HCIS 420 Week 1 Health Care IT Organizational Structure and Functions Example

Who Owns the Risk? The IT Organization of a 150-Bed Regional Hospital, Its Functions and Where Security Responsibility Sits

[Student Name]

University of Phoenix

HCIS/420: Information Systems Risk Management in Health Care

Week 1 Assignment

[Instructor Name]

[Date]

The hospital, its IT department and its figures are composites written for a model paper; frameworks and requirements come from the sources listed.

Last fall, a hospital two counties away was hit by ransomware and diverted ambulances for nine days. At the next board meeting of a composite 150-bed regional hospital, a trustee asked a simple question: who here is responsible for making sure that does not happen to us? Answering it required describing how the hospital's IT is organized, what each part does and where responsibility for information risk actually sits. This paper provides that description as the starting point for a risk management program.

Leadership

The chief information officer leads IT, reports to the chief financial officer and manages a department of 38 people and a budget of about $9 million. The CIO sets priorities, manages vendors, prepares the IT budget and represents IT on the executive team. An information security officer, a role created three years ago, reports to the CIO. A chief medical information officer, a practicing hospitalist with protected time, reports to the chief medical officer and works with IT on clinical systems. Sengstack et al. (2016) described this kind of clinical informatics executive as a bridge between clinicians and IT whose knowledge must span clinical practice, informatics and leadership.

Functional Teams

Applications: 14 analysts who configure and support the EHR, revenue cycle, laboratory, pharmacy and other systems. Infrastructure: eight engineers for servers, storage, network and the data center. Integration: two analysts who run the interface engine and 120 interfaces. Service desk: seven technicians who answer calls and support devices. Data and reporting: three analysts who build reports and quality measures. Security: the security officer and one analyst, who manage access reviews, vulnerability scans and incident response.

Vendors as Part of the IT Organization

Much of the hospital's technology is run by others. The EHR vendor hosts the production system, a managed service company monitors the network at night, the billing office uses an outside clearinghouse and dozens of application vendors have remote support access. These partners are effectively part of the IT organization, and each is a business associate with its own security obligations. The CIO's team manages the contracts, but no one had kept a single list of which vendors can reach which systems, a gap that matters for risk because vendor access is a common path for attackers.

Three Lines of Responsibility

One useful way to see the structure is in three lines. Operational teams, such as applications and infrastructure, own and manage risks in their daily work. The security officer and the compliance office set policy and check that risks are managed. Internal audit, reporting to the board's audit committee, independently tests whether the first two lines are working. At the hospital, the first two lines existed but overlapped, and internal audit had never reviewed IT.

Governance

Three bodies make decisions. The IT steering committee, chaired by the chief operating officer, approves projects and budgets. The security and privacy committee, which includes the security officer, privacy officer, compliance officer, CMIO and a nursing director, reviews policies and incidents. The board's audit committee receives a written security report twice a year from the CIO.

What the Rules Require

The HIPAA Security Rule requires each covered entity to identify a security official responsible for developing and implementing its security policies and procedures. Federal guidance on implementing the rule explains that this official should have the authority and resources to carry out the role and that security management must include risk analysis, risk management, a sanction policy and review of information system activity (Marron, 2024).

Governance at the Top

The National Institute of Standards and Technology (2024), in version 2.0 of its Cybersecurity Framework, added a Govern function alongside Identify, Protect, Detect, Respond and Recover. Govern covers establishing and monitoring the organization's cybersecurity risk strategy, expectations, policy, roles and oversight. The addition makes plain what the trustee's question implied: cybersecurity risk is an enterprise risk that leadership and the board own, not a technical matter delegated entirely to IT.

Answering the Trustee

Who is responsible? Formally, the security officer implements security; the CIO provides resources; the executive team sets risk tolerance; and the board oversees. In practice, the hospital's structure blurred these lines.

Gaps in the Structure

Four gaps stood out. First, the security officer reports to the CIO, who is also responsible for delivering projects on time, which can discourage the officer from raising risks that delay them. Second, the security team of two cannot keep up with access reviews for 1,400 users and 200 applications. Third, no one had defined the hospital's risk appetite, so no one could say with authority which risks were acceptable and which were not. Fourth, the board received security reports but no measures it could compare over time.

Recommendations

Move the security officer's reporting line to the chief compliance and risk officer, with a dotted line to the CIO. Add one security analyst and use a managed detection service for after-hours monitoring. Ask the executive team to adopt a written risk appetite statement. Give the audit committee a quarterly dashboard with a few measures, such as percentage of critical patches applied within 30 days, completion of the annual risk analysis and results of phishing tests.

How Structure Enables Risk Management

Later weeks of this course build a risk analysis and a risk management plan. Both depend on this structure: someone must own each risk, someone must have authority to accept or reduce it and someone must report on it. Without clear ownership, a risk register becomes a list that no one acts on. The structural fixes above therefore come first in the hospital's program, before any new security tools are bought.

Conclusion

The hospital's IT organization has capable teams and governance bodies, but security responsibility sat too close to project delivery, lacked staff and lacked a defined risk appetite. Clarifying ownership, as the HIPAA Security Rule and the national framework expect, prepares the hospital to identify, analyze and manage its information system risks.

References

Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66 Rev. 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2

National Institute of Standards and Technology. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29

Sengstack, P., Thyvalikakath, T. P., Poikonen, J., Middleton, B., Payne, T., Lehmann, C. U., & Kannry, J. (2016). The chief clinical informatics officer (CCIO): AMIA task force report on CCIO knowledge, education, and skillset requirements. Applied Clinical Informatics, 7(1), 143-176. https://doi.org/10.4338/ACI-2015-12-R-0174