1 of 22

Building an Information

Assurance Strategy

for Sinai Chicago

NIST CSF | Regulatory Compliance | AI Governance | Risk Management

Daniza Neri · INFM 208 · June 2026

2 of 22

SECTION 1 · REGULATORY LANDSCAPE

Why NIST Compliance Matters at Sinai Chicago

SAFETY-NET HOSPITAL RISK PROFILE

100,000+ patients annually; life-critical services at stake [1]

REGULATORY CONVERGENCE

HIPAA, HITECH, and Illinois PIPA overlap and compound

RISING HEALTHCARE THREAT LANDSCAPE

93% increase in large breaches, 2018–2022 (HHS) [3]

Sinai cannot rely on ad hoc cybersecurity because the stakes are exceptionally high. As a safety-net health system that served more than 100,000 patients and families across four hospitals, 14 outpatient clinics, and two institutes in FY2023 [1], any disruption to critical systems can have a significant impact on vulnerable patient populations.

Exposure of protected health information or system downtime could affect emergency services, Labor and Delivery operations, or Mount Sinai Hospital's Level I trauma center, which serves as a critical trauma resource for Chicago's West Side [2].

HIPAA, HITECH, and the Illinois Personal Information Protection Act create overlapping cybersecurity, privacy, and breach-notification requirements that require a structured and coordinated approach to compliance.

The NIST Cybersecurity Framework provides a consistent framework for managing these obligations, reducing compliance gaps, and strengthening organizational resilience.

According to the U.S. Department of Health and Human Services, large healthcare breaches increased by 93 percent between 2018 and 2022 [3]. The NIST Cybersecurity Framework gives clinical, technical, and executive leaders a common language for identifying, managing, and reducing cybersecurity risk while supporting Sinai's regulatory and operational responsibilities.

This framework should be viewed as a strategic risk management tool rather than a compliance exercise.

3 of 22

HIPAA Security & Privacy Rules

Covered entity status: 8 facilities, 100,000+ patients and families served annually, generating ePHI at scale. [1]

IMPACTED AREA	RISK IF NON-COMPLIANT
EHR & clinical data (Epic)	OCR investigation, penalties up to $1.9M/yr
Medical device connectivity	Unencrypted PHI transmission violation
Business Associate Agreements	Shared liability for vendor breach

SECTION 1: REGULATORY 1 of 3

Sinai is a covered entity under HIPAA. With eight facilities serving more than 100,000 patients and families annually, the organization generates, stores, and transmits electronic protected health information at scale [1].

As a result, compliance with the HIPAA Security, Privacy, and Breach Notification Rules is a critical operational requirement [19]. This slide highlights three areas where HIPAA risk is most relevant to Sinai.

The first is EHR and clinical data within Epic. Unauthorized access to patient records can result in Office for Civil Rights investigations, financial penalties, reputational damage, and loss of patient trust. Because Epic serves as the organization's primary clinical platform, access control failures represent the most significant regulatory exposure point for Sinai, making strong access controls, audit logging, and continuous monitoring essential.

The second area is medical device connectivity. Network-connected medical devices routinely transmit patient information across clinical environments. HIPAA requires organizations to protect electronic protected health information during transmission, making encryption and secure transmission controls, supported by network segmentation, important safeguards for protecting electronic protected health information during transmission [19].

The third area is Business Associate Agreements. Sinai relies on vendors and partners to support clinical, operational, and technology services. If a vendor experiences a breach involving protected health information, Sinai may still face regulatory scrutiny and operational consequences. Maintaining current Business Associate Agreements and conducting ongoing vendor oversight are therefore essential components of HIPAA compliance.

For Sinai, HIPAA risk is concentrated in three areas: access to Epic and other clinical systems, the secure transmission of information through network-connected medical devices, and the oversight of third-party vendors that handle protected health information. These are the areas where leadership attention, governance, and security investments will have the greatest impact on reducing regulatory, operational, and patient-care risk.

4 of 22

HITECH Act

Strengthens HIPAA enforcement and breach notification requirements.

