Click here to close now.

Welcome!

Microsoft Cloud Authors: Elizabeth White, Liz McMillan, Pat Romanski, Jaynesh Shah, Carmen Gonzalez

News Feed Item

Industry Working Group Addresses Demand to Align HITRUST CSF with AICPA’s SOC 2SM Reporting

The Health Information Trust Alliance (HITRUST), the leading organization supporting the healthcare industry in advancing the state of information protection and responsible for the development of the Common Security Framework (CSF), announced today a collaboration with the American Institute of CPAs (AICPA) to develop and publish a set of recommendations to streamline and simplify the process of leveraging the CSF and CSF Assurance programs for the AICPA’s Service Organization Control SOC reporting, the accounting standards for reporting service organization controls.

This approach will provide healthcare organizations that must comply with HIPAA or other regulatory requirements the ability to leverage one comprehensive, scalable and up-to-date framework relevant to their organization type. This means healthcare organizations can more easily meet the wide and varied array of information protection regulations, standards, best practices and other information protection requirements and streamline and support their SOC 2 reporting requirements.

“HITRUST has been championing the need for greater efficiencies in the industry’s information protection compliance programs and striving for more consistency, less redundancies and greater efficiencies in the current assessment and reporting practices both within and between organizations,” said Ken Vander Wal, Chief Compliance Officer, HITRUST. “Establishing guidance that enables organizations to leverage the CSF for their SOC 2 reporting is another win for industry.”

Some of the benefits to healthcare organizations include:

  • Leveraging the HITRUST CSF controls in SOC 2 engagements
  • Realizing significant time efficiencies and cost savings through synergies between the CSF controls and Trust Services Principles and Criteria
  • Reducing the inefficiencies and costs associated with multiple control frameworks and reporting requirements

The collaboration is also expected to help manage the increasing risks third party vendors can bring by having a comprehensive control framework that focuses on controls and requirements that would address those risks.

“Vendor risk management is a component of enterprise risks management that is receiving ever increasing attention, particularly as organizations use cloud services to store and process confidential information,” said Chris Halterman, Executive Director, Ernst & Young LLP. “By using a SOC 2 report to communicate how it has implemented the HITRUST CSF controls, a service provider might efficiently and effectively demonstrate compliance with their vendor risk management responsibilities and reduce the amount of time and effort required by its clients to support vendor risk assessments.”

This new cooperative development between the AICPA and HITRUST has begun with the formation of a working group consisting of AICPA member firm representatives and an industry advisory group consisting of industry representatives. As a starting point, the working and advisory groups will have access to a mapping that has been performed of the CSF controls and the Trust Services principles and criteria for security, availability, and confidentiality.

“As the CISO of an organization that receives many information security compliance reporting requests, it is crucial we evaluate how to most efficiently communicate the information protection controls we have in place,” said Roy Mellinger, Vice President and Chief Information Security Officer, WellPoint. “Being able to leverage the HITRUST CSF as the controls framework for our SOC 2 reporting speaks to the comprehensive of the CSF and achieves the ‘assess once report many’ approach industry has been seeking.”

The guidance and recommendations from the working group are expected to be available within six to nine months.

About HITRUST

The Health Information Trust Alliance (HITRUST) was born out of the belief that information protection should be a core pillar of, rather than an obstacle to, the broad adoption of health information systems and exchanges. HITRUST, in collaboration with healthcare, business, technology and information privacy, risk and security leaders, has established a number of programs to support any and all organizations that create, access, store or exchange personal health and financial information. HITRUST is supporting the industry through its framework, assurance program, cyber center, risk management tools, education and leadership. It is also driving the widespread confidence in the industry’s safeguarding of health information through awareness, education, advocacy and other outreach activities. For more information, visit www.HITRUSTalliance.net.

More Stories By Business Wire

Copyright © 2009 Business Wire. All rights reserved. Republication or redistribution of Business Wire content is expressly prohibited without the prior written consent of Business Wire. Business Wire shall not be liable for any errors or delays in the content, or for any actions taken in reliance thereon.

