Strengthening Healthcare Security: A Collaborative Approach with HITRUST and ProviderTrust

Welcome, everyone. Thank you for taking the time to join us. I’m Kat Weldon, marketing coordinator here at ProviderTrust. I will be your host for today’s webinar, strengthening health care security, a collaborative approach between high trust and provider trust. Before we get started, I would like to address a few housekeeping items. If you have attended a ProviderTrust webinar before, you’ll notice that we have a new platform today. You can engage with panelists and a few fellow attendees using the panel on the right side of your screen. While participants are unable to mute, we encourage you to drop any questions into the chat or the q and a section at any time. We’ll do our best to address any of the questions throughout the session and then during the designated q and a at the end. Please note that today’s session is being recorded. The recording and slide deck will be shared in a follow-up email from ProviderTrust afterward. Now I’m excited to introduce today’s presenters, two outstanding industry experts from HITRUST and ProviderTrust, Donna Thiel and Ryan Patrick. Donna Thiel is the chief compliance officer at ProviderTrust. Donna works with compliance officers across the country to strengthen compliance programs, manage government investigations, implement and manage corporate integrity agreements, and prepare for the various regulatory changes that impact health care providers. Donna brings almost thirty years of experience working within health care, including nearly twenty in various compliance and legal roles. As well, we have Ryan Patrick, the vice president of adoption at HITRUST. He offers more than twenty years of experience in security and information technology. His extensive background includes positions specializing in risk assessments aligned with security and compliance framework. And as a retired colonel of the United States Army, Ryan’s discipline and strategy is also further exampled by his academic achievements as he holds a master of strategic studies and an MBA. Now that we’ve met our presenters for today, let’s take a quick look at our agenda. We will begin with an overview of current security risks and trends in health care, then we will dive into the evolving threat landscape, what this means for you and your organization, and how to adapt. We’ll then wrap up with practical takeaways, including best practices for managing third party risk and for planning what’s ahead. At that time, we will also have a designated q and a session to address any remaining questions. At this time, I’ll let Donna take it away, and I hope you all enjoy the session. Good morning. It might be good afternoon for some of you depending on which, coast you’re on. So thank you so much for joining us today. Ryan and I are really excited to chat with you. One of the things that Kat didn’t mention in the introduction is one of the other hats that I get to wear here at ProviderTrust is the chief compliance officer is really managing all of our third party, certifications. So HITRUST is one of those very important certifications that we have here at ProviderTrust. And so Ryan and I are excited to share, kind of from two different angles. Right? The angle of living and breathing and becoming HITRUST certified and then the HITRUST perspective, as well as the importance of that. Plus, we’re gonna weave in some important just industry information as we go along. So let’s get started. So we wanted to start today and just thinking about kind of that, quote, risky state of of health care. Right? I’m assuming everyone that’s sitting on this call today is in health care. As Kat mentioned, she was very kind in saying that I’ve been in health care for thirty years. It may or may not be a Tish longer than that, but, I spent my whole career in in health care. Right? Grew up on the provider side, and now I’ve had the opportunity to be here at ProviderTrust for eight years. So health care is is my sweet spot and and Ryan’s as well. So when we look at these numbers and we think about the things that we’ve seen in twenty twenty four and and many years coming into, into where we sit today in twenty twenty five, Ryan’s gonna go into a bit more detail about the Change Healthcare, most recent ransomware. But you look at that. Right? A hundred and ninety million, beneficiaries that were, impacted by just just the change, ransomware. You look at that number on the top. Those are the, HIPAA, enforcements, the dollars that have been recouped related to, that oversight on, different types of security breaches, which look at that number on the the bottom right, two hundred and seventy six million. Now I might even wonder. Right? That says two hundred and seventy six million and some change. Right? Total number of individuals, whose PHI was exposed during or stolen in twenty twenty four. Considering change was a hundred and ninety million, and and Ryan and I could probably cite a number of other examples, I would wonder if that number is is even low. Or many of us probably have had our same information, impacted by more than an more than just one breach. It’s not just just change or list the other ones that that you wanna think about. And so when I was thinking about this and thinking about why, right, why is is health care the center? And when we’re doing research, and I think all of you can relate. Right? When you’re preparing for a webinar, you you take the time to really dig in and think about some of these statistics. And and for me, it was the why. Why health care? And when I was looking at it, I found it was very interesting. Healthcare is the third most targeted industry for ransomware. Right? There’s been an increase of over thirty two percent from twenty three to twenty four. And one of the interesting stats that I saw is that up to sixty seven percent of health care organizations that are hit by ransomware are paying the ransom. So if you’re a nefarious actor, right, and you’re saying two out of three of these organizations that I’m going after are actually paying the ransomware, Wow. That that in and of itself seems like a a pretty big, reason. But then think about the data that we house. Right? Think about the data, that our organizations have. Right? Patient records are so they’re so full of sensitive information. I was I was researching and reading the average, I don’t even know what what you would say. Right? The cost. Right? How much is it worth for a medical record after they steal this information? How much do they sell it for? And the stat that I saw said anywhere between two hundred and fifty dollars and a thousand dollars for each medical record. Now I did the same research for a credit card. Like, we know. Right? We get the same notices from our credit card