{"id":1665,"date":"2017-01-18T02:07:06","date_gmt":"2017-01-18T02:07:06","guid":{"rendered":"http:\/\/orionhealth-blog.local\/?p=1665"},"modified":"2024-08-13T01:45:36","modified_gmt":"2024-08-13T01:45:36","slug":"why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance","status":"publish","type":"post","link":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/","title":{"rendered":"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance"},"content":{"rendered":"\n

Does your health IT software vendor have a dedicated team that manages risk? A team that integrates the privacy, compliance, quality, and information-security organisations into a single functional unit?<\/p>\n\n\n\n

For most vendors, the answer is no, because the people who would comprise such a team are often distributed among other<\/em> teams. <\/p>\n\n\n\n

For example, the chief compliance officer (CCO) and chief privacy officer (CPO) roles often fall under the purview of the legal department; the chief information security officer (CISO) tends to report to the chief information officer (CIO); and the chief medical officer (CMO) often reports into the product department, or has their own separate reporting structure.<\/p>\n\n\n\n

Consider that: the CCO and CPO; the CISO; and the CMO\u2014who, by most accounts, should<\/em>work closely together\u2014usually don\u2019t<\/em> work closely together due to the competing priorities of their respective departments.<\/p>\n\n\n\n

And what about a vendor\u2019s quality-control initiatives, like process improvement, risk monitoring, audits, certifications, and more? Which team handles those?<\/p>\n\n\n\n

Since there\u2019s no industry best practice yet, the answer to that question tends to be all over the place, varying from vendor to vendor. Is it operations? Finance? Business transformation? Human resources?<\/p>\n\n\n\n

By not having a single, dedicated team managing risk, a vendor creates a dysfunctional organisation that ends up extending the timelines for satisfying new regulations and customer requirements, while making themselves liable to ignore critical clinical safety, privacy, security, efficiency, and operational deficiencies.<\/p>\n\n\n\n

So, how might your<\/em> health IT software vendor go about addressing these issues, if they were so inclined?<\/p>\n\n\n\n

There are a few things they would need to recognise first:<\/p>\n\n\n\n

  1. The roles responsible for assuring privacy, clinical risk, compliance, and security have a lot of crossover functionality, as many privacy issues can also be clinical-risk issues, information-security issues can also be compliance issues, and so on. Placing the roles that address those issues in a single<\/em> organisation\u2014rather than holed up separately<\/em> in various silos\u2014can instantly create a lot of valuable synergy that reduces risk, improves efficiency, and increases client satisfaction. <\/li>
  2. A real opportunity is created when the same team responsible for security, risk, and assurance\u2014who are already charged with implementing a large number of controls required by the various industry regulations such as HIPAA, HITRUST, and ISO\u2014is also responsible for quality<\/em>. Adding a chief quality officer (CQO) to the team creates a holistic view of processes, process monitoring, and process improvement that\u2019s generally difficult for a CCO, CPO, CISO, or CMO\u2014who are typically preoccupied with tactical concerns\u2014to comprehend, maintain, and improve on their own. <\/li>
  3. Once your vendor has recognised these issues, they should begin looking at all the other risks that could potentially affect not just you as a client with patients<\/em> to protect, but them as a vendor with a reputation<\/em> to protect. This is where your vendor will recognise the competing priorities within departments that lead to dysfunction in protecting your organisation\u2019s most valuable asset: the patient\u2019s medical data.<\/li><\/ol>\n\n\n\n

    By assembling all of these roles into a single team, your health IT software vendor can provide a tiered<\/em> approach to protection that effectively surrounds<\/em> your health IT data; applies a tactical security, data-loss prevention, and file-integrity focus to it; and wraps enterprise risk management, clinical safety, and compliance around the health IT data, too.<\/p>\n\n\n\n

    At this point, your vendor should refer to the seven elements of an effective compliance program<\/a>; implement comprehensive programs for incident and crisis management and clinical safety; and then wrap an assurance piece around<\/em> those programs.<\/p>\n\n\n\n

    This assurance piece accounts for all the industry regulations and requirements\u2014everything from best practices to government regulations around the globe, like GDPR in EMEA, HITRUST, HITECH, and the new 21st Century Cures Act<\/a>\u2014and utilises this newly assembled team of information security, clinical safety, compliance, and quality experts to take action, ensuring conformity to regulations and driving process improvement throughout the organisation.<\/p>\n\n\n\n

