While the National Cybersecurity Center of Excellence has upheld its mission to further practical, standards-based cybersecurity solutions since it was established in 2012, advances in technology in recent years have highlighted a need to integrate privacy.
"Our digital footprint is constantly growing, there's more data about us, our personal information is available and exposed," said U.S. National Institute of Standards and Technology Security Specialist Nakia Grayson. "Our objective is to look at privacy at NIST's NCCoE and highlight the importance of privacy and where it can fit. We identify those areas in the cybersecurity build and then come up with ways to address privacy risks in those specific areas."
The NCCoE — a partnership between the NIST, the state of Maryland and Montgomery County, Maryland — collaborates with industry organizations, government agencies and academic institutions to build practical solutions based on industry standards and best practices, using commercially available technology, to help address today's most pressing cybersecurity challenges.
The NCCoE creates guides targeting specific challenges in the public and private sectors, including industries like health care, as well as for broad, cross-sector technology, Grayson said, and currently has over 30 active cybersecurity projects.
One of the NCCoE's projects with the largest privacy component is the "Securing Telehealth Remote Patient Monitoring Ecosystem" guide, exploring how health care delivery organizations can leverage telehealth capabilities like remote patient monitoring, while improving cybersecurity and privacy controls. While remote patient monitoring technologies, which have been on the rise since the COVID-19 pandemic, can be convenient and cost-effective, they can also come with "security and privacy risks," according to the NCCoE guide.
"In the guide, we talk about the fact that you are changing the nature of the doctor/patient relationship," said MITRE Principal Julie Snyder, CIPP/G, CIPP/US, CIPM, CIPT, who leads privacy for the MITRE center that supports the NIST. "So instead of doctors taking vitals and drawing labs when you are right there in their office and physically present, you now have devices to do that more frequently and from a distance, no matter where you are. When setting up that solution, you now have more technologies and organizations involved than just the patient and the doctor, or the clinical organization. You now have other players in the game who are passing information from that device through a telehealth platform provider to your doctor at a health care delivery organization."
The NCCoE's project team performed a risk assessment in a virtual lab environment simulating the telehealth ecosystem and remote patient monitoring services, applied the NIST Cybersecurity Framework, NIST Privacy Framework and other relevant standards, and collaborated with health care, technology and telehealth partners.
The resulting practice guide points to a "holistic risk mitigation strategy" including foundational activities to identify and manage risk, like governance and risk assessments; safeguards such as identity management, authentication and access control; data security steps including securing and monitoring data storage, and protective technology; activities to enable the timely discovery of a cybersecurity incident like continuous monitoring for unauthorized personnel, devices, software and connections; and responses to contain the impact of a detected cybersecurity event, like response processes and procedures and mitigation activities.
While there's certainly value in remote patient monitoring, Snyder said privacy risks are inherently introduced, "just by putting more players in the game. We need to manage those new privacy risks so that we can take advantage of the capabilities offered by this technology."
"So you want to make some architectural decisions, for example, about when device readings are paired with patient data," Snyder said. "Our solution walks you through that and shows how we use the NIST Privacy Risk Assessment Methodology and NIST language around problematic data actions and privacy engineering objectives to frame that discussion. We show you things like which categories in the NIST Privacy Framework Core you can address to help manage the privacy risks in your remote patient monitoring solution."
For each project, the NCCoE works with a community of interest, which Snyder said informs the challenges it tackles. As it explores more projects in the privacy realm, Snyder and Grayson said privacy professionals and organizations can join those communities of interest and they are looking forward to connecting.
"We would love to work with more communities on privacy. We would love to explore more privacy topics with the communities we're already working with. It's all driven by what we hear from each community," Snyder said.
"We want to hear from privacy professionals if there are other areas we should work in more to help come up with solutions as it relates to privacy," Grayson added.
For more information or to get involved in the NCCoE's privacy work, email privacy-nccoe@nist.gov.
