HIPAA Compliance Pre-Audit in Brief

A HIPAA compliance pre-audit can help healthcare providers and business associates, such as IT contractors, billing companies, accounting service providers and others, evaluate PHI protection and get ready for an OCR audit. Healthcare software product companies and medical device manufacturers can benefit from HIPAA compliance assessment to be sure that their products meet HIPAA requirements before they enter the market.

A HIPAA compliance pre-audit may include: Review of established security policies, procedures, and employees’ security awareness; security testing of software and IT infrastructure involved in storing, processing, transmitting or protecting PHI.
Steps of a HIPAA compliance pre-audit: planning; resources preparation (assembling an in-house auditing team and preparing required tools or choosing a vendor to perform the assessment); the auditing process launch and execution.
Auditing team roles: project manager, HIPAA compliance consultant, security testing engineers.

Setup Plan for a HIPAA Compliance Pre-Audit

A comprehensive evaluation of HIPAA compliance may require different activities, depending on the type of healthcare services a company provides, the size of the company and its structural complexity, or (for healthcare technology vendors) the nature and complexity of a product. ScienceSoft lists the generally applicable guidelines on how to strategize, prepare resources for and carry out an efficient HIPAA compliance pre-audit.

1. HIPAA compliance pre-audit planning

Duration: 2-3 weeks

Creating a checklist of security policies and procedures applicable for your company as required by HIPAA. You may need to consider the following administrative, technical and physical security controls aimed to ensure PHI protection:

Administrative safeguards

Security management: PHI risks assessment, risk mitigation and incident response plans.
Security personnel: a security official responsible for developing and implementing security policies and procedures.
Information access management: ensuring against unauthorized or unnecessary use and disclosure of PHI.
Workforce management and training: appropriate authorization and supervision of employees; promoting their understanding of existing security policies and procedures.
Continuous evaluation of security policies and procedures implementation.

Technical safeguards

Access control: user authorization, password management, automatic log-off.
Transmission security: encryption of transferred sensitive health data.
Audit controls: monitoring and logging of all the activities involving PHI.
Integrity controls: prompt detection of security breaches and protective measures against PHI theft or unauthorized modification.

Physical safeguards

Facility access controls: restricted access to the facilities containing PHI.
Workstation and device security measures.

Identifying applications, databases, and network components that contain, transmit or protect PHI.
Listing the staff members and business associates who have access to your company’s PHI.
Estimating financial, time and human resources required for the audit.
Developing a risk mitigation strategy to deal with unintentional data exposure, downtime, lack of access to the IT infrastructure related to the audit activities.

2. Resources preparation for HIPAA compliance pre-audit

ScienceSoft’s experts outline common preparation steps for in-house and outsourced auditing projects.

Duration: up to ~12 weeks if it is necessary to hire and/or train compliance and security testing specialists.

Assembling the auditing team including security testing engineers with different skills. HIPAA compliance auditing of a software product may also require a software architect and source code specialist.
Selecting techniques and tools relevant for the auditing scope: social engineering, black/gray/ white box pentesting, application architecture and code review; application or network vulnerability scanners etc.
Providing the auditing team with the access to the target assets.

Duration: up to ~12 weeks to search, study offers and choose the right vendor.

Looking through the vendor's portfolio and testimonials that can support their profound understanding of HIPAA requirements and specifics of a healthcare IT environment.
Checking the scope of relevant services: the vendor should offer not only HIPAA compliance consulting, but also multiple testing formats to ensure all-around diagnostics of security controls envisaged by HIPAA.
Evaluating the vendor’s approach to auditing documentation. The vendor must consistently record each auditing phase to support audit transparency, precision, completeness and repeatability. The final report should include a clear description of found incompliances, analysis of their risk, and a remediation plan.

3. Launch and execution of HIPAA compliance pre-audit

Duration: up to 10 weeks

To check if a company’s security policies and procedures meet HIPAA requirements, ScienceSoft’s compliance consultants recommend:

Scrutinizing documentation on all security controls and activities related to PHI protection: risk analysis, breach notification, incident management, HIPAA training for employees, previous security testing for vulnerabilities, etc.
Interviewing the staff to understand their security awareness level.