SECTION 1: REGULATORY 2 of 3

BREACH NOTIFICATION
60-day window to notify HHS and patients

INCREASED PENALTIES
Fines up to $50,000 per violation

VENDOR ACCOUNTABILITY
Business associates directly liable

The Health Information Technology for Economic and Clinical Health (HITECH) Act strengthens HIPAA enforcement and expands requirements related to electronic health information and breach notification. For Sinai, HITECH increases both regulatory accountability and financial exposure associated with data breaches. This slide highlights three areas where HITECH creates direct obligations for Sinai.

The first is breach notification. If a breach affects 500 or more individuals, Sinai must notify the U.S. Department of Health and Human Services, affected patients, and, in some cases, the media within 60 days of discovery [18]. Failure to meet this timeline can result in additional enforcement actions and increased regulatory scrutiny.

The second area is increased penalties. HITECH strengthened HIPAA enforcement by increasing financial consequences for noncompliance. Violations can result in fines of up to $50,000 per violation, with penalties increasing based on the level of negligence [18]. As a result, a single security incident can create significant financial and regulatory exposure.

The third area is vendor accountability. HITECH established direct accountability for business associates that create, receive, maintain, or transmit protected health information [18]. For Sinai, this means Business Associate Agreements must clearly define security, privacy, and breach notification responsibilities for cloud providers, billing partners, and other vendors with access to protected health information.

For Sinai, HITECH transforms cybersecurity incidents from technical events into regulatory and financial events. A delayed breach notification can trigger enforcement action, a security failure can result in substantial penalties, and a vendor breach can create organizational liability even when the incident originates outside the health system. Together, these requirements make incident readiness, vendor oversight, and compliance governance essential components of Sinai's overall risk management strategy.

5 of 22

Illinois Personal Information Protection Act

Governs personal information (PII) beyond the scope of HIPAA, including employee, billing, and community data.

ELEMENT	REQUIREMENT	SINAI IMPACT
Scope	Illinois residents' PII beyond PHI	Employee SSNs, payroll data
Notification	Most expedient time possible	Always-ready breach response
Security standard	Reasonable security measures	Aligns with NIST CSF
Biometric data	Governed separately under BIPA	Time-tracking systems in scope

SECTION 1: REGULATORY 3 of 3

The Illinois Personal Information Protection Act, or PIPA, expands data protection requirements beyond HIPAA by covering personally identifiable information belonging to Illinois residents [14].

For Sinai, this includes information that falls outside traditional healthcare records, such as employee Social Security numbers, payroll information, billing records, and other community data. This slide highlights four areas where PIPA creates obligations for Sinai.

The first is scope. While HIPAA focuses on protected health information, PIPA applies more broadly to personal information maintained by the organization.

As a result, Sinai must protect employee, financial, and operational data in addition to patient information [14].

The second area is notification. PIPA requires organizations to notify affected individuals in the most expedient time possible following a breach [14]. Unlike HIPAA's defined 60-day notification requirement, PIPA does not establish a specific timeline. This means Sinai must maintain an always-ready breach response capability rather than relying solely on federal notification deadlines.

The third area is the security standard. PIPA requires organizations to implement reasonable security measures to protect personal information [14]. These expectations align closely with the risk management and security controls found in the NIST Cybersecurity Framework, allowing Sinai to strengthen both compliance and cybersecurity through a unified approach.

The fourth area is biometric data. If Sinai uses fingerprint, facial recognition, or other biometric technologies for workforce access or time-tracking systems, those activities may also fall under the Illinois Biometric Information Privacy Act, or BIPA [14]. Because BIPA carries significant legal and litigation risk, any biometric data collection should be reviewed through a separate compliance and governance process.

For Sinai, PIPA expands the organization's responsibility beyond patient records. Employee information, breach readiness, security controls, and biometric data management all require ongoing oversight and should be incorporated into the organization's broader information assurance program.

