SOLUTION BRIEF (TRIPWIRE)

THE TRIPWIRE HIPAA SOLUTION
Meeting the Security Standards Set Forth in Section 164
The United States Health Insurance Portability and Accountability Act of 1996, or HIPAA, was enacted to safeguard Protected Health
Information (PHI) by mandating procedures and controls to assure the public that critical and private information is controlledfrom loss of confidentiality, integrity or availability. With few exceptions, an organization is subject to HIPAA if it exchanges data
related to the health care profession.
Both HIPAA and the regulatory environment have evolved since 1996. In 2009, the Health Information Technology for Economic andClinical Health Act (HITECH Act) was signed into law as part of American Recovery and Reinvestment Act (ARRA). This law includes
new rules that affect the health care industry and those entities that might handle, process or maintain personal health information.
The new rules revolve around two primary areas:•The mandated adoption of new electronic health record systems (and standards, controls and protections around thatadoption)•The expansion of breach notification rules concerning personal health records

In 2013, the HIPAA Omnibus rule, in a health information technology (HIT) context, was enacted to modify the HIPAA Privacy, Securityand Enforcement Rules to implement statutory amendments under the HITECH Act. The HIPAA Omnibus rule has extensive changes
to strengthen the security and privacy of PHI, such as extending liability to business associates and increasing penalties with amaximum penalty of $1.5 million per violation. HIPAA and HITECH are separate and unrelated laws, though they do strengthen eachother in certain ways. For example, HITECH stipulates that technologies and technology standards created under HITECH do notcompromise HIPAA privacy and security laws.
Organizations subject to HIPAA, known as Covered Entities (CE), include:•Health care providers — doctors, hospitals, etc.,•Health care insurance and health plan clearing houses,•

Businesses that self-insure; and•Businesses that sponsor a group health plan and provide assistance to their employees on medical coverage (such asflexible spending accounts).

HIPAA Impact

US Department of Human and Health Services (HHS) is becoming more aggressive with the violations and fines. In the first half2016 alone, HHS recorded close to $15 million in settlement payments.1 Healthcare cyber attacks are also on the rise and appear
to be shifting their tactics. Healthcare care records are still being stolen and resold on the black market, but the price is dropping,
pivoting some of the monetization to ransomware attacks.2 The HIPAA Security Rule requires implementation of security measuresthat can help prevent the introduction of malware, including ransomware. HIPAA is intended to mandate security processes
to evade these cyber attacks. Keep in mind, experiencing a cyber attack is not just a compliance concern — it’s a healthcare
business concern of loss of service and business.

Fortra.com

Fortra Solution Brief

The Tripwire HIPAA Solution

Your HIPAA Compliance

Tripwire Solutions and HIPAA

to set up strong processes, methods and controls to assure

controls to meet the security requirements of HIPAA (Sectionauditors that the security and integrity of PHI is assured. The164), reducing time spent fighting fires caused by poor

specific technical rules are fairly prescriptive, and systems

network and data security practices, and enhancing thethat are in scope for HIPAA should meet both the Act’sdata security of ePHI. Tripwire’s real time and continuous

intention and the implementation instructions as put forth infoundational controls (which include security configurationeach section. Below, we illustrate how Tripwire products helpmanagement, vulnerability management and log

address secure processes as dictated by HIPAA Section 164.

management) assure you do not drift from compliance, andAdditionally, we can show not only how to reach compliance,

are consistently compliant.

Meeting the requirements of HIPAA requires most businesses

but maintain it over the long term.

