Who owns it, who runs it

The organization

Organization: Sagebrook Community Health (fictional)
Industry: Healthcare: a network of 12 primary-care clinics
Size: About 700 staff; a nine-person IT team with two in security
Risk appetite: Low tolerance for patient-safety incidents or patient data exposure; moderate tolerance for administrative disruption.

Constraints

The electronic health record (EHR) is a hosted service run by a vendor; clinicians reach it through the clinic's sign-in portal.
Billing is outsourced to a billing company whose staff use the same sign-in portal.
Under the clinic's governance policy, the Chief Medical Officer owns risk to clinical systems and patient data; IT runs the systems.

Remediation capacity: 2 findings. You can choose "Mitigate: remediate ("fix")" for at most 2.

You have 2 remediation slots.

F1 No multi-factor authentication on the portal used for remote EHR access

Clinicians and the billing company's staff sign in to the EHR remotely through the clinic's sign-in portal with a password alone. The portal logs show password-spraying attempts against clinician accounts over the past month. IT already runs an identity provider that supports multi-factor authentication (MFA); turning it on for the portal and enrolling users takes about two weeks.

Asset: Sign-in portal for remote EHR access
Exposure: Internet-facing
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Patient records in the EHR
Compensating controls available: Alert on repeated failed sign-ins
Remediation effort: Medium
Business owner: Chief Medical Officer

Your response to F1

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F2 EHR vendor's audit report shows a missed backup-restore test

IT reviewed the EHR vendor's SOC 2 report this month, the first review in two years. It lists one exception: the vendor skipped one quarterly test of restoring from backup. The vendor has a corrective plan due in 60 days. The clinics keep paper downtime procedures for EHR outages. The IT director has offered to sign off on the risk for the clinics.

Asset: Hosted EHR service
Exposure: Third party
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Patient records in the EHR
Compensating controls available: Run an EHR downtime drill at each clinic before the vendor's plan is due
Remediation effort: Low
Business owner: Chief Medical Officer

Your response to F2

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F3 Customer access reviews required by the EHR vendor haven't been done

The same SOC 2 report lists controls the vendor expects each customer to operate, including a quarterly review of its own users' EHR access. The clinic hasn't done one in 18 months. A quick check found 40 accounts for staff who have left that can still sign in. Disabling them takes a day; a quarterly review takes IT and the clinic managers about two days each quarter.

Asset: Clinic user accounts in the EHR
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Patient records in the EHR
Compensating controls available: Alert on sign-ins to accounts unused for 90 days
Remediation effort: Low
Business owner: Chief Medical Officer

Your response to F3

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F4 Billing company contract renews without breach terms

The billing company's staff work with patient billing records through the clinic's sign-in portal. Its contract renews next month. The draft has no deadline for notifying the clinic of a breach and no terms on who pays if the billing company causes one. The billing company has said it will negotiate. Giving its staff a separate, dedicated access path would take about six weeks.

Asset: Billing company contract and access
Exposure: Third party
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Patient billing records
Compensating controls available: Separate access path for billing company staff
Remediation effort: High
Business owner: Chief Financial Officer

Your response to F4

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

F5 Infusion pumps on the main clinical network can't be patched

Infusion pumps at four clinics run software with known flaws. The manufacturer has to recertify any update, and it doesn't expect to before next year. The pumps sit on the same network as clinic workstations. Moving them to their own network segment that allows only the pump-management server takes about a week.

Asset: Networked infusion pumps
Exposure: Internal network
CVSS base score: None (not a scored vulnerability)
Known to be exploited: No
Data involved: Medication dosing settings
Compensating controls available: Separate network segment allowing only the pump-management server
Remediation effort: High
Business owner: Chief Medical Officer

Your response to F5

Avoid — stop the activity

Mitigate: remediate ("fix")

Mitigate: compensating control ("reduce")

Transfer / share

Who approves accepting this risk? (only if you choose Accept)

Your rationale (required if you accept: 10–600 characters; optional otherwise)

Overall note (optional, up to 1200 characters; shown back to you, never stored)

Your rationale and note are shown back to you once and never stored. Privacy