    Once your health IT software vendor has a single team that\u2019s organised in this way\u2014filled with subject matter experts from various domains working closely together, communicating consistently, and understanding your entire risk structure\u2014your vendor will be able to contribute more to your risk-compliance initiatives than ever before.<\/p>\n\n\n\n

    With an autonomous team that manages its own reporting line outside of the operations, services, and product departments, your vendor will be set to succeed without the conventional corporate structures that brought about these questions\u2014questions about who handles what<\/em>\u2014in the first place. Your vendor will have established a true system of checks and balances, where the security, compliance, clinical safety, and quality risks are addressed by a single department that doesn\u2019t have to worry about whether their priorities align with the priorities of other departments.<\/p>\n\n\n\n

    The benefits of this approach will be incalculable. Not only will it be possible for your vendor to address any issues relating to security, risk, and assurance in a prompt and complete manner, but a strong \u201cbook of knowledge\u201d will be established within the new team, one informed by not only your vendor\u2019s experience with your case but with all<\/em> of its client\u2019s cases, which will give your vendor the ability to resolve your challenges quickly and allow you to continue maintaining a strong focus on the business of making patients well.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Does your health IT software vendor have a dedicated team that manages risk? A team that integrates the privacy, compliance, quality, and information-security organisations into a single functional unit? For most vendors, the answer is no, because the people who would comprise such a team are often distributed among other teams.  For example, the chief compliance officer […]<\/p>\n","protected":false},"author":35,"featured_media":2785,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[1],"tags":[],"region":[23],"class_list":["post-1665","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","region-global"],"yoast_head":"\nWhy Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health<\/title>\n<meta name=\"description\" content=\"Does your health IT software vendor have a dedicated team that manages risk?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health\" \/>\n<meta property=\"og:description\" content=\"Does your health IT software vendor have a dedicated team that manages risk?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\" \/>\n<meta property=\"og:site_name\" content=\"Orion Health\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/orionhealth\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-01-18T02:07:06+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-13T01:45:36+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2560\" \/>\n\t<meta property=\"og:image:height\" content=\"1707\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Orion Health\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@OrionHealth\" \/>\n<meta name=\"twitter:site\" content=\"@OrionHealth\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Orion Health\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\"},\"author\":{\"name\":\"Orion Health\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/ce954e65dfbb7173bc8fa8d8ac90f2ca\"},\"headline\":\"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance\",\"datePublished\":\"2017-01-18T02:07:06+00:00\",\"dateModified\":\"2024-08-13T01:45:36+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\"},\"wordCount\":925,\"publisher\":{\"@id\":\"https:\/\/orionhealth.com\/uk\/#organization\"},\"image\":{\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg\",\"articleSection\":[\"Blog\"],\"inLanguage\":\"global\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\",\"url\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\",\"name\":\"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health\",\"isPartOf\":{\"@id\":\"https:\/\/orionhealth.com\/uk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg\",\"datePublished\":\"2017-01-18T02:07:06+00:00\",\"dateModified\":\"2024-08-13T01:45:36+00:00\",\"description\":\"Does your health IT software vendor have a dedicated team that manages risk?\",\"inLanguage\":\"global\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"global\",\"@id\":\"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage\",\"url\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg\",\"contentUrl\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg\",\"width\":2560,\"height\":1707},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#website\",\"url\":\"https:\/\/orionhealth.com\/uk\/\",\"name\":\"Orion Health\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/orionhealth.com\/uk\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/orionhealth.com\/uk\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"global\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#organization\",\"name\":\"Orion Health\",\"url\":\"https:\/\/orionhealth.com\/uk\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"global\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/Orion-Health-Logo.png\",\"contentUrl\":\"https:\/\/orionhealth.com\/wp-content\/uploads\/Orion-Health-Logo.png\",\"width\":260,\"height\":96,\"caption\":\"Orion Health\"},\"image\":{\"@id\":\"https:\/\/orionhealth.com\/uk\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/orionhealth\/\",\"https:\/\/x.com\/OrionHealth\",\"https:\/\/www.linkedin.com\/company\/orion-health\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/ce954e65dfbb7173bc8fa8d8ac90f2ca\",\"name\":\"Orion Health\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"global\",\"@id\":\"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/a1feedc501270f1e5c68f2a302f7d9fc59e88d952d13c51eda45122dd02cb09c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/a1feedc501270f1e5c68f2a302f7d9fc59e88d952d13c51eda45122dd02cb09c?s=96&d=mm&r=g\",\"caption\":\"Orion Health\"},\"url\":\"https:\/\/orionhealth.com\/global\/author\/orion-health\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health","description":"Does your health IT software vendor have a dedicated team that manages risk?