A healthcare security expert says HIPAA compliance starts with multifactor authentication on cloud identities and VPNs, then phase out VPNs entirely. Use the Plan-Do-Study-Act cycle and non-punitive reviews to find gaps and improve continuously, and follow security benchmarks you revisit regularly.
So, turning the conversation to what do we need to know? Like, you've served in healthcare, cyber, IT over many years. If you were a stakeholder, if you were a healthcare business executive or a security team right now, what are the things that you're highlighting that are most important?
I'd really focus on the fundamentals. Is there multifactor? Is there a culture of continuous improvement? And what I've seen is organizations that do the Plan-Do-Study-Act, are part of Joint Commission or part of that non-punitive environment that, you know, there are some configuration changes, issues here and there, and room for improvement, they fare better. So I would recommend on the fundamentals, make sure that your cloud identity is protected via multifactor. Take a look at those VPNs, make sure those VPNs have MFA, or maybe even phase out the VPNs. And for that, but you're going to see that the fundamentals and the benchmarks of recommendation, follow them and then constantly revisit them for continuing improvement.