6 of 22

Mission-Critical Assets & Services

SECTION 2: NIST CSF APPLICATION

CLINICAL SYSTEMS	Epic EHR PACS Lab systems	Patient safety
MEDICAL DEVICES	Infusion pumps Ventilators Monitors	Life-critical
NETWORK INFRASTRUCTURE	Clinical Wi-Fi VPN Cloud services	Availability
WORKFORCE & ACCESS	Large staff credential footprint MFA	Insider threat
COMMUNITY SERVICES	FQHC data Revenue cycle	Financial/PIPA

Sinai's information assets can be grouped into five mission-critical categories, each supporting essential clinical and operational services and each carrying a distinct risk profile [1].

The first category is Clinical Systems. These include the Epic Electronic Health Record system, Picture Archiving and Communication System imaging, and laboratory information systems. These platforms support patient care, clinical decision-making, and care coordination. Any disruption to these systems can directly affect patient safety and regulatory compliance.

The second category is Medical Devices, including infusion pumps, ventilators, and patient monitors. These assets represent Sinai's highest life-safety risk because they are directly involved in patient treatment and monitoring. Maintaining visibility into these devices and understanding where they are connected across the organization is critical for both patient safety and cybersecurity.

The third category is Network Infrastructure. This includes clinical Wi-Fi, virtual private networks, and cloud services. These systems provide the connectivity that supports clinical operations across the organization. The primary concern in this category is maintaining system availability and ensuring uninterrupted access to critical services.

The fourth category is Workforce and Access Management. Sinai manages a large staff credential footprint across clinical, administrative, and support roles and relies on identity and access management controls to protect access to clinical and business systems. This area represents the organization's primary exposure to insider threats, credential theft, and unauthorized access.

The fifth category is Community Services. This includes data managed through Federally Qualified Health Center programs and revenue cycle operations [1].

These services contain sensitive information and support the financial sustainability of the organization, creating both financial and regulatory risk, including obligations under the Illinois Personal Information Protection Act [14].

Together, these five categories represent the assets and services most critical to Sinai's mission. The risks shown in the right-hand column, including patient safety, life-critical operations, availability, insider threats, and financial and regulatory exposure, are the areas the NIST Cybersecurity Framework is designed to manage through its Identify, Protect, Detect, Respond, and Recover functions [8].

7 of 22

Identify

Strategic benefit: Full visibility across medical devices, clinical systems, and vendor technologies.

SECTION 2: NIST CSF

CURRENT STATE
Unknown networked medical devices
Incomplete asset inventory

FUTURE STATE
Enterprise device inventory program
Automated real-time asset discovery

The Identify function is the foundation of the NIST Cybersecurity Framework. An organization cannot effectively protect, detect, respond to, or recover from threats to assets that have not been identified [8].

This slide highlights two current-state gaps at Sinai and the future-state capabilities needed to address them.

The first gap is unknown networked medical devices. Many clinical devices, including infusion pumps, ventilators, and patient monitors, are connected to the network but may not be fully visible through existing inventory processes. Because these devices are often managed by both biomedical engineering and information technology teams, maintaining complete visibility can be challenging. The future state is an enterprise device inventory program that provides centralized visibility into all connected clinical devices across the organization.

The second gap is an incomplete asset inventory. Without a complete inventory of hardware, software, medical devices, and third-party technologies, Sinai cannot accurately assess risk or prioritize security investments. The future state is automated real-time asset discovery, which continuously identifies and updates assets as they are added, removed, or modified within the environment.

These gaps also have compliance implications. HIPAA Security Rule §164.308(a)(1) requires covered entities to conduct an accurate and thorough risk analysis of systems that create, receive, maintain, or transmit electronic protected health information [19]. A complete and current asset inventory is essential to meeting that requirement.

The strategic benefit is full visibility across medical devices, clinical systems, and vendor technologies. That visibility enables better risk management, stronger compliance, and provides the foundation for every other function within the NIST Cybersecurity Framework.

8 of 22

Protect

Strategic benefit: Reduces attack surface by retiring legacy systems and enforcing identity verification.

