Compliance with the HIPAA Security Rule
Auditors are beginning to move beyond the application layer and demanding actual data security
The HIPAA Security Rule establishes national standards to protect individuals' medical records and other personal health information (PHI). It applies to health plans, health care clearinghouses, and health care providers. The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting PHI. Auditors have become more sophisticated; they are moving beyond application level safeguards and demanding to see security applied to the actual data stores. As healthcare organizations have embraced cloud technologies for scale and efficiency it has presented new compliance reporting challenges. The Security Rule still applies to all data stores - whether they are located on premises or in the cloud:
Protect against threats
Identify and protect against anticipated threats to the security or integrity of the information
Prevent improper use
Protect against reasonably anticipated impermissible uses or disclosures
Workforce compliance
Ensure that the proper rights and privileges are applied and enforced for end-usersImperva Data Security Fabric framework for data audit protection
Imperva DSF streamlines data-related compliance processes for assigning policy controls, enforcing separation of duties, retaining audit records, archiving, and reporting by removing the manual labor and providing easy access through interactive tools. Tasks that formerly required days to complete can be executed in minutes, saving time, shortening audit cycles, and significantly reducing compliance overhead costs.
Regulatory compliance framework mapped to Imperva Data Security Fabric
Identify
Identify and locate all “Individually identifiable health information”
DSF Data Discovery & Classification
Discover ungoverned data, classify all data, and assess vulnerabilities
Assess vulnerabilities
Maintain safeguards to prevent unauthorized use or disclosure of PHI
DSF Data Risk Analytics
Identify and report data access anomalies and unauthorized behavior
Set controls
Implement policies that allow only authorized persons to access PHI
DSF Data Access Control
Set policies and continuously monitor who is accessing sensitive data
Audit & secure
Implement mechanism to examine and report on systems containing PHI
DSF Data Activity Monitoring
Gain a clear actionable picture of compliance and security status
Measure & report
Demonstrate consistent protection and policy enforcement to regulators
DSF Templatized Reports
On-demand compliance reports for PCI, HITECH, and HIPAA
The new healthcare compliance imperative: protect data at the source
Healthcare organizations' complex IT environments demand new data security requirements to protect data at the source. You need to rely on a unified data-centric platform that provides the broadest coverage across a broad range of data repositories - on-premises data stores, geographically distributed systems, and cloud/multi-cloud/hybrid-cloud deployments - to coordinate policies, monitoring and enforcement to eliminate any gaps that could leave data stores vulnerable to attack.
-
EMR systems
-
DBaaS
-
On-premises data
-
Files
-
Data warehouse
Imperva works with leading EMR systems
Imperva provides audit and compliance capabilities beneath the application layer to secure the underlying database.
-
![AWS]()
AWS
-
![Google cloud]()
Google Cloud
-
![Azure]()
Azure
-
![Oracle]()
Oracle
-
![Alibaba cloud]()
Alibaba Cloud
-
![IBM]()
IBM
Sensitive data is protected and compliance is covered
With every minute, files containing sensitive data are steadily generated throughout your organization. Sensitive, regulated data piles up fast. Healthcare organizations are challenged to identify who owns their file data, which users have access rights, and who is actually using the data. These core capabilities are critical to delivering security and managing file data efficiently day-to-day. Imperva lets you confidently protect data in SaaS stores, on-premises databases, and cloud repositories, proving to auditors, clients, and other stakeholders that tight controls are in place and regulations are being fully met.
