THE IT&S 2015 ANNUAL REPORT

Response to and Recovery from
Potential Threats and Incidents
Responding to potential threats in a timely manner is vital to
limit or contain the impact of incidents, and the Information
Protection team made some impressive strides this past year in
preparing for danger.
Key accomplishments in 2015 included:
Protecting Our
Patients, Our Staff,
and Our Name
Paul Connelly, VP and Chief Information Security Officer, visited
divisions in 2015 to paint the very complex and textured
picture of information protection for division and hospital
leaders. The number of facilities, systems, users,
vendors, and volume of data to protect is massive,
making our risks for compromises especially high.
The primary goal of the Information Protection team
is to protect HCA’s patients, staff, and company’s
reputation.
• ESTABLISHING A BREACH
RESPONSE FRAMEWORK
• DEVELOPING A MATURE
REPORTING PROCESS
This won’t be accomplished, though, without everyone’s
diligence and vigilance. That’s why it’s the responsibility of
AND PROCEDURES TO HELP
BUSINESS, LEGAL, AND IT
RELATIVE TO HCA’S
CYBERSECURITY INSURANCE
each and every workforce member to:
PERSONNEL RESPOND IN THE
COVERAGE
EVENT OF AN INCIDENT
• PERFORMING INCIDENT
RESPONSE TEST EXERCISES
TO IDENTIFY OPPORTUNITIES
FOR IMPROVEMENT
• UPDATING EMAIL RETENTION
GUIDELINES AND TRAINING
RECOGNIZE THAT THE
RISKS ARE REAL. THE
EXTERNAL AND INTERNAL
THREATS ARE INCREASING.
CONSEQUENCES FROM
BREACHES COULD BE
PROTECT THEMSELVES
AND THEIR FAMILY. FROM
PHISHING EMAILS AND
PASSWORD PROTECTION
TO SOCIAL MEDIA
USE AND TRAVELING
INCORPORATE THESE SIX
WORDS INTO DAILY ROUTINES
AND DECISIONS: “HOW
WILL OUR INFORMATION BE
PROTECTED?” ALL EMPLOYEES
MUST MAKE INFORMATION
CATASTROPHIC FOR OUR
SAFELY, EMPLOYEES ARE
PROTECTION A PRIORITY
PATIENTS AND COULD BADLY
ENCOURAGED TO KEEP
WITH TEAM MEMBERS AND
DAMAGE THE REPUTATION
CURRENT ON WHICH
VENDORS. THEY’RE ALSO
OF OUR FACILITIES AND
ACTIONS WILL PROTECT
ENCOURAGED TO CHALLENGE
ORGANIZATION.
THEM AND WHICH ACTIONS
THE “WAY WE’VE ALWAYS
WILL PUT THEM AT RISK.
DONE IT” AND ENGAGE
INFORMATION PROTECTION
WHEN NECESSARY.
82
83