Preventing, Containing, And Managing Cyber Breaches: Where To Begin?

Health-care institutions find it difficult to prioritize their competing cybersecurity objectives due to limited information security dollars and busy IT personnel. There seems to be little guidance on where to focus, despite a long list of steps health information custodians should be taking to safeguard their electronic information and to respond appropriately to cybersecurity incidents.

In our experience, regulators tend to focus on certain issues when conducting cyber breach investigations. These areas of regulatory focus offer some guidance to institutions on where they might concentrate their cyber breach prevention and management efforts. That said, decisions about which initiatives to prioritize will vary across institutions depending on their individual circumstances.