SECTION 2: NIST CSF

CURRENT STATE
Legacy medical device operating systems
Inconsistent MFA enforcement

FUTURE STATE
FDA-aligned technology lifecycle plan
Zero-trust segmentation + MFA rollout

The Protect function focuses on implementing safeguards that reduce the likelihood and impact of cybersecurity incidents.

This slide highlights two protection gaps at Sinai and the future-state controls needed to address them [8].

The first gap is medical device patch management complexity. Many network-connected medical devices require manufacturer validation and testing before software updates can be implemented, making traditional patch management more complex than in standard information technology environments [20].

As a result, traditional patch management strategies are not always feasible for these devices. The future state is an FDA-aligned technology lifecycle plan that establishes update schedules, clearly defines vendor accountability, and implements compensating controls for devices that cannot be patched through standard methods.

The second gap is inconsistent multi-factor authentication enforcement. While multi-factor authentication is one of the most effective controls for preventing unauthorized access [8][22], implementation across healthcare environments is often inconsistent because security requirements must be balanced with clinical workflow efficiency.

The future state is a zero-trust security model combined with enterprise-wide MFA enforcement, ensuring that users and devices are continuously verified before accessing clinical and business systems.

Together, these controls significantly reduce Sinai's attack surface. Medical device risks are addressed through structured lifecycle management, while stronger identity verification reduces the likelihood of credential-based attacks. The strategic benefit is a more resilient security posture that protects clinical operations, patient information, and critical systems while supporting the organization's long-term cybersecurity objectives.

9 of 22

Detect

Strategic benefit: Shifts Sinai from reactive breach response to proactive threat detection.

SECTION 2: NIST CSF

CURRENT STATE
Credential attacks going undetected
No behavioral baseline for anomalies

FUTURE STATE
AI-assisted behavioral monitoring (UEBA)
Automated alerts for anomalous access

The Detect function focuses on identifying cybersecurity threats and suspicious activity before they can cause significant operational or clinical disruption.

This slide highlights two current-state gaps at Sinai and the future-state capabilities needed to address them [8].

The first gap is credential attacks going undetected. Credential-based attacks, including phishing, password spraying, and the misuse of stolen login information, are among the most common causes of healthcare data breaches.

The 2024 Change Healthcare ransomware attack, which affected nearly 190 million individuals, was linked to the absence of multi-factor authentication on a Citrix remote access portal, as confirmed by UnitedHealth Group CEO Andrew Witty in congressional testimony [22]. Without the ability to identify unusual access patterns in real time, organizations may not detect a credential-based intrusion until significant harm has already occurred.

The future state is AI-assisted behavioral monitoring using User and Entity Behavior Analytics, or UEBA, which continuously analyzes user activity and identifies patterns that deviate from expected behavior.

The second gap is the absence of a behavioral baseline for anomalies. Sinai generates large volumes of user activity data through Epic and other clinical systems. Without a baseline for normal behavior, it becomes difficult to distinguish legitimate activity from suspicious access.

The future state is automated alerts for anomalous access, which notify security teams in real time when activity falls outside expected behavioral patterns for a specific user, role, location, or time period.

The strategic benefit is a shift from reactive breach response to proactive threat detection. By establishing behavioral baselines and continuously monitoring for abnormal activity, Sinai can identify potential threats earlier, reduce response times, and strengthen protection of patient information and clinical systems.

10 of 22

Respond

Strategic benefit: Faster coordinated response that protects patient care during cyber incidents.

SECTION 2: NIST CSF

CURRENT STATE
Limited clinical leadership in incident response
Incident plan untested with clinical scenarios

FUTURE STATE
Cyber Incident Clinical Leadership Committee
Quarterly tabletop exercises

The Respond function focuses on minimizing the impact of cybersecurity incidents through coordinated decision-making, communication, and recovery actions. In a healthcare environment, a cybersecurity incident is also a patient safety event.

For this reason, incident response cannot be managed solely by the information technology department [8]. This slide highlights two current-state gaps at Sinai and the future-state capabilities needed to address them.

The first gap is limited clinical leadership in incident response. When a cybersecurity incident affects clinical systems, decisions about patient care, staff communication, and operational continuity must be made alongside technical containment efforts.