Tripwire solutions offer highly automated foundationalCore to the Tripwire solution for HIPAA is high integrity

And why is continuous compliance important? Even if ansystems management, a policy-based solution that allows

organization is compliant today, unforeseen change is

you to programmatically analyze critical changes andvery likely. Most organizations have IT systems that mustsettings to determine if they are authorized and compliant.

be updated, modified and maintained to keep runningBecause integrity monitoring is being performed as changesmoothly, which introduces high likelihood that it will drift out

occurs, you can actually achieve a continuous state ofof compliance with HIPAA rules.

compliance. Tripwire has a solid track record with many

Fortra’s Tripwire has observed that most organizations needboth a compliance monitoring system and a change control
process that assures only authorized change is introduced
to the systems in scope. To demonstrate system integrity

compliance standards (CIS, ISO 27001, PCI, FISMA/NIST, NERC
CIP, SOX, COBIT, DISA) as well as HIPAA, and offers over 150
policy templates and audit-ready reports to support thesestandards.

one must show a not only a process, but evidence (reportsWe also recognize that many healthcare organizations areand logs) that assures only authorized change occurs.

aligning to National Institute of Standards (NIST) guidelines

Healthcare industry observers see increases in healthcare
cyber attacks. Security issues with highly connected
electronic health records (EHR) systems and the advent ofand framework as well for a security strategy with over 47%
healthcare organizations adopting NIST.3 We encourage youto read our Achieving FISMA brief and other NIST-related briefs.

web-based health record repositories are likely to push newand enhanced rules for electronic PHI (ePHI) and expandeddefinitions of who is a CE. Are you ready?

References

1. http://www.beckershospitalreview.com/healthcare-informationtechnology/10-largest-hipaa-settlement-fines.html
2. http://securityaffairs.co/wordpress/54666/
security/healthcare-cyber-security.html
3. HIMSS Survey 2016

Fortra.com

Page 2Fortra Solution Brief

The Tripwire HIPAA Solution

Fortra’s Tripwire Helps You Achieve and Maintain HIPAA Section 164
Requirement

Tripwire ResponseTripwire
EnterpriseTripwire
IP360

TripwireLogCenter§ 164.306 Security standards: General rules.
(a) General requirements. Covered entities and business associates must do the following:(1) Ensure the confidentiality, integrity, andavailability of all electronic protected healthinformation the covered entity or businessassociate creates, receives, maintains, or transmits.

Tripwire monitors systems for any unauthorizedchanges, and discovers and prioritizes
vulnerabilities to ensure health data is notcompromised. Organizations can correlate eventswith changes that impact IT policies.

ProvidesProvidesSupports(2) Protect against any reasonably anticipatedthreats or hazards to the security or integrity ofsuch information.

Tripwire detects unauthorized changes,and discovers and prioritizes vulnerabilities.
Organizations can correlate events with changes
that impact IT policies.

ProvidesProvidesSupports(3) Protect against any reasonably anticipateduses or disclosures of such information that are notpermitted or required under subpart E of this part.

Tripwire detects unauthorized changes,
and discovers and prioritizes vulnerabilities.
Organizations can correlate events with thechanges that impact IT policies.

ProvidesProvidesSupports(4) Ensure compliance with this subpart by its
workforce.

Tripwire provides policies and documents toensure certain security efforts.

ProvidesProvidesValidates

ProvidesProvidesSupports

ProvidesProvidesSupports

ProvidesProvidesSupports§ 164.308 Administrative safeguards.
(a) A covered entity or business associate must, in accordance with § 164.306:(1)(i) Standard: Security management process.
Implement policies and procedures to prevent,detect, contain, and correct security violations.

Tripwire monitors systems for any unauthorizedchanges, and discovers and prioritizesvulnerabilities to ensure health data is notcompromised. Organizations get real-time,conditional alerting, which enables them tocorrelate events with the changes that impact IT
policies and security events.

(ii) Implementation specifications:(A) Risk analysis (Required). Conduct an accurate
and thorough assessment of the potential risks
and vulnerabilities to the confidentiality, integrity,and availability of electronic protected healthinformation held by the covered entity or businessassociate.

Tripwire discovers and prioritizes vulnerabilities.
Tripwire assesses if your systems are hardened(secure configurations).

(B) Risk management (Required). Implement
security measures sufficient to reduce risks andvulnerabilities to a reasonable and appropriate
level to comply with § 164.306(a).

