THE IT&S 2015 ANNUAL REPORT

REPORT AFTER REPORT from the FBI, the Secret Service, and
other government agencies indicated that healthcare companies
were being maliciously, relentlessly targeted in 2015. In fact,
the FBI revealed that, on the black market, a medical record is
worth ten times the value of a credit card. Behind the scenes
at HCA, though, we stood strong in defense against outside
threats. Information Protection worked with every hospital
division, Parallon, Sarah Cannon, Physician Services Group, and
HCA International to strengthen each organization’s information
protection program.
Our 2015 accomplishments adhere to the Framework for
Improving Critical Infrastructure Cybersecurity, released by
the National Institute of Standards and Technology (NIST). This
framework is a nationally recognized set of industry standards
and best practices for managing cybersecurity risks and
establishes a big picture structure for our enterprise Information
Protection program. The framework allowed us to focus on the
following specific areas in 2015.
THE BIG PICTURE: TO PROTECT AND SERVE
Every day HCA’s sensitive data is targeted for financial gain and
other malicious purposes. The Information Protection team
works with all HCA employees to protect our patients, our
people, and our business.
Identification of Our Assets
and Our Risks
Understanding what information we need to protect and what
risks our organization faces are foundational activities for the
Information Protection team. This understanding enables us to
prioritize efforts and resources, making risk-based decisions
consistent with business needs.
Key accomplishments in 2015 included:
• FORMALIZING THE STRATEGY
AND RISK MANAGEMENT
TEAM IN INFORMATION
PROTECTION TO FOCUS
ON RISK MANAGEMENT
STRATEGY FOR THE
ENTERPRISE
• MATURING THE
INFORMATION PROTECTION
DATA GOVERNANCE COUNCIL
AND FACILITY SECURITY
COMMITTEES, WHICH ARE
DESIGNED TO FACILITATE
RISK-BASED DECISIONS AND
INCLUDE KEY STAKEHOLDERS
FROM LEADERSHIP, CLINICAL,
FINANCIAL, LEGAL, HUMAN
RESOURCES, AND IT&S
• REFRESHING PHYSICAL,
ADMINISTRATIVE, AND
TECHNICAL ASSESSMENTS
FOR ALL HOSPITALS AND
AMBULATORY SURGERY
CENTERS; DOCUMENTING
RISKS; AND DEVELOPING
CORRECTIVE ACTION PLANS
• CREATING HIPAA SECURITY
RISK ANALYSIS AND RISK
MANAGEMENT DOCUMENTS
FOR EACH FACILITY TO
PROVIDE A CONSOLIDATED
VIEW OF THE HOSPITAL’S
APPROACH TO SECURITY
RISK ANALYSIS AND RISK
MANAGEMENT
78
79