companies, and the the the price, the value of a stolen credit card is really ten to twenty five dollars. So think about that. PHI, right, the patient information that’s being stolen is ten times more valuable than, a credit card. So that in and of itself is is another, motivator, I guess. The other thing is you think about the importance of health care. Right? When you think about ransomware, what do they do? They lock out your systems. They encrypt your information. They don’t just steal the information, but in often many cases, they’re preventing you to access your own information. Right? And we know that having access to patient information is time sensitive. Right? We don’t have the ability to say, oh, golly. Let’s just wait for our system to be rebuilt. The patient needs the doctors, the the practitioners. They need that information at the a click of a, you know, a touch of a button or instantly. And so that motivator for the the health systems, right, to pay the ransomware because they need that information back. They need access to their systems. We also think about health care. We are not always the fastest to adopt technology. We don’t necessarily have the resources to have the latest and greatest technology. So many of our systems are legacy systems. Right? They’re older systems. They may not have the best, controls, if you will, in, the systems, and so they may be easier to hack into. So for all of those reasons, right, the payment, the value, and some of the age of the system, I think are good reasons why, the nefarious actors come after us in health care. So I’m gonna turn it over to Ryan. I’m gonna switch slides and let Ryan share a little bit more, but I know he’ll be happy to, elaborate a bit more on what I just kind of laid down as an introduction. Yeah. So thanks, Donna. I, I wanna touch on, you know, the comprehensiveness of a health record for a second because I I you did it justice, but I think we need to scratch a little bit deeper on why it’s, you know, ten times more valuable on the dark web than, say, credit card information. If you look at the type of information in, you know, of record for a credit card, it’s literally just your name, address, maybe the credit card number, or some other related type of information. But when you look at a health record, it’s all of that stuff plus all of your sensitive information that you really don’t want the general public knowing about. And, oh, by the way, it likely contains information about your family members as well. So it’s it’s, you know, taking something like a credit card record and multiplying it significantly let me keep my hands within the window. Multiplying it significantly, in that it can be used in a lot of different ways. So that’s why, you know, I think you’re you see more and more attacks on health care because it’s super, super, super comprehensive, the type of data you can get at. But you really hit the nail on the head, and I I always talk about this, that the very nature of health care is to help people. It’s to help each other. Whereas security, traditionally speaking, wants to, you know, lock things down and inhibit functionality in order to protect systems data, people, what have you. So there’s a natural rub between the the people who are drawn to health care, the providers, and security. And when you look at the full spectrum of the US health care industry, you have really enormous multibillion dollar organizations who have tons of resources, tons of datas, tons of, you know, exposure points all the way down to rural hospitals who have little to no resources. And then you have the one and two doc practices or clinics who have even less resources. So the ability to gain access and exploit these environments, it’s not hard. So when you look at a malicious actor, you know, their their motives are are not to do the really, you know, sexy hacks that are, you know, breaking into the FBI or the NSA or something like that. They’re gonna take the path of least resistance. And right now, unfortunately, health care is the path of least resistance. So I think that’s why we’re seeing it be so pervasive, and it’s not new. This has been going on at least a decade or more from a from a cyber perspective. And until we start to latch on to things that actually matter, when you think about the difference between security and compliance, unfortunately, I don’t think we’re gonna see a lot of change unless we do that. So I digress on that. I just wanted to add that extra flavor because, you know, you you made a lot of great points, but I feel like people need to, you know, look under the hood and really understand the drivers of these actors out there, which will lead me now into the actual slide that I’m supposed to brief. You know, the impact of ransomware has has changed the landscape, not just in health care, but generally speaking, pretty significantly. So I’m not gonna read all of these stats to you. But if if you look at the stats on the left side, there are a ton of attacks happening. There’s a ton of payments happening, and it looks like based on the numbers that health care is more apt to make a payment. And why is that? Well, when life or death is on the line, you’re pretty much gonna do whatever it takes to save lives. So if making net payments is how you make sure that services are restored and you can actually provide quality patient care, then you’re likely gonna do those things. Whereas if you’re in another industry, especially, you know, very large industries like financial services or retail, you may be able to absorb the downtime and the loss of revenue, whereas health care can’t. Health care can absorb the loss of revenue at this point. And if you look at what happened with Change Healthcare last year, it disrupted the entire, and I’m exaggerating to a certain extent, the entire US healthcare system. Because not only were payments not being made to providers or prescriptions not being filled, it became an availability issue. Even though there was data that was siphoned out of change, which is the typical, or the new the new, you know, vector that is added to most ransomware attacks. The fact that for months, changes services to a very large portion of the US health care industry, whether directly or indirectly, was not functional. And it put a lot of organizations in jeopardy of flat out going out of business. And these are health care organizations. These are providers. These are clinics. These are hospitals, health systems who are not able to actually generate revenue. So when you think about the way that HIPAA has kind of focused our attention on the confidentiality of patient information, That doesn’t really work in the world of ransomware because it’s not just a confidentiality issue. If the data is just flat out not available, you know, on