Tripwire discovers and prioritizes vulnerabilities.
Tripwire assesses if your systems are hardened(secure configurations).

(C) Sanction policy (Required). Apply appropriate
sanctions against workforce members who fail tocomply with the security policies and proceduresof the covered entity or business associate.

Tripwire can identify infrastructure that has driftedfrom established secure configurations.

Fortra.com

ProvidesValidates

Page 3Fortra Solution Brief

The Tripwire HIPAA Solution

Requirement

Tripwire Response(D) Information system activity review (Required).
Implement procedures to regularly review records
of information system activity, such as audit logs,
access reports, and security incident tracking
reports.

Tripwire provides system log information, tosupport investigations.

(3)(i) Standard: Workforce security. Implement
policies and procedures to ensure that all
members of its workforce have appropriate accessto electronic protected health information, asprovided under paragraph (a)(4) of this section,and to prevent those workforce members who
do not have access under paragraph (a)(4) of
this section from obtaining access to electronic
protected health information.

Tripwire tracks authorized and unauthorized
activities.

(B) Protection from malicious software(Addressable). Procedures for guarding against,detecting, and reporting malicious software.

Tripwire monitors systems for any unauthorizedchanges, and discovers and prioritizes
vulnerabilities to ensure health data is notcompromised.

(C) Log-in monitoring (Addressable). Procedures
for monitoring log-in attempts and reporting
discrepancies.

Tripwire tracks authorized and unauthorized
activities.

TripwireEnterprise

Tripwire
IP360

Tripwire
LogCenter
ProvidesProvidesProvidesProvidesProvidesProvidesProvidesValidates(D) Password management (Addressable).
Procedures for creating, changing, andsafeguarding passwords.
(6)(i) Standard: Security incident procedures.
Implement policies and procedures to address
security incidents.

Tripwire monitors systems for any unauthorizedchanges, and discovers and prioritizes
vulnerabilities to ensure health data is notcompromised. Tripwire offers log information forinvestigations.

(ii) Implementation specification: Response andreporting (Required). Identify and respond tosuspected or known security incidents; mitigate, tothe extent practicable, harmful effects of security
incidents that are known to the covered entity
or business associate; and document security
incidents and their outcomes.

Tripwire monitors systems for any unauthorizedchanges and discovers and prioritizes
vulnerabilities to ensure health data is notcompromised. Tripwire offers log intelligence, tosupport investigations.

C) Emergency mode operation plan (Required).
Establish (and implement as needed) procedures
to enable continuation of critical businessprocesses for protection of the security ofelectronic protected health information while
operating in emergency mode.

Tripwire maintains system baselines to enablerollbacks if systems have been corrupted.

(D) Testing and revision procedures (Addressable).
Implement procedures for periodic testing andrevision of contingency plans.

Tripwire can support the testing process with its
monitoring capabilities.

Fortra.com

ProvidesProvidesProvidesSupports

Supports

ProvidesSupports

Supports

Page 4Fortra Solution Brief

Requirement

The Tripwire HIPAA Solution

Tripwire Response

TripwireEnterprise

Tripwire
IP360

Tripwire
LogCenter§ 164.312 safeguards.
A covered entity or business associate must, in accordance with § 164.306:(a)(1) Standard: Access control. Implement
technical policies and procedures for electronic
information systems that maintain electronic
protected health information to allow accessonly to those persons or software programs thathave been granted access rights as specified in§ 164.308(a)(4).

Tripwire tracks authorized and unauthorized
activities.
Supports(2) Implementation specifications:(i) Unique user identification (Required). Assign aunique name and/or number for identifying andtracking user identity.
(ii) Emergency access procedure (Required).
Establish (and implement as needed)
procedures for obtaining necessary electronic
protected health information during anemergency.

Tripwire maintains system baselines to enablerollbacks if systems have been corrupted.

