The healthcare industry is exceedingly diverse, consisting of various organizations from small physician practices and large hospitals to laboratories, pharmaceutical companies, biomedical companies, payers (private, public, etc.), regulators, and public health organizations. All these organizations rely on the efficient and effective exchange of patient-related information.​ Security professionals should understand the diversity of the healthcare industry, the types of technologies, and flows of information that require various levels of protection, and how healthcare information is exchanged within the industry.​

The goal of this learning experience is to provide security professionals with the necessary knowledge to manage emerging healthcare technologies and to identify emerging threats utilizing these technologies throughout the information life cycle. As healthcare organizations partner with vendors, third parties, and other business associates to execute core and noncore business operations via the cloud and other service offerings, understanding how the organization’s information is shared, accessed, used, and destroyed becomes more important to the healthcare privacy and security practitioner.

The healthcare industry is seeing many emerging technologies, posing a challenge to security management as legacy systems and inadequately monitored devices are deployed in new ways. At the same time, regulations like GDPR and HIPAA are demanding higher levels of compliance for privacy and security. Managing data throughout its life cycle entails applying the CIA triad to each phase: creation, storage, use, sharing, archiving, and destruction. Finally, information technology management includes knowing the connectivity requirements for third parties that want, or need, to share information. The covered entity’s privacy and security protection practices must be met by the third party at an equivalent level. Data security professionals need to recommend the appropriate trust model and connection agreement for such third-party relationships.