SOLUTION BRIEF

Maintaining theSecurity and Integrityof EHR Systems
The Tripwire EHR SolutionHighlights

The value of electronic health record (EHR) systems is immense. These» Simple subscription
pricing for best-in-class
FIM and SCM

digital records are designed to be available anytime and anywhere,» Detailed understandingof good vs. bad changes

immunization dates, allergies, lab results and radiology images. With

» Broadest depth andbreadth of compliancepolicy and platform
coveragecare, automate the provider’s workflow, support changes in payer» Tailored advice, incidentassistance and audit
support related toTripwire findings» Cloud-hosted
infrastructure combinedwith consulting services

connecting healthcare providers with patient data. EHRs are a central
repository of patient medical histories, medications, diagnoses,
access to this accurate patient information, providers can offer optimalrequirements, and address patient needs.
Beyond those benefits, by using EHRs
providers can access and consult
with data sets related to the patient’s
diagnosis and implement best carepractices. On the compliance front,
EHRs are intended to meet “meaningfuluse” standards to measure improved
health care quality and efficiency. Thesemetrics are focused on patient-centered,evidence-based, and prevention-oriented
efficiency. In the United States, eligible
hospitals and critical care providers
have been given financial incentives tomove to EHRs. The Office of the National
Coordinator (ONC) can also certify EHR

providers as “meaningful use” with
the Health IT Certification Program (avoluntary certification program). Somecommon EHR systems used are Epic,Cerner, and Allscripts. Epic is used bymany large hospital systems, making it
one of the top three EHR systems in theUS. It is also ONC 2015 Certified, so Epic
users can meet federal mandates.

EHR:
Prime Targets for Cyber Attacks
Given the sensitive information EHRs
contain, the need for privacy andFOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

security is a high priority. This isreflected in the US Health Insurance
Portability and Accountability Act(HIPAA) Privacy and Security rules,
which state the need to protect privacy
and security of individually identifiable
health information found on EHRs. TheHIPAA Privacy Rule covers protected
health information (PHI) in any medium,
while the HIPAA Security Rule covers
electronic protected health information(ePHI). Healthcare is the second-mostcommon industry being targeted byhackers, just behind financial services(Verizon 2017 Data Breach Investigations
Report).
For healthcare organizations, theaverage cost of a stolen patient record
is $355, compared with $5–$30 for
financial data. In other words, PHI is amore valuable cybercrime opportunity.
By taking advantage of patients’ medical
conditions or claim settlements,
criminals can use PHI to target
their victims with frauds and scams.
Attackers can also create fake insurance
claims, allowing for the purchase andresale of medical equipment. Or they
can use PHI to illegally gain accessto prescriptions for their own use orresale. If they have access to a real-time
database, they can change the payment
directions to redirect funds. The rangeof attacker motives and methods inhealthcare is daunting—and increasing.

Defend and Protect Your EHR
Continuous monitoring of system level
configurations and data integrity arefoundational controls for mitigating
cyberattacks on EHR systems. They
provide organizations with visibility into
unauthorized or unexpected changes
that may be the result of errors,omissions or—worse—malicious activity.
Some EHR environments can have up
to ten million changes in one month.
Monitoring complex environments likethese can be easier said than done,
especially when monitoring affects
performance or cannot be done natively
due to the system architecture.
Some providers monitor the databaseby creating scripts and running themagainst the database in a scheduledmanner. However, scripts are inadequate
because they only offer a point intime snapshot rather than continuousmonitoring. This resultant monitoring
gap—between two instances of when thescript has been run—presents a security
challenge as it provides a window ofopportunity to attackers. As a result, thescript approach is often unacceptable toauditors.
Even in situations where the EHR
system has native functionality formonitoring unauthorized access, using
these features can be time consuming
and cumbersome, and can quickly
overwhelm an IT operations department.

The Tripwire EHR Solution
Tripwire’s EHR solution provides atailored package of products andexpertise to alleviate the challenges
of monitoring EHR systems forunauthorized changes and to ensurethat those systems are in compliancewith HIPAA and NIST 800-53 & 171. The
solution leverages Tripwire® Enterprise,a proven security configuration
management (SCM) and file integrity
monitoring (FIM) solution. Tripwire
Enterprise provides healthcareorganizations using Epic, Cerner orAllscripts EHR systems out-of-thebox monitoring for critical file change,
security configuration compliance withHIPAA, NIST 800-53 & 171, and PCI 3.2,
as well as reports that provide auditready evidence of compliance withsecurity controls. Tripwire Enterpriseprovides this coverage across the entire
EHR environment, including:» Application Delivery Platform &Business Continuity Systems (e.g.
Citrix, Red Hat, Windows, HP-UX andAIX)» AD/LDAP (Active Directory and User &Role Management Software)» Database (MSSQL, Oracle, Caché (viaChronicles master files))» In-scope network devices» Virtual Environment (e.g. Citrix,Hyper-V, VMware)

TRIPWIRE®

ENTERPRISE

FIM & SCM

EHR Host OS

EHR Database

EHR App-File

EHR Web

EHR Connected

EHR ConnectedMonitoring & Reporting» Compliance Reporting» Critical File Changes» Security Configuration StateFig 1 The Tripwire EHR Solution provides FIM and SCM capabilities to EHR systems
and monitoring and reporting of results.

To ensure effective tailoring anddeployment of Tripwire products tothe specific EHR system, Tripwire’s
EHR solution provides consulting fromTripwire Professional Services. Theseexperienced consultants work withhealthcare organizations to create
targeted rules for monitoring theEHR application and EHR database
content, as well as hardening policies.
The Tripwire EHR Solution also
provides enhanced automation throughintegrations with change management
practices, ITSM and analytics tools (e.g.
Splunk, QRadar and ServiceNow).

Tripwire Enterprise’s file integrity
monitoring and secure configuration
management capabilities arefoundational security controls that allow
healthcare organizations to achieve
and maintain compliance while gaining
operational efficiencies in managing
their Epic, Cerner or Allscripts
infrastructure. By minimizing the riskof malicious attacks, fraudulent activity
and unauthorized changes, and bygaining exceptional system availability,
healthcare providers can depend on
Tripwire’s integrity assurance solutions
for robust EHR security.

Tripwire offers uniquemonitoring for Epicsystems. Tripwire’sautomated monitoring of
our Epic system allowed us
to achieve our first passing
audit while minimizinga hacker’s attempt tocompromise the data.
— Major US HospitalTripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—allwithout disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
SBEHRS2a2102