they are qualified to evaluate regulatory compliance. On the other hand, if the assessment will be shared with external stakeholders, the organization may wish to leverage the independence of a third-party audit firm.

The meat of the information security gap analysis is a requirement-by-requirement assessment of the organization's compliance with the HIPAA rules. The assessor should document how the organization complies with each part of the regulation and then identify any gaps that require remediation before the organization is fully compliant. This gap assessment then provides the organization's leadership with a roadmap to full compliance.

Ask the Expert:
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today. (All questions are anonymous.)