the easy side, it’s I may not get payments until this service is back up. For change, it was months. Maybe it’s not as impactful in future events. But on the not so simple side, if that information is not available, you may not, as a provider, be able to provide care to that patient because you do not have their medical history. You do not have their drug allergies. So you’re either gonna slow things down and methodically try to figure out, you know, what their preexisting conditions are, what their allergies may be, so on and so forth, or you may not be able to do much. And if it’s in a life and death situation, that may be, an unfortunate cause for something that we don’t really wanna talk about. And I’m not here to scare anybody, but this is reality in health care. This is why it’s critical infrastructure. So, you know, the fact that people couldn’t fill their prescriptions, the fact that providers couldn’t, you know, secure payments to pay themselves, pay their employees, pay their suppliers, so on and so forth, it became this really big crisis, if you will, in in the health care, system or health care industry last year. So, you know, for me, the biggest takeaway from this slide is, yes, HIPAA is still right now, and I know we’re gonna get into, you know, the the next iteration of HIPAA or the proposed next iteration of HIPAA, but HIPAA’s still right now focusing you on the confidentiality of data. Make sure patient information is not disclosed, but I this is your call to action, at least for this slide. Think about the availability. Think about your critical suppliers. They may be traditionally low risk in your inherent risk model, But if you can’t generate revenue or your business cannot operate without this vendor, that should skyrocket them to being more critical and understand what availability challenges that they may have. So, Donna, I’ll pass it back off to you. Any comments? Yeah. I completely agree. And I think as a provider growing up, right, when I think back about all the training that we did around HIPAA, right, when it first came out, it really was patient rights. Right? How do we protect the information? How do we protect the patient from disclosures? And I think the world has evolved. And as we’re gonna talk about in this slide, right, we’re talking about the proposed rule, the proposed, security rule. And and I think in in another slide, I have some thoughts about the progression. Right? You think about HIPAA came out in two thousand and three when the privacy rule came out, security rule came out in two thousand and five, and here we are in twenty twenty five, the landscape looks a lot different. And so when you look at, these proposed rule, modifications to the HIPAA security rule, right, the removal of addressable elements. Well, is really anything, you know, optional anymore? Right? It’s it’s there’s no such thing as addressable. Right? Everything has to be in place and more than what this rule requires in order for us to truly protect the information, that sensitive information. Right? Enhancing risk assessment. For any of you that follow the, you know, I call it the wall of shame. Right? Where we have to publish if there’s been more than than five hundred folks. Right? And if you watch the the, review, the settlement agreements, right, almost all the time, it feels like it’s about the company failing to do an annual risk assessment, failing to understand their own risks, failing to follow-up on their risks. So it’ll be interesting to see, you know, does enhancing these requirements really impact change, or is it another, you know, written requirement? Talking about vendors. Right? Business associates. Ryan just talked about the importance of understanding who those vendor partners are. Right? So strengthening those business associate relationships. And I would also say, like, is it just the business associates? Are there other third party vendors that you really need to understand where you have connectivity? You might not be sharing protected health information. Right? PHI might not be necessarily so it might not even be a business associate. It may just be a vendor that you have connectivity to for other things that are integrating or getting into your system that could cause you problems greater than just your your business associates. So even though this rule is is focusing obviously on business associates, I would encourage us to look at at more than that. All of these things that we talk about. Right? Mandatory technical controls, encryption, MFA, network. Right? All of those things are are standard practice today for most of our organizations, and, really, this regulation is just kinda catching up. Right? It’s really it’s not state of the art. It’s it’s it’s probably ten years old for, where we are today. Again, incident response contingency planning, workforce security measures. Right? What’s our number one risk? Our human beings. The people in our organization are our highest risks. So when you think about enforce enhancing workforce security, that’s really education and training. Right? It’s really do do our employees, do our team members, do those folks who have access to our information really understand it? So this is what the security rule is proposing. But I think in as we move forward and start thinking about, is this really enough? Right? Is this really sufficient? And, again, if you look at the journey of where we’ve come from two thousand and three of privacy rule, if you think about the last time this regulation was updated, it was in twenty thirteen. Twelve years ago was the last time any regulatory changes were made to HIPAA. Holy Schneckies. Right? What’s happened in the last twelve years? Ryan just showed you some statistics as did I of what happened in twenty twenty four. In twelve years, My whole I could say for my personal career, my career has changed in this twelve years. And what I managed in my organization with fifty thousand employees and the type of data that we have into what’s happening today is is worlds different. So I think this regulation is important. It’s important that it’s changing, but I would say it’s really kind of, a bit behind from from what we we need to do. Ryan, anything you’d wanna share in that vein? Yeah. For sure. And and I whole heart wholeheartedly agree with you. One of the things that if you think about the security rule coming out in two thousand five because even the the updates in twenty thirteen didn’t change the safeguards themselves a whole lot. So they they’re pretty much the same as they were in two thousand five. What didn’t exist in two thousand five? The cloud. The cloud didn’t exist in two thousand five. What else didn’t exist? AI, generative AI, and even different versions of AI, were not as robust as they are today. And if you look at this