Screen Reader Mode Icon

Question Title

* 1. Enter your email (I will send you a report of all your responses):

Question Title

* 2. What type of organization are you looking to evaluate? Select as many that apply.

This 10-question survey is designed to give you a quick 5-minute assessment of your high-level information security risk at your organization. Reminder: This is not a complete HIPAA-based information security risk assessment as most information security frameworks have some 100-600 controls that complete the full assessment.

This high-level assessment is based on my 30 years of experience in healthcare and as an operational healthcare CIO/CISO/CTO, responsible for creating and maintaining Information Security Management Systems (ISMS) primarily in the federal, not-for-profit, and startup domains. I have been on the receiving end of developing an ISMS and then certifying that program for over 15 years with ZERO non-conformities (the highest achievement you can receive). I am a Certified Information Security Manager (CISM) and have been an evaluator for HITRUST and DirectTrust, where I assisted over a dozen companies in developing and then achieving their certifications.

This is a "big rocks" risk assessment of your Information Security Management System (ISMS) program (or lack thereof) to help you determine whether you're overly exposed to unnecessary risk of a data breach and the avoidable damage that breach could cause to your operations.

Question Title

* 3. Do you have an appointed and properly trained Chief Privacy Officer, separate and apart from an appointed and properly trained Chief Security Officer?

Question Title

* 4. Does your organization have an established Information Security Management System (ISMS) to address all the federal and state mandates that ensure the confidentiality, integrity, and availability of sensitive data? And are you reviewing and updating annually, as well as requiring staff to acknowledge these policies and procedures annually?

Question Title

* 5. Does your organization use an industry best-practice framework, such as SOC, ISO, NIST, or HITRUST, to base its ISMS and establish appropriate security controls?

Question Title

* 6. Has your organization identified all sensitive data (e.g., personally identifiable information (PII)) that is federally mandated to be protected by such regulations as HIPAA, GDPR, CCPA, and PCI?

Question Title

* 7. Has your organization established an information security incident response team that has well-established protocols on how to respond to an incident and report any breach to the appropriate authorities (e.g., law enforcement, Office of Civil Rights, patients, etc.)?

(TIP: This incident response team is a control that is typically required in any of the aforementioned security frameworks.)

Question Title

* 8. Has your organization identified all assets and personnel that come into contact with sensitive data (e.g., HR, clinical, and IT staff; servers; devices)?

TIP: You need an inventory of all "actors/assets" involved in processing sensitive data and to demonstrate you are protecting devices or training staff on the proper use of those assets.

Question Title

* 9. Has your organization conducted a Risk Assessment (RA) and Business Impact Assessment (BIA) against all of the actors/assets handling sensitive data that are used to inform your Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP)?

TIP: HIPAA mandates that all entities, covered or business associate, are required to conduct an annual risk assessment. And don't forget that if you're using outsourced platforms like AWS, Google Cloud, or any other third-party as part of your infrastructure ... It is your responsibility to evaluate their compliance with your established ISMS!

Question Title

* 10. Has your organization used a third-party audit firm to assess compliance with federally mandated regulations? For example, achieved SOC 2 or ISO 27001 certification?

Question Title

* 11. Has your organization used a third-party company to conduct a vulnerability and penetration test (VAPT) of your network and associated assets that are used to process sensitive data?

Question Title

* 12. Does your organization use a SaaS platform like Vanta, Drata, Sprinto to establish and maintain its ISMS program?

Thank you for taking the time to respond ... That's it, you've answered all the questions! If you answered NO to more than half of these questions, I would consider your business operations to be at a HIGH RISK of adverse consequences in the event of a security incident, such as a breach of Protected Health Information (PHI) or other Personally Identifiable Information (PII). If you provided your email, I will send you a copy of all responses submitted.
0 of 12 answered
 

T