The future state is a Cyber Incident Clinical Leadership Committee that includes the Chief Medical Officer, Chief Nursing Officer, Chief Information Officer, and Information Security Director. This multidisciplinary structure ensures that clinical, operational, and technical decisions are made simultaneously during an incident, reducing disruption to patient care and organizational operations.

The second gap is an incident plan that has not been tested with clinical scenarios. A plan that exists only on paper provides limited protection during an actual event. The future state is quarterly tabletop exercises that include Code Downtime scenarios, which simulate the unavailability of Epic and other critical systems. These exercises allow staff to practice paper-based workflows and downtime procedures so that safe patient care can continue during a cyber event.

The importance of an integrated response strategy was demonstrated during the 2023 Prospect Medical Holdings ransomware attack, which resulted in emergency department closures, ambulance diversions, and significant operational disruptions across multiple states [7]. This event illustrates why healthcare organizations must coordinate clinical and technical response activities to protect patient safety and maintain operational continuity during a cybersecurity incident.

The strategic benefit is a coordinated clinical and information technology response that reduces time to containment and protects patient safety [7].

11 of 22

Recover

Strategic benefit: Measurable recovery targets that reduce downtime and strengthen resilience.

SECTION 2: NIST CSF

CURRENT STATE
No tested disaster recovery timeline
Vendor recovery gaps in business continuity planning

FUTURE STATE
Quarterly DR exercises with defined RTOs/RPOs
Contractual vendor SLA enforcement

The Recover function focuses on restoring critical systems and operations following a cybersecurity incident or other disruptive event.

This slide highlights two recovery gaps at Sinai and the future-state capabilities needed to address them [8].

The first gap is the absence of a tested disaster recovery timeline. While backup systems may exist, recovery capabilities cannot be assumed without regular validation. For Sinai, recovery planning should prioritize critical systems such as Epic EHR and PACS imaging because of their direct impact on patient care, clinical decision-making, and operational continuity.

The future state is a disaster recovery program that includes quarterly recovery exercises and clearly defined Recovery Time Objectives, or RTOs, and Recovery Point Objectives, or RPOs, aligned with clinical and business requirements.

The second gap is vendor recovery dependencies within the business continuity plan. Sinai relies on external technology providers to support critical operations, including cloud services and clinical applications.

The future state is contractual enforcement of vendor service-level agreements, ensuring that recovery commitments, uptime expectations, and support obligations align with the organization's operational needs and are validated through business continuity planning.

The strategic benefit is measurable recovery targets that are tested and validated through regular exercises. By establishing recovery objectives and strengthening vendor accountability, Sinai can improve operational resilience, reduce downtime risk, and maintain continuity of patient care during and after a major cyber incident.

12 of 22

Asset Protection Across NIST CSF

ASSET	IDENTIFY	PROTECT	DETECT	RESPOND	RECOVER
Epic EHR	Asset inventory	MFA + RBAC	UEBA	CICLC	RTO < 4hr
Medical devices	Inventory	Segmentation	Anomaly alerts	Isolation	Manual fallback
Clinical network	Asset map	Zero trust	IDS/IPS	Containment	Redundancy
Staff credentials	IAM audit	MFA enforcement	Behavioral monitoring	Disable & notify	Re-provision
Revenue cycle	Data map	Encryption	DLP alerts	Breach notify	PIPA notification

SECTION 2: ASSET TO CSF MAP

This matrix demonstrates how the five NIST Cybersecurity Framework functions work together to protect Sinai's mission-critical assets [8].

Using Epic EHR as an example, the Identify function ensures the system is documented within the organization's asset inventory.

The Protect function applies safeguards such as multi-factor authentication and role-based access controls, or RBAC.

The Detect function uses User and Entity Behavior Analytics, or UEBA, to monitor activity and identify potential threats.

The Respond function activates the Cyber Incident Clinical Leadership Committee to coordinate clinical, operational, and technical response activities.

