HIM 530 Module 2 Frameworks Short Paper Example

Compliant Is Not the Same as Secure: The HIPAA Security Rule and the NIST Framework at Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Module Two Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Compliant Is Not the Same as Secure: The HIPAA Security Rule and the NIST Framework at Osprey Point Health

When Osprey Point Health's board asked whether the medical center was secure, the answer it received was that it was HIPAA compliant. Those are not the same claim. The HIPAA Security Rule sets legal requirements, while the NIST Cybersecurity Framework offers a way to organize and measure a security program. This paper compares the two, maps them to each other and recommends how Osprey Point should use both, particularly given that its enterprise risk analysis has not been updated since 2021.

What the HIPAA Security Rule Requires

Only electronic patient information falls under the Security Rule, and its duties reach both hospitals and the vendors acting for them. Its first group, administrative safeguards, includes a risk analysis, risk management, workforce training, a security official and contingency planning; physical safeguards cover buildings, workstations and removable media; and technical safeguards cover who can log in, the logs that record their activity, protection against improper alteration, identity verification and protection of data in transit. Some specifications are required and others are addressable, meaning an organization must implement them if reasonable and appropriate or document an alternative. This flexibility lets a small clinic and a large hospital comply in different ways, but it also means the rule sets a floor rather than describing a mature program. Federal regulators proposed changes in 2025 that would make several now-flexible safeguards, such as encryption and multifactor authentication, mandatory, so organizations should watch the rule's status.

What the NIST Framework Offers

The NIST Cybersecurity Framework is voluntary guidance for managing cybersecurity risk in any sector. Version 2.0, released in 2024, sorts its outcomes into six functions (NIST, 2024). The new one, Govern, covers the strategy, roles, policies and oversight that direct the rest, including supply chain risk. The other five follow the life of a threat: knowing your assets and risks, guarding them, noticing when something goes wrong, reacting to it and restoring normal operations. Each function breaks into categories and subcategories of outcomes, and organizations can describe their current and target profiles to plan improvements. The framework does not tell an organization which tools to buy; it describes what a program should achieve.

Mapping the Two

Table 1 maps the framework's functions to Security Rule requirements. The overlap is large, but the framework adds emphasis on governance, continuous detection and recovery that the rule addresses only briefly.

Table 1. NIST CSF 2.0 Functions Mapped to HIPAA Security Rule Safeguards

Note. Mapping prepared by the author for Osprey Point's security committee.

Where Osprey Point Stands Today

A quick self-assessment against the framework shows an uneven program. Protect is the strongest function: the medical center has role-based access, encrypted laptops and annual training. Detect is weaker; audit logs are collected but reviewed only after complaints, which is how both snooping incidents last year were found. Identify has fallen behind, since the asset inventory misses many connected devices and the risk analysis is four years old. Respond and Recover exist on paper, but the incident response plan has never been exercised and backups have not been restored in a test for over a year. Govern is the weakest of all, because no committee owns security priorities and the board receives only a compliance attestation. These gaps shape the recommendations below.

Why Recognized Practices Now Matter

A 2021 amendment to the HITECH Act requires federal regulators, when deciding penalties and audit outcomes, to consider whether a covered entity or business associate had recognized security practices in place for the previous twelve months. Recognized practices include those developed under the NIST framework and the health sector's own cybersecurity practices guidance. The amendment gives hospitals a concrete incentive to adopt a framework and document its use, beyond the rule's minimum requirements.

Why Frameworks Are Not Enough on Their Own

Frameworks describe outcomes; organizations still have to achieve them. Jalali and Kaiser (2018) studied cybersecurity in hospitals and found that it depended on organizational factors such as leadership attention, coordination between information technology and clinical departments and competing priorities for resources. Argaw et al. (2020) described challenges that make hospitals especially vulnerable, including legacy systems that cannot be patched, connected medical devices and chronic underinvestment. Kruse et al. (2017) similarly found that health care lagged other industries in protective measures. Osprey Point's unsupported imaging archive is an example of exactly the legacy risk these authors describe, and no framework will remove it without budget and leadership decisions.

Recommendations for Osprey Point

Osprey Point should use the Security Rule as its legal floor and the NIST framework as its management structure. Four steps follow. First, establish the Govern function formally: a security steering committee chaired by the chief information officer with the privacy officer, health information and clinical leaders, reporting to the board twice a year. Second, update the enterprise risk analysis, which is both a legal requirement and the Identify function's core outcome; Milestone One will begin that work. Third, document current and target profiles against the framework so that improvements can be planned and shown to regulators as recognized practices. Fourth, give the unsupported imaging archive a dated replacement or isolation plan, since it is the most visible gap between compliance on paper and security in practice.

Conclusion

The HIPAA Security Rule tells Osprey Point what it must do; the NIST framework helps it organize, measure and improve what it does. Treating compliance as the goal left the medical center with an outdated risk analysis and an unsupported system storing patient data. Using the rule as a floor and the framework as a structure, with governance at the top, gives the board a truer answer to whether the hospital is secure.

References

Argaw, S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M.-V., Calcavecchia, F., Anderson, D., Burleson, W., Vogel, J.-M., O'Leary, C., Eshaya-Chauvin, B., & Flahault, A. (2020). Cybersecurity of hospitals: Discussing the challenges and working towards mitigating the risks. BMC Medical Informatics and Decision Making, 20, Article 146. https://doi.org/10.1186/s12911-020-01161-7

Jalali, M. S., & Kaiser, J. P. (2018). Cybersecurity in hospitals: A systematic, organizational perspective. Journal of Medical Internet Research, 20(5), Article e10059. https://doi.org/10.2196/10059

Kruse, C. S., Frederick, B., Jacobson, T., & Monticone, D. K. (2017). Cybersecurity in healthcare: A systematic review of modern threats and trends. Technology and Health Care, 25(1), 1-10. https://doi.org/10.3233/THC-161263

National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). https://doi.org/10.6028/NIST.CSWP.29