HITRUST

Hello, and welcome to another edition of Third-Party Threateners Podcast.

Today, I have a great guest here, Ryan Patrick from HITRUST.

Ryan and I have met through Third-Party Risk Association conferences and a couple other ones.

I think we've bumped into each other as well.

I'm a big fan of the HITRUST framework and the work that they do.

I work in a lot of the healthcare space, so I'm really familiar with it.

With that, Ryan, I want you to, as I usually do, turn over to the guests, let them do their introductions.

Yeah, absolutely.

I think the challenge is folks worried about data breaches or those types of things.

And as you've said, Simple Practice is very clear about it being HITRUST certified that you have these things.

So the data is secure and the way you're using it is really limited to quality improvement.

Mm-hmm.

I can also see IP addresses behind the firewall, which is not good.

A little bit further, kind of looking around and poking, printers, right? So everyone says medical is a big deal, HIPAA, HITRUST, all that stuff.

I found 15 printers at an organization that is calling itself, and I won't give the last name, but the first name is Watermark.

And it looks like they're all in a town called East Point.

You cannot Yep.

Also, Diven, who talked about HIPAA, SOC, ISO, and HITRUST.

Those are all the frameworks.

We know that.

[upbeat music] So joining me today is, is Brad Thies, and, uh, founder of and CEO of Barrr Advisory, a cybersecurity and compliance firm helping organizations navigate everything from SOC 2 to ISO to HITRUST to HIPAA and other, other frameworks.

Brad has been working with businesses ranging from high-growth startups to Fortune 1000 companies across technology, financial services, healthcare, government, helping them turn security and compliance requirements into controls they can actually use.

Uh, today we're gonna talk about why compliance matters.

22301 is for business continuity.

HITRUST is for healthcare information.

And NIST SP 153 is a catalog of controls.

And NIST CSF is again is a framework that you can base your security practices on.

I want to prove that, okay, I have the good practices.

How can I prove if I can make this aligned with the globally accepted best practices? So the standards and frameworks gives you the globally accepted best practices, and you can communicate to your board, to your customer, that my practice is aligned or certified with 27001.

My practice is aligned with an HTC SF.

So that gives the confidence to your customers.

I th- I think, you know, first of all, compliance is just a measure of, you know, all the things we should do anyway.

So even without this concept of, like, being compliant with certain standard, whether it is SOC 2 or HITRUST or the things that, you know, is, uh, is important to us in the healthcare field, right? With all these things, we need to protect, uh, patient data, we need to protect our customers' data anyway.

And, you know, our company, our software stack is built that way from day one.

And so, you know, when we measure... wh-when we use these standards to measure our, our work, sometimes it, you know, n- a lot of it is like everything is already, the box is already checked out of the box.

Very common in the procurement process in regards to SOC 2. there's where the rubber meets the road in that if you want to go after MSP agreements that are worth more than $10,000 a month, you're probably gonna be expected to have a SOC 2 compliance.

This particular piece of software does SOC 2, ISO 27001, HIPAA, GDPR, HITRUST, PCI DSS, NIST, AI Act, that's a new one.

CIS, CMMC.

So you can do a lot here.