“I Passed My Compliance Audit; Now What?”

It’s that time again—time for your compliance audit. Depending on your business, it might be an annual audit from a government or regulatory entity, or it may be requested by someone with whom you’re about to do business—a prospective vendor, partner or client.

What’s involved in this audit? And if you pass, does that mean you’re good to go? What’s the next step?

What Is a Compliance Audit?

A compliance audit is a set of questions designed to make sure that you are complying with industry or federal regulations. Most often, these are related to security of information. The type of information varies, but the ultimate goal is the same: making sure that your organization is taking the appropriate steps to ensure the safety of the data that has been entrusted to you.

Audits across different industries ask different questions. A healthcare compliance audit will be looking for HIPAA metrics—steps taken to safeguard protected health information (PHI). Brokers are subject to FINRA compliance audits to ensure security in the financial industry, and organizations that contract with the government must comply with NIST requirements for cybersecurity.

Compliance audits average between 100-200 questions, most of which are highly technical and are best answered by your IT team or resource. It’s not a black-and-white pass/fail scenario, though. Since audits may vary not only by industry, but even from company to company, not every question will apply to your business. For example, a healthcare organization may send a HIPAA compliance audit to a potential vendor, but since the vendor doesn’t handle any PHI, many of the questions won’t apply. This doesn’t mean that the two can’t do business together; rather, it supports an informed discussion about their partnership.

If I Passed, That Means I’m Secure, Right?

Not exactly. As Anthony, one of our FIT engineers, explains, it’s just a first step. Compliance audits are concerned with different aspects of your business and environment, but not EVERY aspect. Some areas of your network are not included, but could still pose a vulnerability in your security.

Plus, most audit questions are not a simple pass/fail; you may have passed, but with the equivalent of a C. Think of your compliance audit as a report card—an assessment of where you’re at, and where you can improve. Once you identify those areas, what do you do about them?

Next Steps

Your compliance audit helps you develop a TBP, or Technology Business Plan, for what adjustments or improvements your IT environment needs over the next 3-24 months. Areas that barely passed or didn’t pass will be the primary areas of focus for your IT team, and can spur projects or other resolutions to help strengthen and streamline your network.

Since the main focus of compliance audits is security, take a good look at the cybersecurity measures you have in place. New threats emerge every day, so it takes a proactive approach and constant vigilance to counter attacks and defend against new vulnerabilities and exploits.

At FIT Solutions, we are your go-to IT resource. We complete compliance audits for you and make recommendations based on the results. We also help prepare your environment to meet and repel cyberattacks. Give us a call today at 888-339-5694 or contact [email protected] to see what elite IT service is like.

Windows 7 End-of-Life (EOL): How to Maintain HIPAA Compliance

You may soon be facing a HIPAA compliance headache on the workstations in your healthcare facility. Microsoft support for Windows 7 and Windows Server 2008 ends on January 14, 2020. 

No more security patches will be issued after that date. This puts those operating systems at odds with the HIPAA administrative safeguards, which include the specification for “protection from malicious software,” specifically “procedures for guarding against, detecting, and reporting malicious software.”

The end of support means that workstations running those operating systems will be unpatched against new exploits, leaving them highly vulnerable, and therefore, out of HIPAA compliance.

If you are still running those older operating systems, you’re not alone. Many companies still have Windows 2008 servers and Windows 7 workstations in their environments. While these operating systems are ten years old and newer systems are certainly better, organizations keep using them. They are very stable and continue to do their jobs well. But the longer you hang onto them, the greater the risk to your organization.

First, let’s talk about the risks, and then how to alleviate them without having to purchase all-new systems at once.

Lessons from Past Compliance Audits

After a data breach occurs, history shows that regulators conduct a thorough audit of the affected organization’s entire environment. They look at everything. Although the breach was caused by an employee walking out with a thumb drive that was lost or stolen, every other instance of non-compliance that the auditors uncover is subject to a fine, even if it had nothing to do with the breach. Organizations that have been found using Windows products that were past their end-of-life — such as Windows XP — have been fined for that in the past. Undoubtedly, Windows 7 and Server 2008 will be no exception.

Considering the Alternatives

Under the language of the HIPAA rule, specifications are listed as either required or addressable. “Protection from malicious software” is an addressable specification. That gives organizations a bit of wiggle room. Complying with an addressable specification involves evaluating the risk, considering the measures to mitigate it, coming up with a reasonable alternative that is equivalent, and documenting it. (That’s the short version; here’s the official source on how to meet an addressable specification.)

Let’s say you find it impossible or at least extremely cost-prohibitive to replace all of your out-of-compliance operating systems by January 14. You could address the HIPAA specification by updating a set number of systems every month between now and the end of 2020, until all have been updated. In the meantime, you implement an Endpoint Detection and Response (EDR) monitoring system to keep an eye on the unpatchable systems, as well as use encryption on the systems that hold personal health information (PHI).

Hopefully, you have already performed this sort of analysis across all of the HIPAA specifications as part of your overall compliance effort. HIPAA requires you to perform a risk analysis, have a risk management plan, and document them both. Those are the first documents an examiner will want to see.

At FIT Solutions, we can advise you on all of the aspects of IT that impact your ability to comply with HIPAA. That includes helping you with your risk management and risk assessment plans and documentation, as well as assisting with your Windows 7 and Windows Server 2008 end-of-life planning.

Call us today at 888-339-5694.

Get in touch.

Fill out the form and our team will get
back to you as soon as we can!