To see if the company’s software and IT infrastructure have security loopholes that can endanger PHI, ScienceSoft recommends:

Running automated vulnerability scanning to find potential entry points to access sensitive health information.
Reviewing the software architecture and source code for vulnerabilities that can endanger PHI protection.
Exploiting vulnerabilities and simulate hackers’ attacks to access PHI.

Best practice: Security testers should try to find out how potential hackers can hide trace of their unauthorized presence in the IT environment. It will help devise measures to avoid a repeated intrusion.

Preparing an audit report that covers:
- HIPAA compliance assessment scope, for example documents on security policies and procedures aimed at PHI protection, components of the IT environment involved in operations with PHI, staff members that have access to PHI.
- Gaps in security policies and procedures or employees' knowledge that can be fraught with PHI exposure.
- Security testing methodology and tools used during auditing, detected vulnerabilities in software and IT infrastructure endangering PHI, their nature, severity and probability of exploitation.
- Corrective measures for all deviations from HIPAA requirements at administrative, technical and physical levels.

Consider Professional Services for Your HIPAA Compliance Pre-Audit

ScienceSoft’s HIPAA compliance consultants and cybersecurity specialists offer their expertise to perform or plan a comprehensive HIPAA compliance pre-audit.

HIPAA compliance assessment planning

Outlining HIPAA requirements applicable for your case.
Determining the auditing scope (the assets and security controls to check).
Defining the auditing steps.
HIPAA compliance pre-audit cost calculation.

Go for planning

HIPAA compliance pre-audit

Defining the assessment scope based on your company’s type, size, structure and IT environment.
Working out an optimal assessment plan.
Evaluating security policies and procedures as well as the required controls.
IT infrastructure and application security to locate and explore vulnerabilities that may endanger PHI security.
A detailed audit report and a roadmap on corrective measures to achieve HIPAA compliance.

Go for pre-audit

Talents Required for HIPAA Compliance Pre-Audit

Project manager

Plans a HIPAA compliance pre-audit, calculates costs and estimates time and human resources needed.
Monitors and coordinates the auditing process.
Ensures smooth communication between the stakeholders and the auditing team.

HIPAA compliance consultant

Defines HIPAA requirements applicable for a specific company.
Reviews security policies and procedures related to PHI protection to detect and document deviations from HIPAA regulations, if any.
Interviews employees to check awareness of HIPAA requirements and IT security measures.
Recommends a remediation plan for the company to become HIPAA-compliant.
Helps prepare or improve documentation on security policies and procedures aimed at PHI breach prevention or remediation (incident management plan, risk assessment report, breach notification plan etc.).

Security testing engineers

Run automated vulnerability scanners on software, networks or devices involve in operations with PHI.
Review software architecture and source code to find the flaws that can undermine PHI security.
Perform white box/gray box/black box penetration testing to find out the most probable ways to steal or modify PHI.
Advise on fixing the detected gaps to protect PHI.

HIPAA Compliance Pre-Audit Sourcing Models

HIPAA compliance self-audit

Pros:

No need to let third parties access your IT environment and sensitive health data.
The auditing team is familiar with your healthcare service/product and activities involving the use of PHI.
Possibility to regularly check HIPAA compliance as your corporate infrastructure grows or changes.

Cons:

The need to build up a qualified auditing team, including security testing engineers knowledgeable about HIPAA compliance requirements.
Heavy expenses on salaries and maintenance.

Third-party HIPAA compliance pre-audit

Pros:

An impartial evaluation.
Expert understanding of complex HIPAA requirements.
Availability of all the necessary talents for an all-around HIPAA compliance assessment.
The vendor takes over responsibility for all stages of the HIPAA compliance pre-audit.

Cons:

Risks associated with sensitive data exposure.
The vendor will need time to understand your internal processes and IT infrastructure.

Compliance manager is in-house; security testing team is completely or partially external

Pros:

You get skilled compliance talents, while preserving sufficient control over the auditing process.

