Healthcare Third-Party Risk Management | HIStalk
- A recent cyber incident at Oracle Health, impacting approximately 6 million records, has highlighted the critical need for healthcare organizations to modernize their approach to third-party risk management.
- The incident served as a stark reminder to compliance officers about the importance of considering all data, including that residing in legacy systems, when assessing third-party risk.
- In March, Oracle Health reported its second data breach, raising concerns among healthcare providers and their patients.The compromised data resided in its legacy cloud infrastructure.
Healthcare providers face widening compliance gaps due to outdated third-party risk strategies. A recent breach at Oracle Health,affecting millions of records,spotlights vulnerabilities in legacy cloud infrastructure and highlights the need for modern solutions. The healthcare sector,now the primary target for data breaches,requires proactive measures to safeguard patient information. These include establishing a single source of truth, automating risk scoring, and continuous oversight. Manual risk assessments and periodic reviews fall short. Strengthening these strategies, especially third-party risk management, is paramount for healthcare organizations. news Directory 3 can provide you with the five steps for improving compliance oversight. Discover what’s next in proactive data protection.
Healthcare Providers Face Compliance Gaps in Third-Party Relationships
Updated June 24, 2025
A recent cyber incident at Oracle Health, impacting approximately 6 million records, has highlighted the critical need for healthcare organizations to modernize their approach to third-party risk management. The breach,which compromised protected health facts (PHI),exposed vulnerabilities in legacy cloud infrastructure and underscored the challenges of maintaining oversight across complex networks of contractors and partners.
The incident served as a stark reminder to compliance officers about the importance of considering all data, including that residing in legacy systems, when assessing third-party risk. Many healthcare compliance professionals struggle with limited visibility into the various networks they are tasked with managing. This lack of visibility, coupled with outdated risk assessment methods, creates notable compliance gaps.
In March, Oracle Health reported its second data breach, raising concerns among healthcare providers and their patients.The compromised data resided in its legacy cloud infrastructure. The incident highlighted the difficulties in managing data outside of centralized oversight,particularly within legacy infrastructures.
The healthcare sector has become a prime target for data breaches. In 2024, it was identified as the most targeted industry, demonstrating that traditional third-party risk assessments are frequently enough insufficient. These assessments, frequently conducted periodically using manual methods like emailed surveys and spreadsheets, provide a limited and static view of risk. Emerging vulnerabilities in legacy systems can easily be missed,leading to sensitive data exposure.
Five Steps to Improve Compliance Oversight
To strengthen their third-party risk posture,healthcare organizations should consider these essential steps:
- Create a Single Source of Truth: Establish a secure,centralized repository for all compliance-related evidence and documentation.
- Track and Classify Third-Party Engagements: Maintain a clear inventory of all third-party integrations, classifying them based on their level of risk.
- Automate Risk Scoring: Implement configurable scoring models based on regulatory frameworks to consistently assess third-party risk.
- Move to Continuous Oversight: Replace periodic reviews with real-time monitoring to flag any increases in risk scores.
- Develop Response Plans: Regularly test risk programs through simulations and tabletop exercises.
Maintaining trust is paramount in healthcare compliance.Losing that trust can have significant consequences. By adopting real-time, integrated Governance, Risk, and Compliance (GRC) tools, healthcare teams can enhance visibility, reduce manual work, and proactively respond to risks, ultimately safeguarding patient data and ensuring compliance.
What’s next
Healthcare organizations must prioritize modernizing their third-party risk strategies to protect patient data and maintain compliance. Embracing continuous monitoring and integrated GRC tools will be crucial in mitigating future risks and maintaining the trust of patients and stakeholders.