rule, this proposed rule, there is a glaring gap. There’s an AI is not mentioned in it. And, you know, you’re if you’re not using some form of AI today in your environment, you probably need to look a little bit harder because I bet you you are. I saw a statistic that came out of a McKinley report. So Don’t quote me the exact stats, but follow me directionally. It said something like eighty percent globally organizations have adopted AI in twenty twenty four. But when you look at the fact that Microsoft has got Copilot, AWS, GCP, Adobe, all these other ones have their own version of that, you probable that number probably is a lot higher, and it you probably already have AI in your environment. So when you think about the risks that are inherent with using AI, this rule is not even contemplating that right now. So I agree with you, Donna. This is this is more of a a catch up and raising the bar for organizations that haven’t gotten to this point but need to, but it’s not really elevating the game for a large portion of, the industry. So, you know, we haven’t even talked about the threat landscape, which is a shameless plug for the next slide. If you wanna move forward, Donna, I’ll jump into that. Yeah. So Donna mentioned that HIPAA is nearly thirty years old. Now granted, that’s somewhat of a misnomer, but it’s the the the point is is valid in that if you want Ryan’s personal opinion, you can’t rely on HIPAA to protect you. It is not designed to actually protect you. It’s not nimble enough. It’s not flexible enough. It is not relevant enough even with the proposals that are being done. And let’s pretend they they actually raise the bar moving forward looking ahead. It’s only gonna be good for a certain amount of, certain amount of time. So what do you do when that time is eclipsed and it becomes irrelevant again? Well, you need to look at other mechanisms, other frameworks, other standards, other regulations, maybe not regulations so much because it’s government. It moves really slowly, but standards and frameworks out there that are a bit more nimble and and being updated more often. And, you know, adopt those. I’m gonna put my bias high trust high trust hat on and, you know, use something like high trust, and I’m gonna give you all the reasons why in a future slide, to do so. But, you know, one of the things that I think is missing from the proposed rule for HIPAA and just generally in the industry is there’s no defined assurance model. HIPAA tells you to do risk assessments. And sure there’s, you know, guidelines. But if you are left to your own devices, and I’m using making that statement very generally, who do you have the right training? Do you have the right expertise? Do you have the right experience to interpret the safeguards, interpret all the different technologies within your environments, and make a determination on whether they’re mature enough and capable enough to be operating effectively. I would guess more times than not that we don’t we don’t have that experience, especially when you think about the resource strapped organizations within the health care industry. They don’t have the time, the people, the resources to stay on top of everything that’s happening from a threat perspective, from a technology perspective in order to weigh in effectively on these risk assessments or other types of validated external assessments in order to walk away feeling more comfortable that the controls that are in place in the environment are actually operating and scaling effectively. So I’m gonna pause there because I think I stole a little bit of Donna’s thunder. Donna, I’ll pass pass it back over to you. No worries. I think all like, everything that Ryan is is putting it you know, kinda laying down for us, I I try to absorb from a compliance officer’s seat. Right? And I think about and so what should I do? What should I ask? How can I, support the organization differently? So I think what’s on this slide speaks a little bit to that, right, of thinking about how do I employ techniques to try to manage that threat landscape? How do I, you know, how do I communicate? How do I, how do I just provide assurances that that we’re doing the right thing? Right? I have my my toolbox is the security rule is, you know, pick pick whatever you would like. Right? At ProviderTrust, we do we have SOC HITRUST. You know, we have NCQA. We have lots of things that are good frameworks for us to use, but all of those are just part of the toolkit. I think that’s what’s important, and that’s what what I would highlight from this slide is what can we do or what should we do greater than just what the rule says. So, right, certainly looking at industry certifications as frameworks to help us bolster what the security role guides us to do. And then think about who we’re engaging with. Right? That pre engagement due diligence, I think, is so important. And I I mentioned it in the other slide how the security role is is kind of enhancing business associate relationships. But, again, there’s there’s a lot more vendors out there that you should be talking to and thinking about and putting on your list of high risk vendors and making sure that you understand what they do, what data they have, how they’re in and out of your organization from, an integration. Like Ryan was saying, are they using AI? How are they using AI? Are they protecting your information? Are they taking your information? Right? All of those things, what’s your due diligence around that? Thinking about your risk assessment. You know? Yep. You have to do it annually, but is that enough? Like, what am I doing with the information I’m gathering from the risk assessment? Right? When when OCR comes in, if I I have an issue, right, they’re gonna look at my risk assessment, but then they’re gonna ask me about mitigation. Right? What have I done? Have I protected the organization? I think that’s important. Also attestations. Like, am I reaching out? Like, Ryan and I have had this conversation many times. Right? Provider trust, we are HITRUST certified. We take great pride in that in the work, and we’re gonna talk about that in a little bit. And we want our our clients to come to us and say, we can attest that we’ve done all these things, and here’s our HITRUST certification that says a third party has also validated that we’re doing all of that work. So we really think making sure that your partners are also attesting to the good things that they’re doing to ensure compliance at their level. Right? And then thinking about the industry and the regulatory guidance. Right? As Ryan has pointed out, we’ve talked about this. The regulatory side isn’t keeping up. So what do I have to do in the industry? What’s what’s be what’s out there that I can leverage and make sure that I’m learning and asking the right