Third-party risk management (TPRM) is a major blind spot for most healthcare cybersecurity programs. Vendor contracts are often signed without conducting a risk assessment – which helps explain why the industry has experienced a 300% increase in vendor-related breaches since 2021.
However, this also makes TPRM among the most promising pieces of “low-hanging fruit” for security teams to address. Simply implementing a more programmatic approach to vendor risk management could be the single most valuable intervention CISOs can make this year, and this article explains why the TPRM lifecycle is the perfect model to use.
Expect to learn:
- How more consistent processes can reduce “assessment fatigue”
- Why mapping the TPRM lifecycle can radically reduce vendor risk
- What security leaders can do today to improve future risk management
Why Third-Party Risk Management (TPRM) Needs an Overhaul
Most security leaders are well acquainted with the flaws in existing TPRM programs; we need not go into detail on all the inefficiencies that cause the healthcare industry to experience more third-party breaches than any other industry. But it’s important to note how many of these well-noted weaknesses stem from a lack of unified processes.
Take “assessment fatigue” – the familiar exhaustion security teams feel when faced with 10s or even 100s of vendors to audit. Most explanations point to the size of healthcare vendor networks, which no doubt contribute to the sense of overwhelm. But this fatigue is also driven by the lack of consistent processes for assessments:
- Communication is often fragmented and conducted across multiple platforms or formats
- Data is often compiled in different systems that may lack interoperability
- Remediation and risk mitigation are often ad-hoc and under-budgeted
As a result, security teams must not only contend with large vendor networks but also constantly improvise or adapt their processes to changing needs. This increases cognitive load, fosters inconsistent risk evaluation and mitigation, and makes third-party risk management feel like a burden.
An alternative approach puts a clear structure around all TPRM processes. This eliminates variability in approach and gives every team member clarity on exactly what is required and when – which is exactly what the TPRM lifecycle is designed to accomplish.
What is the TPRM Lifecycle?
The third-party risk management (TPRM) lifecycle maps the entire vendor management process and breaks it into a clear set of repeatable processes. Rather than scrambling to retrospectively assess risk or “catch up” with best practices, every vendor follows a clear set of risk management steps to make better procurement decisions – and keep your patients, reputation, and bottom line safe.
We can break this third-party risk management lifecycle down into five core phases:
1. Due Diligence
Before partnering with a third party, run comprehensive assessments to understand their risk posture. Security teams should expect any vendor to supply:
- Documented security policies and practices
- Operational risk reports
- A history of security incidents and remediation
- Compliance documentation
This helps identify potential vulnerabilities related to data privacy and security; it also reveals how willing they are to collaborate with your security team. Given that 40% of contracts are signed without undertaking such assessments, it is fair to assume that simply adding this process will dramatically reduce vendor risk – as well as make future assessments easier.
Key steps:
- Establish official “due diligence” requirements for vendor evaluation
- Create a core team responsible for undertaking risk assessments
- Leverage technology to streamline and optimize the assessment process
2. Vendor Selection
Evaluate each vendor’s suitability based on key factors such as their:
- Ability to integrate with EHR systems and meet interoperability standards
- Control measures to prevent unauthorized access to data
- Incident response plan for data breaches
- Security posture and existing compliance processes
- Potential benefits to your organization
This helps you view prospective vendors through a holistic lens. Rather than simply looking for the most advanced software or hardware, you can evaluate its potential costs and benefits across a wider range of factors – leading to better purchase and partnership decisions.
Key steps:
- Ensure vendor selection policies feature clear compliance and security provisions
- Include security policies, responsibilities, and incident response requirements in vendor contracts
3. Vendor Onboarding
Include risk management processes in the onboarding phase to make future monitoring and mitigation simpler. Many organizations include these steps later in the lifecycle; the first official vendor risk assessment might occur after several months or years of working together. But this means your TPRM team is always “catching up,” which is stressful and creates room for vulnerabilities to be exploited, so it’s recommended to introduce this earlier in your engagement.
Key Steps:
- Establish service-level agreements (SLAs) that stipulate the vendor’s cybersecurity responsibilities
- Build relationships with the vendor’s internal risk team
- Create avenues for official communication and risk monitoring, with the ideal system enabling the vendor to supply real-time risk data
4. Ongoing Monitoring and Mitigation
Make third-party risk management practices a core part of every vendor relationship. This should be an ongoing collaboration between your TPRM team and each vendor’s own compliance and security units.
At any given time, you should be able to answer questions such as:
- When was the most recent breach at this vendor?
- What is this vendor’s most urgent cybersecurity weakness?
- What steps is the vendor taking to improve their security?
- How does the vendor’s risk program impact our security and compliance posture?
This ensures that decisive action is taken when a vulnerability is discovered – not when a breach has already taken place.
Key Steps:
- Run annual risk and compliance assessments with every vendor
- Monitor threat levels and proactively remediate the highest risk at any given time
- Undertake regular (quarterly or annual) vendor network audits to establish and mitigate your overall vendor risk level
5. Vendor Offboarding
Follow best practices to remove vendors from your IT network. 76% of cybersecurity leaders say offboarding is a key security threat, and this may be even truer for complex healthcare systems with many outdated devices and software.
Key Steps:
- Ensure all PHI access is terminated, and data stored on vendor systems is destroyed
- Change the vendor password access to prevent previous employees from entering the system
- Collaborate with the vendor’s security team to map all possible gaps in the offboarding process
- Conduct exit interviews to improve future vendor relationships
Complete TPRM Assessments 3x Faster with Intraprise Health
The TPRM lifecycle is a powerful framework, but many organizations lack the time or resources to implement it with confidence.
That’s why Intraprise Health, a Health Catalyst Company, offers end-to-end TPRM solutions to make it easier, including:
- Exclusive software to centralize, streamline, and accelerate your vendor assessments
- Expert services that help even resource-limited companies gain HITRUST certification
- Comprehensive consultation programs to identify and resolve your biggest vendor risks
The net result? A more robust and efficient third-party management program that ensures your organization is safe from sudden vendor-related threats.
Want to explore how we could protect your patients, reputation, and bottom line?
