Security Governance, Risk Management, and Compliance in eHealth
This domain tests how an eHealth organisation sets security direction, assigns accountability, and proves compliance to regulators and partners. Expect questions on governance bodies, risk methodology, control frameworks, and the evidence trail that connects policy to practice.
Governance and accountability
A board-approved security strategy, a named CISO or security lead, and a cross-functional security committee are baseline. Use a three-lines-of-defense model: operations owns controls, risk and compliance challenge them, and internal audit provides independent assurance. The policy hierarchy runs policy, standard, procedure, guideline. Align to the ISO 27001 ISMS, ISO 27799 for health informatics, the NIST Cybersecurity Framework 2.0, and HIPAA Security Rule safeguards.
Risk management
Inventory ePHI assets and data flows. For each risk, estimate likelihood and impact, calculate a score, and record a treatment: avoid, mitigate, transfer, or accept. Maintain a risk register with owner, due date, residual score, and review cadence. Third-party risk needs business associate agreements, security questionnaires, and right-to-audit clauses. Compliance mapping turns legal text into testable controls; keep evidence such as access reviews, training records, and restore tests.
Worked example
A telehealth vendor hosts ePHI in a public cloud. A ransomware scenario has likelihood 4 and impact 5, giving a score of 20, high. Treatment: enforce phishing-resistant MFA, immutable backups, and a signed BAA. Residual likelihood falls to 2, impact stays 5, score 10, medium. The CISO accepts residual risk with quarterly monitoring and documents the decision in the register. This supports the HIPAA risk-analysis and risk-management requirements and gives auditors a traceable rationale.
Traps
Treating the risk assessment as a one-off document. Equating compliance with security. Missing vendor and BAA oversight. Accepting risk verbally with no owner or date. Copying a generic template without mapping it to actual ePHI flows.