The Recover function establishes recovery objectives, including a target Recovery Time Objective of less than four hours.

The same approach is applied across the remaining four asset categories. Medical devices require inventory management, network segmentation, anomaly detection, isolation procedures, and manual fallback capabilities.

Clinical networks rely on asset mapping, zero-trust protections, intrusion detection and prevention systems, containment procedures, and redundancy planning.

Workforce credentials depend on identity and access management audits, multi-factor authentication enforcement, behavioral monitoring, account suspension and notification procedures, and rapid reprovisioning.

Revenue cycle systems require data mapping, encryption, data loss prevention monitoring, breach notification processes, and regulatory reporting under the Illinois Personal Information Protection Act [14].

This matrix serves as a practical governance and investment tool. Each intersection of an asset and a NIST CSF function represents a control that must be implemented, maintained, and validated. By evaluating assets across all five functions, leadership can identify gaps, prioritize investments, and ensure that cybersecurity efforts are aligned with patient care, operational continuity, and regulatory requirements.

The objective is to ensure that every critical asset has a documented and verifiable control associated with each NIST CSF function. A mature cybersecurity program is built on controls that can be measured, tested, and continuously improved.

13 of 22

NIST CSF Maturity Roadmap

SECTION 2: MATURITY ROADMAP

Scale (1–4) reflects NIST CSF 2.0 Implementation Tiers: Partial, Risk-Informed, Repeatable, Adaptive. [8]

Strategic benefit: Prioritizes investments where maturity gaps create the greatest organizational risk.

The maturity assessment is based on the NIST Cybersecurity Framework 2.0 Implementation Tier model, which ranges from Tier 1 (Partial) to Tier 4 (Adaptive) [8].

These tiers provide a structured method for evaluating how effectively cybersecurity practices are integrated into organizational operations, governance, and risk management processes. Based on the gaps identified throughout this assessment, Sinai currently operates between Tier 1 and Tier 2 across the five NIST CSF functions. Identify, Detect, and Recover demonstrate the lowest levels of maturity, with scores of approximately 1.5.

These scores reflect gaps in asset visibility, automated threat detection, and validated recovery capabilities. Protect and Respond show slightly higher maturity at Tier 2 but remain largely risk-informed rather than repeatable or adaptive. The target state is Tier 3 to Tier 4 maturity across all five functions within the next 12 months. Achieving this level will require stronger governance, improved asset visibility, expanded monitoring capabilities, tested recovery procedures, and greater integration of cybersecurity into operational decision-making.

This roadmap also serves as a capital planning tool. Identify and Detect should receive priority funding because they represent the largest maturity gaps and have a direct impact on the effectiveness of the remaining NIST CSF functions. Investments in asset visibility and threat detection create the foundation for stronger protection, response, and recovery capabilities across the organization.

The strategic benefit is a structured approach to prioritizing investments where maturity gaps create the greatest organizational risk. By focusing resources on the lowest-maturity functions first, Sinai can accelerate overall program maturity and strengthen its cybersecurity resilience.

14 of 22

Five Immediate Security Policies

MEDICAL DEVICE SECURITY

Segmentation & Vendor Accountability

IDENTITY & ACCESS MANAGEMENT

MFA & Least-Privilege Access & Quarterly Review

INCIDENT RESPONSE & BREACH NOTIFICATION

CICLC Activation & Code Downtime Testing

AI GOVERNANCE & ACCEPTABLE USE

BAA & Bias Assessment before Deployment

VENDOR RISK MANAGEMENT

SOC 2 Type II & Annual Vendor Review

SECTION 3: SECURITY POLICY

The five recommended policies address Sinai's highest-priority cybersecurity, compliance, and operational risks. Together, they provide the governance foundation needed to support the organization's cybersecurity maturity goals and regulatory obligations.

Medical Device Security should be the organization's first priority because of the direct impact that compromised devices can have on patient safety. This policy should require network segmentation for connected clinical devices and establish clear vendor accountability for security updates, vulnerability remediation, and lifecycle management [8][19][20].