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/","og_locale":"en_US","og_type":"article","og_title":"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health","og_description":"Does your health IT software vendor have a dedicated team that manages risk?","og_url":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/","og_site_name":"Orion Health","article_publisher":"https:\/\/www.facebook.com\/orionhealth\/","article_published_time":"2017-01-18T02:07:06+00:00","article_modified_time":"2024-08-13T01:45:36+00:00","og_image":[{"width":2560,"height":1707,"url":"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg","type":"image\/jpeg"}],"author":"Orion Health","twitter_card":"summary_large_image","twitter_creator":"@OrionHealth","twitter_site":"@OrionHealth","twitter_misc":{"Written by":"Orion Health","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#article","isPartOf":{"@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/"},"author":{"name":"Orion Health","@id":"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/ce954e65dfbb7173bc8fa8d8ac90f2ca"},"headline":"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance","datePublished":"2017-01-18T02:07:06+00:00","dateModified":"2024-08-13T01:45:36+00:00","mainEntityOfPage":{"@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/"},"wordCount":925,"publisher":{"@id":"https:\/\/orionhealth.com\/uk\/#organization"},"image":{"@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage"},"thumbnailUrl":"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg","articleSection":["Blog"],"inLanguage":"global"},{"@type":"WebPage","@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/","url":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/","name":"Why Your Vendor MUST Have One Team Dedicated to Security, Risk, and Assurance - Orion Health","isPartOf":{"@id":"https:\/\/orionhealth.com\/uk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage"},"image":{"@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage"},"thumbnailUrl":"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg","datePublished":"2017-01-18T02:07:06+00:00","dateModified":"2024-08-13T01:45:36+00:00","description":"Does your health IT software vendor have a dedicated team that manages risk?","inLanguage":"global","potentialAction":[{"@type":"ReadAction","target":["https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/"]}]},{"@type":"ImageObject","inLanguage":"global","@id":"https:\/\/orionhealth.com\/global\/blog\/why-your-vendor-must-have-one-team-dedicated-to-security-risk-and-assurance\/#primaryimage","url":"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg","contentUrl":"https:\/\/orionhealth.com\/wp-content\/uploads\/GettyImages-81711420-scaled.jpg","width":2560,"height":1707},{"@type":"WebSite","@id":"https:\/\/orionhealth.com\/uk\/#website","url":"https:\/\/orionhealth.com\/uk\/","name":"Orion Health","description":"","publisher":{"@id":"https:\/\/orionhealth.com\/uk\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/orionhealth.com\/uk\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"global"},{"@type":"Organization","@id":"https:\/\/orionhealth.com\/uk\/#organization","name":"Orion Health","url":"https:\/\/orionhealth.com\/uk\/","logo":{"@type":"ImageObject","inLanguage":"global","@id":"https:\/\/orionhealth.com\/uk\/#\/schema\/logo\/image\/","url":"https:\/\/orionhealth.com\/wp-content\/uploads\/Orion-Health-Logo.png","contentUrl":"https:\/\/orionhealth.com\/wp-content\/uploads\/Orion-Health-Logo.png","width":260,"height":96,"caption":"Orion Health"},"image":{"@id":"https:\/\/orionhealth.com\/uk\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/orionhealth\/","https:\/\/x.com\/OrionHealth","https:\/\/www.linkedin.com\/company\/orion-health"]},{"@type":"Person","@id":"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/ce954e65dfbb7173bc8fa8d8ac90f2ca","name":"Orion Health","image":{"@type":"ImageObject","inLanguage":"global","@id":"https:\/\/orionhealth.com\/uk\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a1feedc501270f1e5c68f2a302f7d9fc59e88d952d13c51eda45122dd02cb09c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a1feedc501270f1e5c68f2a302f7d9fc59e88d952d13c51eda45122dd02cb09c?s=96&d=mm&r=g","caption":"Orion Health"},"url":"https:\/\/orionhealth.com\/global\/author\/orion-health\/"}]}},"_links":{"self":[{"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/posts\/1665","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/comments?post=1665"}],"version-history":[{"count":0,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/posts\/1665\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/media\/2785"}],"wp:attachment":[{"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/media?parent=1665"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/categories?post=1665"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/tags?post=1665"},{"taxonomy":"region","embeddable":true,"href":"https:\/\/orionhealth.com\/global\/wp-json\/wp\/v2\/region?post=1665"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}