DATASHEET (TRIPWIRE)

Tripwire ExpertOps &HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) was enacted

HIGHLIGHTS

to safeguard Protected Health Information (PHI) by mandating procedures
and controls to assure the public that critical and private information iscontrolled from loss of confidentiality, integrity or availability. With few
exceptions, an organization is subject to HIPAA if it exchanges data related tothe health care profession.

The Challenge

Cyberattacks, including ransomware, have become ubiquitous in the healthcare
industry. Patient records contain nearly everything an attacker needs in a single
record to carry out sophisticated insurance fraud schemes, purchase medical
supplies or drugs, or commit other types of fraud including outright identity theft.
Recent studies have determined that cyber criminals can sell the comprehensive
identity information found in a health insurance or patient record on the black
market for as much as $1,000. Compare that to the average cost of a stolen credit
card that fetches about $1 on the black market, and it is readily apparent why
healthcare organizations are so frequently targeted.
Adding to the complexity of these security challenges are compliance andregulatory frameworks (such as HIPAA, NIST, ISO, PCI and COBIT) typicallyenacted to protect systems and sensitive data. However, since they frequently
evolve to keep pace with information technology, industry influences andnew threats to systems and data, healthcare organizations face multiple
moving targets for managing controls and meeting requirements. Healthcareorganizations, struggling to address ever-growing cybersecurity risks withlimited resources—the lack of cybersecurity talent and high turnover oncybersecurity teams—typically focus their energies by employing a “checkbox” mentality for passing each HIPAA compliance audit, and then simply
return to business as usual after the administrative scramble. This is when
configurations can start to drift out of compliance, even though at a particularpoint in time the organization may have passed an audit.

The Goal: Continuous HIPAA Compliance

Meeting the requirements of HIPAA requires most businesses to set up strong
processes, methods and controls to assure auditors that security and integrity

Fortra.com• Q u ic k ly a c h ie v e H I P AAc o m p lia n c e• Su p p o r t f r o m d e s ignatedT r ip w ir e E x p e r t s• C lo u d - h o s t e din f r a s t r u c t u r e c o m bi ned
w it h c o n s u lt in g s ervi ces• B r o a d e s t d e p t h a ndb r e a d t h o f c o m p li ancep o lic y a n d p la t f o r mc o v e r a g e , in c lu d ing P CI ,NIST , ISO 27 0 0 1 a n d COBI T

Fortra Solution Briefof PHI is assured. The specific technical rules are fairly
prescriptive, and systems that are in scope for HIPAA shouldmeet both the Act’s intention and the implementation
instructions as put forth in Sections 160, 162 and 164. Even if
your organization is compliant today, that’s no guarantee ofsecurity. Most organizations have IT systems that must be

Tripwire ExpertOps & HIPAA Compliance

HIPAA Part 164 Security and Privacy
164.306(a) - General Requirements
164.308 - Administrative Safeguards
Security management process

updated, modified and maintained, which introduces thepreviously mentioned configuration drift. Fortra’s Tripwire

Workforce security

has found that most organizations need both a compliance

Security awareness training

monitoring system and a change control process toassure only authorized change is introduced to in-scope

Security incident procedures

systems. System integrity is ensured only by being able toContingency plan

demonstrate to your HIPAA auditor that you have a processthat assures only authorized change occurs. Tripwire®
ExpertOpsSM can help organizations achieve continuous

Tripwire ExpertOps
Coverage

164.312 - Technical Safeguards
Access control

HIPAA compliance while insulating their teams from thechallenges of turnover and the cybersecurity talent gap.

Audit controlsYour Solution: Tripwire ExpertOps

Integrity

Tripwire ExpertOps combines managed services with thePerson or entity authenticationindustry’s best File Integrity Monitoring (FIM) and Security

Transmission security

Configuration Management (SCM) to help Covered Entities
address the requirements of the HIPAA security rule, asoutlined in Section 164. Tripwire ExpertOps also provides
personalized consulting, HIPAA audit support, and a cloudbased infrastructure to help you achieve and maintaincompliance. The solution is easy to deploy and use, withsimple subscription pricing and a low total cost of ownership.
Tripwire ExpertOps enables you to rapidly achievecompliance with HIPAA by reducing the attack surface,
increasing system integrity and delivering continuouscompliance. Plus, because Tripwire ExpertOps includes
personalized consulting, you receive ongoing support from adesignated Tripwire Expert.

Benefits•HIPAA audit support•

24/7 compliance visibility via a customized
dashboard•Alerts and reports in your inbox•

Waivers and change requests made easy•

No more awkward or incomplete hand-offs whenyour staff changes

Fortra.com

How It Works

Tripwire ExpertOps provides you with continuous staffing
to operate and manage Tripwire-provided HIPAA controls
at peak efficiency. The solution adapts to your uniqueenvironment—reports and profiling tasks are customized tomeet your specific needs. You will receive expert guidance
to configure your system and policy configurations tobest align with your requirements. And you’ll gain visibility
via 24/7 access to compliance information via a tailoreddashboard and management console.
A Tripwire Expert will act as an extension of your team byprioritizing work efforts and managing critical escalations.
Together you will jointly develop a Service Plan that outlines
communication practices, escalation procedures and any
specialized requests.
The Tripwire Expert will then tune and operate your
Tripwire-provided HIPAA controls to provide:•

Prescriptive policy and content guidance to enable
HIPAA compliance for your specific network or systemsecurity requirements•Recommendations for maximizing automation
capabilities for compliance and event alerting

Page 2Fortra Solution Brief

Tripwire ExpertOps & HIPAA Compliancepractices, change management process integrations,and audit prep activities•

Prioritized remediation to identify opportunities toefficiently improve compliance posture•

Quarterly executive review of achievements towards
objectives, insight into ongoing improvement, andutility of the environment•

Organizational grading for each accountabledepartment to provide visibility into groups needing
additional resources and attention

Get 24/7 visibility without deploying additional hardware,
databases and back-end software. Tripwire ExpertOps is

READY TO TAKE THE NEXT STEP?
G e t in t o u c h w it h yo u r T r ip w ir e A c c ountM a n a g e r — o r v is it t r ip w ir e . c o m / c o n t a ct-us—t o d e v e lo p a c u s t o m Se r v ic e P la n f o r T ri pw i reExpertOps.
Migrating from Tripwire Enterprise?
W e c a n h e lp w it h m ig r a t io n s e r v ic e s andp r ic in g . C o n t a c t yo u r T r ip w ir e A c c o u nt
M a n a g e r f o r d e t a ils .

built on a cloud computing platform, allowing the service
to quickly scale to meet your needs while maintaining highlevels of security. The service uses a single-tenancy model
to ensure that data remains segregated between customer
accounts. Tripwire applies multiple controls for security
and privacy of your data, including secure configurations,
vulnerability scanning, data encryption, malware
defenses, access control, log management, multi-factorauthentication, VPN, and much more.

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

© Fortra, LLC and its group of companies. All trademarks and registered trademarks are the property of their respective owners.

(fta-tw-ds-1023-r1-hm)