questions and really staying current in that threat landscape? It changes every day. And so who in your organization, who on your team is really accountable for that? And how do you build that into your risk assessment? Right? How do you build that into your changing due diligence? So this isn’t our last slide of best practices, but I think this is a really good best practice slide to think about managing in a world that regulations are important and that’s a stick, but it’s really not sufficient to protect the information that that is so important. So that’s probably enough for this. And, Ryan, I think the slide that you were thinking was next is probably this slide. It it is. It is. I got a little excited. I apologize. Good. So so we’ve talked about HITRUST and, obviously, a HITRUST guy. So, I wanna I wanna focus your attention on the top statistic, and that is as a former really cool security guy doing cool security stuff now, just the person you see on your screen talking to you. This is the stat that really gets me excited about the work that we’re doing in HITRUST. And what it represents in twenty twenty four, less than one percent of HITRUST certified environments suffered a breach. The exact number is point five nine percent, which is actually down from point six two in twenty twenty two and twenty twenty three. And you may be like, I don’t know. I don’t know. The the the average, you know, breach numbers that I see out there, and they vary, is somewhere between forty and sixty percent of organizations have suffered a breach in the last twelve months, and you guys are telling me that you’re less than one percent. I don’t I don’t believe it. So let me let me tell you why I think this is accurate. And, truthfully, when my compliance team shared the numbers with me, I said, yeah. I don’t believe it either. You need to go rerun the math, and they did. And it still came back exactly the same. So we actually require our customers to report breaches and security incidents to us contractually. It’s in the agreement that they signed with us before they get certified. They have to report that. We also monitor open source information. So if the breach is put out on the wall of shame or if it’s released publicly in the news or what have you, we were looking for that. We also require our external assessor firms because HITRUST doesn’t do any assessments. We actually train and authorize, independent auditors to do the actual validation work prior to submission to us. As a part of that validation work, they are required to check and verify whether there has been a breach in the environment the scoped environment for the assessments, in the recent past. So even if we, you know, missed a little bit, let’s say our margin of error was fifteen percent, which I would argue is probably on the high side, we’re still dramatically lower than the industry averages. And, you know, it begs the question, well, why are we so different? And it really boils down to to two things in my mind. We don’t pick the controls in a vacuum because we think we’re the smartest people on the planet. We actually have the bad actors out there tell us what controls are important. So we are consuming threat data on a really, on a monthly basis, but we’re doing analysis on a quarterly basis of this threat data, mapping it to the MITRE ATT and CK framework, looking at all the TTPs for the different vulnerabilities, and looking at the related mitigation strategies and bouncing that off of our assessments and saying, are we covering all the controls or or are our controls covering all of the vulnerabilities and the threats that are happening in the wild today? And if we identify that we either have an elemental gap within an existing control or we just flat out don’t have a control protecting against this threat that’s happening, we make adjustments to our assessments. So when you look at HIPAA, nearly thirty years old. You look at SOC two, that’s probably close to ten years old. ISO, they their most released twenty seven thousand one’s most recent release is two, twenty twenty two. Everybody’s years behind, and we’re arguably only ninety days behind. So it’s about as near real time as you can get from a relevant controls perspective. You know, we’re actually protecting against a hundred percent of the addressable, TTPs within the MITRE attack framework at any given time. So we’re closing the gaps for these what the attackers are actually using. We bounce that off of our assurance model and our assurance program. As I mentioned, we don’t do any assessments. We train and authorize these independent auditors to go out and do the work. We have several requirements. We have a actually a a a handbook that’s like this thick telling them how to conduct these audits and the way the testing should be done, the way the sampling should be done, and what time period, so on and so forth. So we’re not just leaving it to them and assuming they have the expertise, the time, the education, the what have you to do these assessments right. We’re we’re telling them this is how you need to do these assessments. Once that’s completing, it gets sent to us and we run QA against that assessment. And we do this for every single HITRUST assessment that has been certified. We have run QA on it. And I will tell you we have what I call six plus levels of QA. So if you look at SOC two, if you’re getting a SOC two, you have to sign them. You as the organization being assessed, you have to sign a management attestation letter saying that the audit was done during these times. You provided factual information, so on and so forth. Then the CPA who does the work signs off on the report saying the report is accurate, so on and so forth. It kind of ends there. It’s all very decentralized. It’s up to the expertise and experience of that CPA firm. But we have those two levels too. So we require the management team of the entity being assessed to do, or to sign off that the assessment was done ethically with integrity. There wasn’t any thing nefarious happening. We also require an independent auditor to do the work. We don’t stop there. We actually require an engagement sponsor on the executive team at that audit firm to review the assessment. Once they do the review, we actually have a quality professional that has been trained and authorized by us review the assessments. All of them sign off on that assessment before it’s ever submitted to us. Once they sign off on it, they hit submit. We run automation automated checks against that assessment. Up to two hundred and fifty checks looking for quality issues. If we find quality issues, we kick the assessment back. And in twenty twenty four, we had a twenty one point five percent rejection rates on assessments that are submitted to us. I mean, we’re kicking them back because