Helio Health: A 12-Month Encryption Exception With No CISO
Helio Health Analytics (2,000 staff) processes ePHI for 40 hospital clients under business associate agreements. Policy SEC-07 requires AES-256 encryption at rest with customer-managed keys for any system holding ePHI.
Marketing has procured a campaign platform that stores 12,000 patient email addresses and appointment preferences. The provider encrypts disks but offers no customer-managed keys, and its SOC 2 Type II report carries a carve-out for exactly that control. The contract auto-renews in 45 days.
The marketing director wants a 12-month exception. The CISO is on leave. The risk committee meets monthly. The exception standard says anything longer than 90 days requires risk committee approval, and the register currently shows 27 open exceptions, 9 of them past their expiry date.
1. What do you do in the next 45 days? Justify the decision path.
Read the worked answer
The request as framed cannot be granted. A 12-month exception is above 90 days, so the standard routes it to the risk committee. With the CISO away, the question is not 'who can say yes to 12 months' but 'what is the largest decision anyone is authorised to make right now'.
Path: the CISO's named delegate may grant a time-bound interim exception of up to 90 days, conditional and recorded, and must calendar the item for the next risk committee, which then decides whether to extend, require migration, or terminate the contract before renewal.
Conditions to attach:
- Data minimisation first - reduce the 12,000 patient identifiers to the minimum; tokenise or exclude direct identifiers, and confirm whether the dataset falls inside the BAA scope at all. If it does not, the exception may be unnecessary.
- Contract amendment: security addendum, breach notification in hours not weeks, right to audit, deletion certification at exit, and no subprocessor changes without notice.
- Named-user access with MFA, SSO-enforced, logs exported to the SIEM, and a documented exit/migration date before renewal.
Judgement: do not let the 45-day renewal clock force a rubber stamp. The renewal date is a negotiating lever, not a deadline for the risk decision - the decision can be 'renew only with the amendment'.
2. Which metrics would you put in front of the risk committee, and what does each actually tell them?
Read the worked answer
The committee is making a governance judgement, so the metrics must expose the pipeline and the ageing, not the activity.
Put these forward:
| Metric | Type | What it tells them |
|---|---|---|
| Exceptions past expiry (9 of 27) | KRI | The register is not being enforced; this is the headline number |
| Age distribution of open exceptions (buckets, not average) | KRI | Whether risk is ageing out or being rolled over indefinitely |
| Exceptions approved with a compensating control actually verified | KPI | Whether 'compensating control' is a real term or a slogan |
| % of ePHI systems meeting SEC-07 fully | KPI | Direction of travel on the underlying target state |
| Vendors holding ePHI with a carve-out on the encryption control | KRI | Concentration of the same failure across the portfolio |
What to avoid: counts of policies published, number of security awareness sessions run, or total exceptions raised. These measure output, not exposure, and they invite the committee to feel governed without being governed.
Point to make explicitly: 9 expired exceptions is not a reporting problem, it is a control failure. The remediation is a standing agenda item with a named owner per exception and an automatic escalation trigger - not another policy reminder. Report the aggregate exposure of those 9, because 27 individually-tolerable exceptions can sum to an intolerable portfolio position.
3. The marketing director escalates to the CFO, who says 'just sign it, I'll take the risk'. How do you respond?
Read the worked answer
Be constructive and precise: the CFO can own a risk, but the process decides how ownership is recorded, not whether it is recorded.
Points to make:
- Authority is not the issue; evidence is. A verbal 'I'll take the risk' is unenforceable and undocumented. If the firm is later asked by a client, auditor, or regulator why a carve-out was accepted, the answer must be a signed acceptance with the residual risk expressed in numbers, the compensating controls listed, and an expiry date.
- Ownership must sit with the business owner, not security. The marketing director's acceptance, endorsed by the CFO at the right forum, is defensible. Security's job is to make the trade-off visible, not to absorb the consequence.
- The three lines model matters here. Security (second line) can advise and monitor; it cannot substitute its judgement for the accountable executive's, and equally the executive cannot override a board-set appetite statement unilaterally. If SEC-07 exists because of a client BAA obligation, there is a contractual floor the CFO does not have the authority to waive.
Concrete resolution: offer a one-page decision record - risk described, residual quantified, conditions, owner, expiry, escalation trigger - and ask the CFO to sign that. In practice this either gets signed quickly (which is fine, and now auditable) or it surfaces that the CFO did not know the carve-out affected BAA obligations, which is the outcome you actually wanted.