Cons:

Difficulty with finding a knowledgeable in-house compliance manager.

Get HIPAA Compliance Pre-Audit Done by Experts

Combining healthcare expertise and proficiency in security testing, ScienceSoft's experts can conduct HIPAA compliance pre-audit for an all-round check of your PHI protection.

CHECK HIPAA COMPLIANCE

HIPAA Compliance Pre-Audit Tools

ScienceSoft’s experts recommend several vulnerability scanning and pentesting tools that can be efficiently applied in the course of HIPAA compliance auditing.

Best for

Vulnerability scanning of web applications and websites dealing with PHI

Description

Detects over 7,000 web application vulnerabilities, such as XSS, XXE, SSRF, SQL injections, host header injections, etc.
Crawls HTML5 websites and AJAX-heavy client-side SPAs.
Detects more than 50,000 network vulnerabilities when integrated with the OpenVAS network vulnerability scanner.
Performs speedy scanning with few false positives.
Prioritizes and classifies found vulnerabilities.
Native integrations with CI/CD and issue trackers (Atlassian Jira, GitHub, GitLab, Bugzilla, etc.).
User-friendly interface and simple setup.
Out-of-box reports including HIPAA compliance reports.
Supports Windows, Linux and MacOS.

Pricing

Starting from $6,995/website/year

Best for

Web penetration testing

Description

Gartner's Peer Review Customers’ Choice 2020.
Recognized as G2 Leader Winter 2022.
Acts as proxy to intercept traffic and enables man-in-the-middle attacks.
Includes a wide-coverage vulnerability scanner.
Uses external servers to detect hidden vulnerabilities that bypass conventional SAST and DAST tools.
Enables advanced attacks of all types: SQL injections, file path traversal, SSRF, XSS attacks, etc.
Offers an embedded browser providing for immediate access to the full Burp Suite functionality.
Allows creating custom extensions, reports, adjusting scanning and attacking for your particular needs.
Runs on Linux, Windows and MacOS.

Pricing

$399/user/year

Best for

Remote web vulnerability scanning

Description

G2 Leader for Vulnerability Scanner Software.
Supports MacOS, Linux, and Windows.
Detects over 65K of common vulnerabilities (CVEs), including missing patches, outdated software, misconfigurations, absent passwords, DoS vulnerabilities, and more.
Offers plug-ins with new vulnerabilities 24 hours after the vulnerabilities have become known.
Provides scanning templates to streamline vulnerability assessment.
Conducts automated scan analysis for remediation prioritization.
Provides user-friendly navigation and actionable user guidance.

Pricing

$2,790/year

HIPAA Compliance Pre-Audit Costs

The cost of HIPAA compliance pre-audit depends on the following factors:

The auditing scope: the number of documents on PHI protection, the number of employees having access to PHI, the number and complexity of networks and applications involved in operations with PHI, etc.
The complexity of the company’s security policies and procedures, software and IT infrastructure related to PHI.
The diversity and complexity of applied testing types and techniques (automated vulnerability scanning, manual penetration tests, black/gray/white box pentesting, security code review, social engineering, etc.).
The efficiency of the vendor’s HIPAA compliance team (in case of a third-party assessment).
The license costs of scanning and pentesting tools (if these activities are performed in-house).


		Example: Black box network vulnerability assessment of up to 200 IPs as part of HIPAA compliance pre-audit may cost $5,000+

Find Out Your HIPAA Compliance Pre-Audit Cost

ScienceSoft will analyze your HIPAA compliance assessment scope and provide you with an accurate pre-audit budget calculation.

REQUEST MY COST ESTIMATE

About ScienceSoft

ScienceSoft is a global provider of IT consulting, software development, and cybersecurity services headquartered in McKinney, TX. Since 2005, we deliver services for the healthcare industry with a special attention to PHI protection. ISO 9001 and ISO 13485 certifications prove our ability to build mature quality management systems. Being ISO 27001-certified, we guarantee the security of customers’ data entrusted to us. If you need help with evaluating your HIPAA compliance, you are welcome to contact our team.