there was issues before we even looked at them. Nobody else is doing that type of work. Alright. So let’s say it gets through the the automated checks. We have a QA analyst that picks it up. They run quality assurance against it. It takes a couple weeks working with the external assessor, the auditor, and the entity being assessed. If everything is on the up and up there, our our compliance team comes in and does a review. And what the clients team really is doing is checking our QA analyst, but they’re digging into the assessment as well. If the assessment is clean, that’s when we certify it. But that’s not where our quality efforts end. And I’m not gonna talk about escalated QA because it’s a whole different process, but understand that if we identify issues in our our normal QA process, we take it out of the QA process and put it into this other process to identify whether the Assurant program was not followed, but I digress. Our quality team actually on a quarterly basis, this is where the plus of the six plus part comes in, runs an audit of our, quality assurance analysts, making sure that they did their job as it’s defined in our handbook. I can tell you on average in twenty twenty four that ninety five percent of the time our quality analysts did their job without issue. The last step, and I know I’m getting long winded, so I’m gonna I’m gonna stop with this, is we actually have a quality advisory committee at our board level that is watching the entire quality program, occasionally may sample reports to make sure that our quality assurance team and our compliance team are doing their job. So we have this multilayered approach to quality with feedback loops at every place. So when you look at the I mentioned escalated queue. I guess I will jump into this for a second. In twenty twenty two, when we first started this, we had eleven percent escalated QA process, meaning eleven percent of all assessments went into escalated QA. In twenty twenty four, it was just over one percent. You may be wondering, oh, well, you know, shouldn’t it stay high? It means, you know, you’re really giving them the the ringer from a quality perspective, and I would argue that it’s the opposite. We’ve actually put in a feedback loop to our entire community to do assessments better, which has increased the quality of assessments before it ever came to us. So when you look at the relevancy, the controls, and the rigor that we put these assessments through, when you when you get HITRUST certified, a lot of people throw parties, but the consumers of those reports, you you can feel comfortable and confident that what’s in that environment is actually scaled. It’s actually mature. It’s actually capable and operating effectively. So I’m gonna pause there, Donna. You let me talk too long. Any comments? No. If it’s okay, I’m gonna just go to the next slide, though, because I think this is really our journey, which I think fits in to be able to to respond to the things that that you just shared. So provider trust is HITRUST certified, and after just I just wrote down twenty one percent were kicked back. Like, I feel really good. We didn’t have that. So, you know, I’m so proud of the work that our team did and then hearing the stats, just makes me even more proud of that experience. But I just wanted to share, Atish, a little bit about our our journey. So we started in the third quarter of twenty twenty one and did our first readiness assessment. And our goal was that in the fourth quarter or the third quarter of twenty three, we would be HITRUST certified. And we we had a a a great partner, and they were really good at, kind of the policy procedure part of HITRUST and educating us around that. And as as Ryan said, right, we started with creating what’s called an object, which is answering all those questions that says, this is what provider trust does. This is the data that we have. This is the way that we, manage the data. These are the type of systems. These are the volumes of data. All those questions. And we had three hundred and twenty controls that we had to manage in order to become certified. So we hired the first, audit partner, and we had a really great relationship with them. But my technical team, my my engineers, my tech technical team really just didn’t gel with this organization, with this auditor. They just really they they just weren’t techie enough, I guess. They were great for me on the policy side, but just not quite right. And so we made the business decision to go and find a new partner. And I will tell you, at first, you’re like, oh my gosh. This is gonna throw off our schedule. We’re not gonna be certified in time. We’re gonna have to start over. But it was worth it. It was worth every minute that we took to make that right decision because we found a new partner, and that partner had all the technical acumen that my team needed, right, to sit in a room and say, I can read this control. I can see what it says, but, gosh, I just can’t connect the dots with what my what my system does compared to what this control is. And so when I think about HITRUST and the the value proposition is, yes, it’s a framework. Yes, it has all these controls. Yes, it’s got just rigor behind the auditing. It also is an educational opportunity for our team. Like, really understanding what good implementation means is different than being able to write it down. Like, being able to test it, the evidence you see in, the slide. Right? We provided over five hundred pieces of evidence for three hundred and twenty controls. And my guess is that number is really low because it’s just it compounds. And one control doesn’t equal one piece of evidence. There are many elements within that that you have to provide. Like, I don’t even know how to describe the evidence. It’s it’s you have to prove that everything you say you do in your policy and procedure that you’re actually doing. And the controls are daily, weekly, monthly, quarterly, annual. Right? They’re not just a a one and done review your policy once a year, but it’s like, I have to check these logs every single day. Oh, it’s not just saying I checked them, but, like, in my company, a provider trust. Right? We have Jira tickets that are created that say, hey. Did you check the log? Did you see anything? Was there an anomaly? If there was an anomaly, you need what’s the remediation action for that anomaly? Right? That’s creating the evidence of our compliance with all of these controls. So when I look across it, right, we are housing we are managing over twelve million records today for our clients. That’s a big number that we’re being entrusted to care for. So HITRUST for us was a really big decision as Ryan’s talking about it. Like, it’s not a small undertaking. It takes everyone in your organization. I will say with the