Many early-stage companies wait until customer requirements force them to formalize their security programs. As careMESH grew rapidly, the company recognized that its security infrastructure needed to mature with the business. careMESH is a healthtech company focused on communication and care coordination, with customers across hospitals, government, health IT, and payers.
“We had grown quite rapidly. We’d accumulated a number of customers and found ourselves on the back foot in terms of putting in place a robust security infrastructure,” explains careMESH President and COO Justin Sims.
As the organization expanded, so too did the amount of sensitive information they handled. The team wanted a framework that could identify gaps in its existing security program and guide the implementation of stronger controls, while ultimately providing customers with independently validated assurance.
“We were looking for a framework that we could utilize to help us design a strong information security management system,” Sims says.
That need led the company to HITRUST.
A security framework for the healthcare industry
careMESH needed more than a general security framework. It wanted an approach that reflected the sensitive data, regulatory requirements, and customer expectations at the center of its business.
The careMESH team chose the HITRUST Framework (HITRUST CSF®) for a couple of reasons:
1. Sims was familiar with the framework, having implemented it at a prior company.
2. HITRUST’s roots in healthcare made it particularly relevant to the environment in which careMESH operates.
“As a healthcare technology company, we wanted to implement a security framework that considered the nuances and the complexities of the healthcare industry,” Sims says.
In HITRUST, the team found a framework that provided the level of protection they were looking for, both for the business and the information customers entrusted to them. careMESH pursued the HITRUST r2 validated assessment, a tailored, comprehensive cybersecurity assessment designed for organizations that manage highly sensitive data or operate critical systems and that can result in HITRUST r2 certification.
“The no-brainer moment for us when we were considering the various alternative frameworks was the simple fact that
HITRUST r2 is regarded by our customers as the gold standard,” Sims adds.
The stakes went far beyond certification.
“We actually look at it more in terms of ‘What is the cost of not doing it? What is the cost of failure?’ If we ever have a security incident or a breach, it would have severe implications on our company and its viability,” he says.
Building stronger security, control by control
The HITRUST Framework provided a structured path for strengthening careMESH’s security program. Through MyCSF®, the company could work systematically through the controls it needed to implement.
“It provides a very simple-to-use and strong framework to guide you through the process,” Sims says of MyCSF. “It really takes a lot of administrative burden away from an organization that’s trying to think through what types of controls to implement and how to implement them.”
Even though careMESH believed it had a solid security foundation, working methodically through the framework surfaced areas where the company could go further. Ultimately, careMESH implemented more than 300 controls.
“We haven’t just ticked a box and obtained certification for our security systems,” Sims says. “We’ve instead been walked through a process to implement really strong security controls.”
One example was phishing. HITRUST prompted the team to go beyond regular employee training and add ongoing simulated phishing tests with targeted follow-up training when needed.
Greater customer confidence and faster reviews
Implementing the framework strengthened careMESH’s controls. Having those controls independently assessed
through the HITRUST r2 assessment, and earning HITRUST r2 certification, gave customers evidence they could trust and reduced friction during security reviews.
“As soon as you mention that you are HITRUST certified, it eases a lot of concerns about doing business,” Sims says.
Healthcare organizations need to understand that the companies they partner with and share protected health information with have a strong and robust framework in place. Sims says HITRUST r2 certification gives customers greater confidence and “improves or speeds up the process of contracting and going through reviews.”
For one public health organization handling highly sensitive mental health data, the results of careMESH’s HITRUST r2 assessment checked many of the boxes the organization needed, considerably accelerating its internal security review process.
“Not only have we got the controls, but we’ve been audited,” Sims shares. “It wasn’t self attestation, it was an actual auditor coming and validating and verifying the controls that we’ve put in place. That really gave the customer a degree of confidence that they were looking for.”
A security framework built for more than certification
Certification helps with procurement and customer reviews, but Sims sees that as a secondary benefit to the security program itself.
“The principal reason for having the framework isn’t a certification, it’s to make sure that we protect the information assets that we manage,” Sims says.
Sims calls HITRUST a “guiding star” for protecting sensitive information. It’s more than a credential customers recognize. It gives the company a roadmap for putting strong, comprehensive security controls in place.
“Out of all of those that we have evaluated, the HITRUST Framework is the most robust and comprehensive framework that’s out there,” Sims says. “Not only is it something that customers and suppliers and other vendors appreciate and accept, it also gives me peace of mind when I go to bed at night knowing that we’ve got a security framework in place that is the best that we could find.”
About careMESH
careMESH delivers interoperability and provider engagement solutions that simplify how hospitals, health systems, payers,
public health agencies, and care teams connect, communicate, and coordinate care. Based in Northern Virginia, careMESH’s deeper mission is to help every healthcare organization deliver the kind of connected, personalized experience every patient deserves.