Overview of security and compliance in MedTech

This is a topic close to my heart right now, as I’m leading Macuject’s security and compliance initiatives. I plan to delve deeper into each of these subjects in future posts but wanted to start with an overview.

Why is security and compliance important for MedTech startups?

Security breaches in the healthcare sector are all too common, with incidents ranging from malicious attacks to accidental data leaks by internal staff or misplaced devices like laptops.

Personal Health Information (PHI) is a hot commodity on the dark web, even more so than credit card details or typical Personally Identifiable Information (PII). This heightened value means cybercriminals target medical databases, either to sell the PHI or to exploit it for their own nefarious purposes. A staggering 15 million+ health records have fallen victim to data breaches, as reported by the health and human services breach report.

Key security and compliance standards and laws for MedTech startups

For many MedTech startups, the US is a key market, which makes both SOC2 compliance and HIPAA adherence a must. I’ll expand on those below.

Outside the US, there are other standards and laws that are important to consider including:

• ISO 27001
• GDPR
• Australian Privacy Act
• PIPEDA

Implementation

Achieving compliance and adherence to these standards and laws is a long process. They require significant financial and people investment. You also need to be prepared to make changes to your product and processes to meet the requirements of each standard.

I strongly recommend having someone on your team with prior experience in implementing these standards and laws. It is a huge advantage which means you’ll be able to hit the ground running and tweak implementation to your companies operating environment whilst still being compliant. Alternatively look for a consultant who can help you get started who has worked with your scale of company previously.

Most importantly ensuring commitment to security and compliance is something you need to instill in your company culture, from the top down. Security is everyone’s responsibility. Your people will need to see the changes as a benefit to them, not a burden. In that regard ensure what you’re putting in place is practical and not overly complex. Embrace automation where ever possible.

Also be aware that achieving compliance and adherence to these standards and laws is not a one-off investment. You need to continue to demonstrate your commitment to security and compliance, company-wide, every single day. An annual audit process with a third party partner is a key part of this as is ongoing budget and people allocation.

SOC 2

Service Organization Control (SOC) 2 is a security auditing process developed by the American Institute of Certified Public Accountants (AICPA). SOC 2 is specifically designed for service providers that store, process, or transmit customer data in the cloud. It assesses the effectiveness of a service organization’s controls in managing customer data, focusing on five key principles:

1. Security
2. Availability
3. Confidentiality
4. Processing Integrity
5. Privacy

SOC 2 compliance demonstrates a commitment to the security, confidentiality, and availability of sensitive health information. The compliance process includes:

• Establishing a comprehensive set of policies and procedures.
• Implementing and maintaining proper security controls.
• Undergoing an independent audit by a certified third party partner, generally a CPA firm.

The audit results in a SOC 2 report, which provides an in-depth review of the service organization’s controls and their effectiveness. A Type 1 report assesses the design of the controls, while a Type 2 report evaluates their operating effectiveness over a specified period. You’ll do both types of report, achieving Type 1 compliance first, then Type 2.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a US law that sets the standard for protecting sensitive patient data. Any company that handles protected health information (PHI) must ensure their systems and processes comply with HIPAA. The HIPAA Privacy Rule and the HIPAA Security Rule are the primary components of HIPAA, focusing on the safeguarding of PHI.

Key aspects of HIPAA for MedTech startups include:

• Implementing technical, administrative, and physical safeguards.
  • Technical safeguards: Access controls, audit controls, integrity controls, and transmission security.
  • Administrative safeguards: Risk assessments, workforce training, and contingency planning.
  • Physical safeguards: Facility access controls, workstation security, and device security.
• Regularly reviewing and updating security measures.
• Providing training on HIPAA compliance to all employees.

Upon meeting HIPAA requirements, organizations can obtain a HIPAA attestation. This is a formal declaration, confirming that the organization has implemented the necessary safeguards to protect PHI as required by the HIPAA Privacy and Security Rules. This may be done internally but is more commonly done by a third party partner.

Third party partner

I’ve found it particularly useful to use the same third party partner for both SOC 2 compliance and HIPAA attestation. This ensures you’re getting a consistent approach to security and compliance assessment and that you’re not duplicating effort in areas where there is overlap in the controls you need to implement.

Conclusion

If you’re a MedTech startup then security and compliance is a must. It’s not something you can afford to ignore.

Good luck on your journey!