Part II: Heed lessons from high-dollar Security Rule settlement

Why This Topic Matters

It helps organizations understand the kinds of governance, documentation, monitoring, and training practices that can affect security compliance and third-party risk management in healthcare settings.

Article Sections

1. Policy and procedure updates

   Discusses maintaining and periodically reviewing organizational policies and procedures in response to changing regulations and threats. It also addresses compliance coordination, communication, and use of technology to support policy management.

2. Vendor and contractor relationships

   Covers due diligence for outside relationships, including oversight practices, contractual planning, and ongoing monitoring of vendor compliance. The section also addresses how organizations may evaluate third-party security posture and related controls.

3. Incident response and audit controls

   Reviews broad incident response planning, logging, audit practices, and access control considerations. It also touches on security monitoring tools and organizational safeguards for protected health information.

4. Training never ends

   Focuses on employee training and continuing education as part of an ongoing compliance program. It mentions interactive training formats used to reinforce awareness and adherence.