Identity and Access Management addresses one of the most common causes of healthcare data breaches: unauthorized access through compromised credentials. This policy should require multi-factor authentication, enforce least-privilege access principles, and establish quarterly access reviews to ensure permissions remain appropriate [8][19].

Incident Response and Breach Notification support compliance with HIPAA and HITECH requirements while strengthening operational resilience. The policy should define breach response timelines, establish procedures for activating the Cyber Incident Clinical Leadership Committee, and require regular testing of Code Downtime procedures to support continuity of patient care during system outages [18].

AI Governance and Acceptable Use provide a framework for the safe and responsible adoption of artificial intelligence technologies. Any AI solution that creates, receives, maintains, or processes protected health information should require a HIPAA-compliant Business Associate Agreement [18]. The policy should also require documented bias assessments, governance review before deployment, clearly defined acceptable-use requirements, and ongoing monitoring responsibilities [11].

Vendor Risk Management addresses the increased third-party accountability requirements established under HITECH [18]. This policy should require vendors handling protected health information to maintain current Business Associate Agreements, provide SOC 2 Type II reports when applicable, participate in annual security reviews, and complete security assessments as part of ongoing vendor oversight.

To ensure accountability and successful implementation, each policy should be formally approved by executive leadership and assigned to a designated owner responsible for oversight, compliance, and continuous improvement.

15 of 22

AI-Enhanced Security Operations

ANOMALY DETECTION (UEBA)

COMPLIANCE MONITORING

SECTION 3: AI IN SECURITY OPERATIONS

INCIDENT TRIAGE AUTOMATION

PREDICTIVE VULNERABILITY SCORING

Focuses remediation resources on vulnerabilities with the highest organizational risk
Prioritizes high-impact systems over lower-risk administrative assets

Priority 2: Future Enhancement

Priority 1: Immediate Implementation

Reduces unauthorized PHI access risk through early identification of unusual behavior
Improves threat detection across Epic and clinical systems without disrupting workflows

Automates audit log review against HIPAA Security Rule requirements, reducing manual reporting effort
Improves documentation consistency and readiness for Office for Civil Rights reviews

Reduces alert fatigue by classifying and routing events by risk level
Accelerates investigation response times for the security team

Strategic benefit: Extends security team capacity through automation while maintaining human oversight.

Given Sinai's current cybersecurity maturity level of Tier 1 to Tier 2, the initial focus should be on AI applications that provide measurable operational value while requiring minimal disruption to existing clinical and security workflows. The four use cases shown on this slide represent a phased approach to AI-enhanced security operations [8].

Priority 1 includes two immediate implementation use cases.

The first is Anomaly Detection using User and Entity Behavior Analytics, or UEBA. These tools establish normal patterns of activity for different user roles within systems such as Epic and can identify unusual behaviors such as large-scale patient record access, after-hours logins, or impossible-travel scenarios. By identifying suspicious activity earlier, UEBA strengthens threat detection and helps protect electronic protected health information [8].

The second Priority 1 use case is Compliance Monitoring. AI-assisted analytics can automatically review audit logs and security events against HIPAA Security Rule requirements, helping identify compliance gaps and organize audit evidence [19]. Automating these activities reduces administrative burden while improving consistency, visibility, and readiness for compliance reviews.

Priority 2 includes two future enhancement use cases. The first is Incident Triage Automation. Security teams often receive large volumes of alerts from multiple systems. AI-assisted triage can classify alerts by severity, eliminate obvious false positives, and route higher-risk events for investigation. This improves response efficiency and allows security staff to focus on the most critical threats.

The second Priority 2 use case is Predictive Vulnerability Scoring. These tools can incorporate exposure, asset criticality, and threat intelligence to identify which vulnerabilities present the greatest organizational risk.

This allows Sinai to prioritize remediation efforts and focus resources on systems that have the greatest potential impact on patient care and operations. AI is intended to augment, not replace, cybersecurity professionals. By automating repetitive monitoring, analysis, and prioritization tasks, AI enables the security team to operate more effectively across a large and complex healthcare environment while allowing staff to focus on higher-value risk management and incident response activities.

