Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

5 Reasons to Go Beyond HIPAA Compliance

With the next 12 months promising to bring "especially aggressive punishment" of violations under the Health Insurance Portability and Accountability Act (HIPAA), in addition to an influx of fresh audits, it's no wonder that health care organizations are thinking more and more about getting compliant.

But before you exclusively switch into check-off-the-box mode, here are five reasons why covered entities and their business associates should first be inspired to impart a deeper focus on security, instead of solely readying themselves for a compliance audit.

Breaches are costly for reasons other than non-compliance:

Ponemon Institute's annual "2014 Cost of a Data Breach Study" found that the average cost to a breached company reached $3.5 million, a 15 percent rise over 2013. The study found that hits to reputation and a loss of customer loyalty drained corporate coffers the most. Specific to health care, while the U.S. Department of Health and Human Services is pledging increased HIPAA fines, corrective action rulings have far outweighed instances of financial penalties.

You'll better understand - and protect - your data:

If you first have a complete understanding of your business' data lifecycle before trying to get compliant, you can create effective policies to control and protect the health information with which HIPAA is concerned. It may seem overwhelming at first, but a systematic approach that breaks the process down into manageable units will help. This will both reduce risk and enable you to be confident that your business is prepared for an audit for when that day comes.

Security invites compliance:

There's a saying that compliance is merely a snapshot in time. While compliance typically isn't won or lost in seconds or minutes, it certainly is difficult to maintain over time without having a proper foundation in place. Focusing instead on mitigating risks and following fundamental security practices will typically lead to an environment that will be harder pressed to lose compliance.

You'll satisfy other compliance mandates in the process:

All federal regulations and industry requirements that relate to protecting data and preventing cyber attacks are different, of course. But in many ways, they share similar guiding principles. Chances are that if you establish a strong security baseline first, compliance will follow suit - and you won't be forced to devote time and resources and toss huge sums of money at every compliance initiative, just so an auditor can give you the green light.

HIPAA is merely the ground floor:

Often compliance rules only speak to organizations implementing basic security controls. But in today's sophisticated threat landscape, where traditional controls often fail, the need for more advanced security is essential, especially in the health care industry, which faces unique security challenges. Companies must turn to technologies such as web security gateways, web application firewalls, network access control, and SIEMs - and services like penetration testing and threat intelligence - to ensure they are keeping up with skilled saboteurs.

Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More