Cybersecurity issues within the context of mergers and acquisitions (M&A) often are overlooked, but they’re tremendously important to consider, because poor cyber hygiene or unmitigated breaches are costly and could compromise the entire deal.
That’s the word from Anahi Santiago, chief information security officer for ChristianaCare, a health system in Newark, Delaware, who recently spoke at the National HIPAA Summit about how the high level of ongoing M&A activity in the health care sector can affect an organization’s cybersecurity activities.[1]
“You may be a health care system that is looking to acquire either smaller physician practices, a mid-sized community hospital or getting into a partnership with a third party to deliver care in a newer, innovative way,” Santiago said. “Or, you may be a smaller physician practice that is about to get acquired, and you’re considering becoming part of a large health care system.” ChristianaCare has what Santiago described as “a very aggressive acquisition strategy.”
It’s key for large health care systems that are looking at acquiring smaller entities to consider the smaller entity’s level of security compliance, Santiago said. “What’s the level of [compliance with] HIPAA and HITECH combined?” she asked. “Are they following industry best practices in terms of privacy and security? Have they done regular risk assessments? Have they deployed the technical and physical controls that are expected to be in place?”
Depending on where the entities function, global regulations such as the General Data Protection Regulation and state regulations might be an issue in terms of breach notification laws and “privacy laws that are often more strict than HIPAA,” Santiago said.
Cybersecurity issues not related to health care, such as the Payment Card Industry (PCI) data security standard, also should be considered before a merger or an acquisition, Santiago said. “I will share a story where we were looking to acquire a smaller physician practice,” she related. “And when we went in to do our due diligence, the server that processed their credit cards was actually acting as a doorstop for the open network closet that did not have enough heating to be able to remain closed. Imagine the conversations we had to have with our integration and business stakeholders around, ‘Whoa, that’s a problem.’ We’re certainly going to be able to figure out how to solve it, but getting ahead of some of these things before going right into an acquisition is certainly important.”
