))
Horror Stories: Why Third-Party Vendor Risk Management is So Scary
Manage episode 344607250 series 3052259
Content provided by Makala Barsolona and Britton Burton | Sr Director of Product Strategy. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Makala Barsolona and Britton Burton | Sr Director of Product Strategy or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.
The last few years third-party vendor risk management (TPRM) has transitioned from being a relatively minor part of security and compliance programs for healthcare entities into a massive undertaking with potentially dire consequences if not managed properly. This is one of those topics that seems to really have CISOs shaking in their boots.
What makes third party vendor risk so scary? Why are security leaders having nightmares?
Join us for this episode of the CyberPHIx podcast where we hear from James Ballou, Chief Information Security Officer for North American Partners of Anesthesia.
James shares insights from his extensive experience managing security teams and third-party risk management programs for leading healthcare organizations.
Topics covered in this session include:
- What makes third-party vendor risk management so scary for healthcare cybersecurity and risk professionals?
- Regulatory requirements related to third-party vendor risk management including HIPAA and state laws
- OCR enforcement of third-party business associate compliance mandates
- Third-party vendor risk governance best practices and models
- The implications for vendors that acquire certifications including HITRUST, SOC 2, and ISO
- The limitations of questionnaire-based vendor assessment models
- Best practices for strategic and operational management of third-party vendor risk management programs in healthcare
- The future of third-party vendor risk management
99 episodes
Share