(iii) Automatic logoff (Addressable). Implement
electronic procedures that terminate anelectronic session after a predetermined time ofinactivity.

Tripwire tracks authorized and unauthorizedactivities.

(iv) Encryption and decryption (Addressable).
Implement a mechanism to encrypt anddecrypt electronic protected health information.

Tripwire can alert if encryption is on or off.
Tripwire validates and reports on the removalof, or changes to, certain types of data, suchas cryptographic files and keys, data files, anddatabase tables.

Supports(b) Standard: Audit controls. Implement
hardware, software, and/or procedural
mechanisms that record and examine activity
in information systems that contain or use
electronic protected health information.

Tripwire addresses security audit settingsand controls that pertain to audit-log
behavior. Tripwire monitors system activity
and can determine the specific user accounts
associated with those events.

Supports(c)(1) Standard: Integrity. Implement policies
and procedures to protect electronic protected
health information from improper alteration ordestruction.

Tripwire (either out of the box or customized)
addresses system integrity of information
systems that maintain electronic protected
health information. In particular, Tripwire
features watch files and settings for thesecontrols, and will alert when changes to themtake a system out of compliance. Tripwire
discovers and prioritizes vulnerabilities.

Provides(2) Implementation specification: Mechanism
to authenticate electronic protected healthinformation (Addressable). Implement electronicmechanisms to corroborate that electronic
protected health information has not beenaltered or destroyed in an unauthorized manner.

Tripwire addresses security mechanismsthat are used to authenticate a system thatmaintains protected health data. The Tripwirechange audit feature monitors system activity,and can determine if and when those controls
were changed.

Supports

Fortra.com

Supports

Supports

Supports

ProvidesPage 5Fortra Solution Brief

The Tripwire HIPAA Solution

Requirement

Tripwire ResponseTripwire
Enterprise(d) Standard: Person or entity authentication.
Implement procedures to verify that a personor entity seeking access to electronic protected
health information is the one claimed.

Tripwire tracks authorized and unauthorized
activities.

(e)(1) Standard: Transmission security. Implement
technical security measures to guard against
unauthorized access to electronic protected
health information that is being transmitted overan electronic communications network.

Tripwire tracks authorized and unauthorized
activities.

(i) Integrity controls (Addressable). Implement
security measures to ensure that electronically transmitted electronic protected healthinformation is not improperly modified without
detection until disposed of.

Tripwire addresses security services and security settings that are used to assure system anddata integrity. The Tripwire change audit featuremonitors system activity and can determine if
and when those controls were changed, or takethe system out of compliance. Organizations
can correlate events with the changes that
impact IT policies

Supports(ii) Encryption (Addressable). Implement amechanism to encrypt electronic protected
health information whenever deemed
appropriate.

Tripwire can alert if encryption is on or off.
Tripwire validates and reports on the removalof, or changes to, certain types of data, suchas cryptographic files and keys, data files, anddatabase tables.

Supports(2) Breaches treated as discovered. For purposes of paragraph (a)(1) of this section, §§164.406(a), and 164.408(a), a breach shall betreated as discovered by a covered entity as of
the first day on which such breach is known tothe covered entity, or, by exercising reasonablediligence would have been known to the covered entity. A covered entity shall be deemed
to have knowledge of a breach if such breachis known, or by exercising reasonable diligencewould have been known, to any person, otherthan the person committing the breach, who isa workforce member or agent of the covered
entity (determined in accordance with the federal common law of agency).

Tripwire supports the rapid detection of data
breaches by monitoring systems and discovering vulnerabilities. Tripwire collects, analyzes
and correlates log data, enabling IT to detect
and respond quickly to security events.

Tripwire
IP360

TripwireLogCenter

Supports

Supports

Supports

Supports

Supports

Supports

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

Copyright © Fortra, LLC and its group of companies. Fortra™, the Fortra™ logos, and other identified marks are proprietary trademarks of Fortra, LLC.

(tw-ds-0424-r1-hm)