Assignment Prompt & Instructions
[>Accounting homework help](https://www.sweetstudy.com/fields/business-finance-accounting)
## **Regulatory Analysis: Cybersecurity Practices Across Healthcare, Finance, and Federal Sectors**
### **Healthcare Sector: Protecting Patient Data Integrity**
The healthcare sector is a primary target for cybercriminals due to the high value of Protected Health Information (PHI) on the black market and the critical nature of medical services. Two pivotal pieces of legislation shaping cybersecurity in this field are the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.
**Key Components and Cybersecurity Implications** HIPAA introduced the “Security Rule,” which establishes national standards for protecting electronic PHI (ePHI). It mandates three types of safeguards: administrative (risk analysis and management), physical (facility access and workstation security), and technical (access controls and encryption). The cybersecurity implication of the HIPAA Security Rule is that healthcare providers must move beyond simple password protection to implement robust encryption for data both at rest and in transit (Standard & HHS, 2013).
The HITECH Act expanded these requirements by increasing the legal liability for non-compliance and widening the scope of HIPAA to include business associates (third-party vendors). Most notably, HITECH introduced the Breach Notification Rule, which requires entities to notify individuals and the Department of Health and Human Services (HHS) of any data breach involving unsecured PHI. This mandate has forced healthcare organizations to prioritize incident response planning and real-time monitoring. Without these controls, the financial penalties under HITECH can reach millions of dollars, creating a strong economic incentive for healthcare entities to adopt sophisticated intrusion detection systems (IDS) and automated threat-hunting tools (Adler-Milstein & Jha, 2017).
### **Finance Sector: Safeguarding Economic Stability**
The financial sector operates under some of the most stringent cybersecurity regulations, primarily because a systemic breach could destabilize the global economy. Two major regulations driving these practices are the Gramm-Leach-Bliley Act (GLBA) and the New York Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR Part 500).
**Compliance Expectations and Security Impacts** The GLBA requires financial institutions—including banks, credit unions, and insurance companies—to maintain the confidentiality of non-public personal information. Its core cybersecurity mechanism is the "Safeguards Rule," which expects institutions to develop a comprehensive, written information security program. Recent amendments to the Safeguards Rule have tightened compliance expectations, demanding that institutions implement multi-factor authentication (MFA), detailed data retention policies, and rigorous oversight of service providers (Federal Trade Commission [FTC], 2021). The security impact is a shift from checkbox-style compliance to a risk-based approach that requires continuous auditing of the digital supply chain.
At the state level, NYDFS Part 500 serves as a "gold standard" for the industry, often influencing national practices. It mandates that financial institutions appoint a Chief Information Security Officer (CISO) and perform regular penetration testing and vulnerability assessments. Unlike broader federal laws, NYDFS Part 500 requires senior management to certify their cybersecurity program’s compliance annually. This high-level accountability ensures that cybersecurity is viewed as a corporate governance issue rather than just a technical one, leading to increased investment in identity and access management (IAM) and specialized security operations centers (SOCs) (NYDFS, 2017).
### **Federal Government: Defending the National Infrastructure**
The federal government is responsible for some of the world’s most sensitive data, including national intelligence and citizens' personal records. Cybersecurity in this sector is governed by the Federal Information Security Modernization Act (FISMA) and Executive Order 14028, "Improving the Nation’s Cybersecurity."
**Key Provisions and Relevance** FISMA (updated in 2014) requires federal agencies to develop, document, and implement agency-wide programs to provide information security for the data and systems that support their operations. The law’s relevance lies in its integration with the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF). FISMA makes the NIST SP 800-53 security controls mandatory for all federal systems. This creates a standardized language of risk, ensuring that every agency, from the Department of Defense to the Social Security Administration, uses the same baseline for technical, operational, and management controls (NIST, 2014).
Executive Order 14028, signed in 2021, represents a modern pivot in federal cybersecurity. Its key provisions include the removal of barriers to sharing threat information between the government and the private sector, and a mandate for all federal agencies to adopt Zero Trust Architecture (ZTA). ZTA assumes that no user or system is inherentely trusted, requiring continuous verification of every request. This order also introduced the requirement for MFA and data encryption across the federal enterprise. The relevance of EO 14028 is profound; it effectively ended the era of "perimeter-based" security for the government, forcing a transition to more resilient, identity-centric security models that can withstand advanced persistent threats (The White House, 2021).
#### **References**
Adler-Milstein, J., & Jha, A. K. (2017). HITECH Act drove large gains in hospital electronic health record adoption. _Health Affairs_, 36(8), 1416-1422. [https://doi.org/10.1377/hlthaff.2016.1651](https://doi.org/10.1377/hlthaff.2016.1651)
Federal Trade Commission (FTC). (2021). _FTC strengthens safeguards rule to protect consumers' financial information_. [https://www.ftc.gov/news-events/news/press-releases/2021/10/ftc-strengthens-safeguards-rule-protect-consumers-financial-information](https://www.ftc.gov/news-events/news/press-releases/2021/10/ftc-strengthens-safeguards-rule-protect-consumers-financial-information)
National Institute of Standards and Technology (NIST). (2014). _FISMA background_. [https://csrc.nist.gov/projects/fisma](https://csrc.nist.gov/projects/fisma)
New York Department of Financial Services (NYDFS). (2017). _Cybersecurity requirements for financial services companies (23 NYCRR Part 500)_. [https://www.dfs.ny.gov/industry_guidance/cybersecurity](https://www.dfs.ny.gov/industry_guidance/cybersecurity)
Standard, S., & HHS. (2013). _Summary of the HIPAA security rule_. U.S. Department of Health and Human Services. [https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html)
The White House. (2021). _Executive order on improving the nation’s cybersecurity (EO 14028)_. [https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/)
– [\
\
RegulatoryAnalysis.docx](https://www.sweetstudy.com/files/regulatoryanalysis-docx "RegulatoryAnalysis.docx")
**Information Systems Assignment, paper**
NOT RATED
Purchase the answer to view it
plagiarism checkPurchase $20