changes that we made, we were certified in February of twenty twenty four. So we were about a quarter off of what our original goal was. But by being able to stop and make the right decision and find the right partner, we were so much better prepared. And we are now entering our next certification window. And as Ryan said, everything’s changing. So we were in version nine dot something. We are now in version eleven, and it looks a whole lot different. More than half of our controls are different than they were the first time. So it’s not like it’s a rinse and repeat. Right? We are starting over with creating new evidence and updating policies, creating new policies. Right? It’s an ever changing process. Right? You get certified for us. It was two years, but we still have an interim audit every year. So I’m about to cough from my cold, so I’m gonna stop and let Ryan take us to the next one. Yeah. And I I just wanna address one thing that you you you mentioned, Donna, around, you know, as versions change for HITRUST, you know, the controls in those assessments could possibly change. And we actually get a lot of pushback and, dare I say, hate mail on how we were, quote, unquote, shifting the goal post. But if you think about my very long winded soapbox, commentary around, you know, the relevancy of controls mattering, I mean, that’s really what it boils down to is we’re updating the framework at least twice a year. That’s separate from changing the potential controls within the assessments every ninety days. So that’s why the controls may look a little bit different is because, guess what, the threat landscape has probably changed to a certain extent. So we’re we’re being nimble. We’re being flexible. We’re being agile in order to protect our customers through the the forcing function that is HITRUST at this point, to make sure they have the right controls in place. So, I mean, if you think about what HITRUST is, generally speaking, it’s designed to build trust between two parties, And that is the very essence of third party risk management. And what I think we want you to to walk away with is understanding, you know, how HITRUST plays a role in third party risk management because and we didn’t we didn’t jump on the SOC two bashing train in this session, but there is a lot to be desired with SOC two, in my opinion, from a TPRM perspective just based on the very nature of how a SOC two is conducted. But, you know, HITRUST is evolving. It’s innovating every single day, so you can feel comfortable that if you’re accepting HITRUST or you’re getting HITRUST certified or, in some cases, both, that you’re on the path and continually evolving along with the threat landscape and the malicious actors out there. But think strategically about how you as a vendor or you as someone managing vendors, you know, what’s the impact that you have? If you’re the vendor and you’re providing some kind of critical service, whether they’re sensitive data or not, that may be really detrimental to your customer. And if you are unavailable, if your services or what have you is unavailable, that is gonna have a cascading effect. And I’m I’m gonna I’m gonna make them one comment, and I’m gonna jump to the next one. But, you know, everybody always every security professional since I’ve been in this business twenty plus years has said, oh, if you have a breach, there’s gonna be reputational harm, and nobody’s gonna wanna do business with you. That may happen for a couple months, but they come back. It really did not have the impact that all of the the the rainy clouds that our security professionals had made it sound like for for decades. But I will tell you that if you are unavailable, if your services or the data or whatever whatever it is your product is unavailable, your customers will leave because they’re reliant on that, and they will go find an alternative to make sure that they can continue to operate in what whatever capacity it is. So think about how critical you are and how critical vendors that you may have from a supplier perspective are to your own business operations and start to build plans around that. I guess I’ll pause there. Donna, you know, any other comments on this slide that you really wanna highlight before we go to questions? Yeah. I just think, I was at the health care compliance institute last week, and someone was presenting on the just specifically about the change health care, ransomware. But when I was looking at my notes the other day, the last thing she had said was it’s how your vendors respond to a breach that shows the quality of that vendor. So I think, Ryan, to your point, back years ago, right, I think the concept was, oh my gosh. We’ll lose everyone if we have a breach. And I I do think now, you know, it’s about the relationship and the partnership that you have with your vendors. And I think at ProviderTrust, our name says trust for a reason. Right? We believe the most important thing is building that relationship with our clients and letting them hoping that they trust us with the data they have and the services that we provide. And so I do think it is the landscape is changing and the statistic that you shared about the volume of of breaches. Right? No one wants that to happen, but it’s how we respond and how we protect the information that’s so important. And so I do think strategically in in this slide is asking yourself about those relationships and asking yourself, should I do something differently or ask different questions is really important. You’re sitting on my seat. Right? Like, what does that look and and and feel like? So, that’s probably all I would like to share. And, yes, the last slide is our q and a, and I apologize for my coughing spree. Back there, I saw one question that was posed to, to me, I suspect, which was how can provider oh, that’s not the one I was gonna pick. But maybe go to the other one first, Kat, and then we’ll come back to this one. The other question that I saw, were what were some of the biggest lessons provider trust learned during HITRUST, and would we do anything differently? I think we just learned that, we were doing really good things, but we probably didn’t have them documented to the level that HITRUST would expect, and we weren’t able to prove them. Right? It’s just that we we could speak to them, and we were confident that we were doing them. Our outcomes showed that we were doing them, but they weren’t at a level that would allow us to pass this, you know, rigorous certification. And so I think we’ve really upped our game from being able to confidently share with our clients what we’re doing. And I so I think that’s our lesson learned is, like, you do good work. And back in my clinical you know, back back in the day, right, if it’s not written, it’s not done. Right? You you could say