@ThingsExpo Stories
The basic integration architecture, as defined by ESBs, hasn’t changed for more than a decade. Most cloud integration providers still rely on an ESB architecture and their proprietary connectors. As a result, enterprise integration projects suffer from constraints of availability and reliability of these connectors that are not re-usable across other integration vendors. However, the rapid adoption of APIs and almost ubiquitous availability of APIs amongst most SaaS and Cloud applications are rapidly redefining traditional integration approaches and their reliance on proprietary connectors. ...
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York City, NY. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participa...
The WebRTC Meetup, where WebRTC enthusiasts exchange ideas, is being held on Wednesday, June 10, from 7 pm – 9 pm at the 4th WebRTC Summit, June 9-11, 2015, at the Javits Center in New York City, NY. The WebRTC Meetup is being hosted by the New York WebRTC Developer Group. WebRTC is the future of browser-to-browser communications, and continues to make inroads into the traditional, difficult, plug-in web communications world. The 4th WebRTC Summit continues our tradition of delivering the latest and greatest presentations within the world of WebRTC. Topics include voice calling, video chat, ...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding business opportunity. Submit your speaking proposal today!
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
Imagine a world where targeting, attribution, and analytics are just as intrinsic to the physical world as they currently are to display advertising. Advances in technologies and changes in consumer behavior have opened the door to a whole new category of personalized marketing experience based on direct interactions with products. The products themselves now have a voice. What will they say? Who will control it? And what does it take for brands to win in this new world? In his session at @ThingsExpo, Zack Bennett, Vice President of Customer Success at EVRYTHNG, will answer these questions a...
SYS-CON Events announced today that BMC will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BMC delivers software solutions that help IT transform digital enterprises for the ultimate competitive business advantage. BMC has worked with thousands of leading companies to create and deliver powerful IT management services. From mainframe to cloud to mobile, BMC pairs high-speed digital innovation with robust IT industrialization – allowing customers to provide amazing user experiences with optimized IT per...
17th Cloud Expo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some form of XaaS – software, platform, and infrastructure as a service.
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo in Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound change in personal an...
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
2015 predictions circa 1970: houses anticipate our needs and adapt, city infrastructure is citizen and situation aware, office buildings identify and preprocess you. Today smart buildings have no such collective conscience, no shared set of fundamental services to identify, predict and synchronize around us. LiveSpace and M2Mi are changing that. LiveSpace Smart Environment devices deliver over the M2Mi IoT Platform real time presence, awareness and intent analytics as a service to local connected devices. In her session at @ThingsExpo, Sarah Cooper, VP Business of Development at M2Mi, will d...
"For over 25 years we have been working with a lot of enterprise customers and we have seen how companies create applications. And now that we have moved to cloud computing, mobile, social and the Internet of Things, we see that the market needs a new way of creating applications," stated Jesse Shiah, CEO, President and Co-Founder of AgilePoint Inc., in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will addresses this very serious issue of profound change in the industry.
Health care systems across the globe are under enormous strain, as facilities reach capacity and costs continue to rise. M2M and the Internet of Things have the potential to transform the industry through connected health solutions that can make care more efficient while reducing costs. In fact, Vodafone's annual M2M Barometer Report forecasts M2M applications rising to 57 percent in health care and life sciences by 2016. Lively is one of Vodafone's health care partners, whose solutions enable older adults to live independent lives while staying connected to loved ones. M2M will continue to gr...
The world is at a tipping point where the technology, the device and global adoption are converging to such a point that we will see an explosion of a world where smartphone devices not only allow us to talk to each other, but allow for communication between everything – serving as a central hub from which we control our world – MediaTek is at the heart of both driving this and allowing the markets to drive this reality forward themselves. The next wave of consumer gadgets is here – smart, connected, and small. If your ambitions are big, so are ours. In his session at @ThingsExpo, Jack Hu, D...
The multi-trillion economic opportunity around the "Internet of Things" (IoT) is emerging as the hottest topic for investors in 2015. As we connect the physical world with information technology, data from actions, processes and the environment can increase sales, improve efficiencies, automate daily activities and minimize risk. In his session at @ThingsExpo, Ed Maguire, Senior Analyst at CLSA Americas, will describe what is new and different about IoT, explore financial, technological and real-world impact across consumer and business use cases. Why now? Significant corporate and venture...
"At our booth we are showing how to provide trust in the Internet of Things. Trust is where everything starts to become secure and trustworthy. Now with the scaling of the Internet of Things it becomes an interesting question – I've heard numbers from 200 billion devices next year up to a trillion in the next 10 to 15 years," explained Johannes Lintzen, Vice President of Sales at Utimaco, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
Aria Systems, which helps enterprises grow recurring revenue, today announced that its co-founder and inventor of cloud billing Brendan O'Brien, will be a featured speaker at the Cloud Expo, June 9-11 at The Javits Center in New York. Aria also will be demonstrating its Active Monetization platform in Booth #424 on the Expo Floor. O'Brien will lead the following sessions: June 9 - 11:00 am - 11:35 am, Room 1A16 with participants from Constant Contact, MGI Research and ATG Enabling Complex Recurring Revenue Strategies – With IoT exploding, massive data will transform businesses with oppor...
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it!
SYS-CON Events announced today that the "First Containers & Microservices Conference" will take place June 9-11, 2015, at the Javits Center in New York City. The “Second Containers & Microservices Conference” will take place November 3-5, 2015, at Santa Clara Convention Center, Santa Clara, CA. Containers and microservices have become topics of intense interest throughout the cloud developer and enterprise IT communities.