patient care was provided. But if when someone came to do a chart audit, it wasn’t in the chart, it it didn’t matter. Right? You couldn’t prove that that you provided that care. And so I think that’s the same thing here. And so I think the lesson that we learned, I’m not sure that it would make me do anything differently, but it does improve the process in which we document and do things today. Right? We we do better than, than we did in the past for sure when it comes to just evidence and being able to really, really stand firm and confident that we’re doing what we say we do. Yeah. I’ll add a comment based on your comments, Donna. You know, one of the reasons why I came to work at HITRUST is because I’ve been using the framework for the better part of ten years prior to coming to HITRUST, and it’s I saw the benefit that it provided organizations to your point. You know, some organizations had did a lot of things ad hoc, which when you’re small, that’s, in some cases, how you survive because you don’t have the resources to to apply more formal processes. But the reason why HITRUST focuses so much on policy and procedure, generally speaking, is because people leave. Organizations evolve. There could be layoffs. And if you don’t have these things documented, how do you pick up the pieces after that event or whatever it is? And what I found was HITRUST became this forcing function to formalize these processes and make them institutional. So if there was a change, for whatever reason, someone else could pick it up and continue to move along, and there’s instead of just a huge spike of issues, maybe there’s just a small bump as there’s a a little bit of a learning curve. That’s where a lot of organizations fall down as they don’t have that institutional knowledge and the the the formalization of policies and procedures to help them in the event of an issue. I think that’s great. I totally agree. So, Kat, you can go back to the first question now. Sorry. I had just the other one in in my in my mind. So the other question is, how can provider trust and HITRUST help with streamlining compliance practices? Ryan and I have chatted about this over the course of preparing for this webinar today. And one of the things at ProviderTrust, like, we are really proud of the work that we’ve done to become HITRUST certified, and I think Ryan’s done a great job today of really, you know, sharing the rigor that goes into doing that. And so what we see is, each organization really putting the time and energy into creating their own questionnaires and their own portals. And a lot of work that in my mind is if an organization is HITRUST certified, leverage that. Right? If you’re talking about streamlining compliance practices, right, there’s well, I should be careful, but I don’t think there’s any compliance department across any organization that would say they are overstaffed, that they have extra folks sitting around doing nothing. Right? And so when you’re trying to think about how can I be more efficient? What can I do? Right? Provider trust at a core, we talk about provider eligibility and exclusion monitoring, license verification. Right? We think we’re streamlining compliance by the service that we’re providing. And then you layer on now the security reviews and looking at the security frameworks. I would love, you know, the way that HITRUST and provider trust partners together to demonstrate compliance, to give confidence to our partners that we are doing what we say we do, like, that to me would be a just a simple way to to reduce some overhead and think differently about how to ask those questions and to stay more current. Right? Ryan has shared that pro the HITRUST is every quarter reviewing their con you know, the landscape. And so if you think about that, does your team really have the time to go in and change those questions on a frequent basis? Probably not. It’s really hard. And so that’s just top of mind for me. Right? Love for you to share your thoughts. But to me, just leveraging the, the framework and the certification in a different more efficient way would be one to answer that I would have. Yeah. I think you hit the nail on the head with the example that you use around the the threat analysis that we’re doing. Only really enormous well resourced organizations have I seen doing that type of work, and I’m not exactly sure they’re doing it to the frequency that we’re doing it. So for most organizations, they either are not gonna do it at all or they have the option to leverage services or resources or tools that’s being kind of built into something else. Right? So there’s hidden value. If you’re pursuing HITRUST, you’re getting that threat analysis done for you. Why not take advantage of it? From a from a streamlining compliance perspective, I mean, HITRUST was kinda born out of the compliance world. It was it was born to satisfy or or to tell health care organizations how to comply with HIPAA security rule and, by extension, the privacy rule to a certain extent. We’ve we’ve kinda moved more center to the marriage between compliance and security, probably leaning a little more towards the security side now, but we’re mapped to sixty one other standards, regulations, or frameworks. So if you’re in a multiregulatory or multi reporting environment, meaning you’ve gotta satisfy HIPAA, you’ve gotta satisfy PCI, you’ve gotta satisfy, I don’t know, FedRAMP or GovRAMP or ISO or what have you. We’re mapped to all of those things so you can use the work that you’ve done against HITRUST and then just report out instead of having to do unique assessments for each one. I don’t know about you, Donna. I feel really confident in what I’m about to say, but tell me if I’m wrong. You know, you probably don’t have the staff to do unique audits for every single thing that you should be doing, not to mention the stuff that you are doing. Whereas if you’re able to do one assessment, use all the evidence to apply to other assessments, then you get to get back to the the really hard work of the compliance work that you’re doing now as opposed to being in this, like, audit loop constantly. Audit it. Audit it. Audit it. It doesn’t make any sense for these redundant assessments to be done. So to me, that’s a big takeaway for from a HITRUST perspective on how to streamline compliance and just audits in general. Completely agree. Well, with that, it’s eleven fifty eight, and we need to wrap up. So on behalf of Brian and I, truly thank you for joining us today. We hope we provided some insights into, this particular topic, and we hope who knows? Maybe Ryan and I’ll do it an another one on another day, but we hope you enjoyed today and found some value to it. We look forward to hosting another webinar soon. So we hope you all have a great day. Thanks for everything. Thanks.