16 of 22

AI Governance: Ethics, Risk & Frameworks

SECTION 3: AI GOVERNANCE & ETHICS

ACTION	GOVERN UNDER
Algorithmic Bias	NIST AI RMF
Transparency Gap	EU AI Act
Data Governance	NIST AI RMF
Operational Reliability	NIST AI RMF

Govern AI systems using recognized frameworks before deployment into clinical, operational, or security workflows

Artificial intelligence governance extends beyond cybersecurity and compliance. For Sinai, AI governance must also address ethical, operational, and patient safety considerations before any AI solution is deployed [11].

This slide highlights four key governance areas and the frameworks that can be used to manage them.

The first area is algorithmic bias, which should be governed using the NIST Artificial Intelligence Risk Management Framework [11]. AI systems trained on incomplete or non-representative datasets can produce biased recommendations, risk scores, or security alerts. Because Sinai serves a diverse patient population, including large Black and Latino communities [1], bias testing should be conducted before deployment and throughout the system lifecycle to help ensure equitable outcomes and reduce unintended disparities.

The second area is explainability and transparency, which aligns with principles found in the European Union AI Act [15]. AI systems that function as black boxes can create challenges during audits, investigations, and clinical reviews when users cannot understand how a recommendation or decision was generated. Explainability should therefore be a key criterion during vendor selection and governance review.

The third area is data governance and privacy, which is also addressed by the NIST AI Risk Management Framework [11]. Any AI system that creates, receives, maintains, or processes electronic protected health information must comply with HIPAA privacy and security requirements [19]. Data quality, access controls, and appropriate de-identification practices should be evaluated before any AI solution is approved for use.

The fourth area is operational reliability, which is also addressed by the NIST AI Risk Management Framework [11]. False-positive alerts can disrupt workflows and consume staff resources, while false-negative results may allow legitimate threats or patient safety concerns to go undetected. AI systems should therefore support human decision-making rather than operate autonomously in high-impact clinical or security environments.

To provide appropriate oversight and accountability, Sinai should establish an AI Ethics Review Board composed of representatives from clinical leadership, information technology, compliance, legal, privacy, and community stakeholders. The board should evaluate AI solutions against recognized governance frameworks, including the NIST AI Risk Management Framework and the European Union AI Act, before deployment. This governance process helps ensure that AI technologies support patient safety, regulatory compliance, operational reliability, and equitable outcomes across the organization.

17 of 22

SECTION 4: RISK ASSESSMENT

Risk Assessment Methodology

RISK ASSESSMENT
Scope & Asset Inventory Healthcare Threat Identification Vulnerability Analysis Patient Safety & Operational Impact Scoring Risk Prioritization & Treatment Planning

RISK REGISTER OUTPUT
Risk Description Impact & Likelihood Assigned Risk Owner Mitigation Strategy Treatment Decision

PRIORITIZED REMEDIATION ROADMAP
Resource Allocation Budget Prioritization Implementation Timeline

The risk assessment process should follow a structured methodology that aligns with HIPAA requirements and industry best practices while accounting for the unique operational realities of a healthcare environment [12][19]. This approach also reflects recognized security gap assessment practices that compare an organization's current security posture against established frameworks and identify prioritized remediation opportunities.

The first step is Scope and Asset Inventory. The assessment should include all systems that create, receive, maintain, or transmit electronic protected health information, personally identifiable information, or support life-critical clinical functions. Particular attention should be given to network-connected medical devices, which often present unique cybersecurity and patient safety risks [12][19][20].

The second step is Healthcare Threat Identification. Sinai should leverage multiple intelligence sources, including guidance from HHS cybersecurity resources and other healthcare-focused threat intelligence sources that identify vulnerabilities actively being exploited across the healthcare sector [13]. These sources help ensure the organization evaluates threats that are relevant to its operating environment.

The third step is Vulnerability Analysis. Technical assets should be assessed using vulnerability management tools, while medical devices should be evaluated using healthcare-specific platforms. Vulnerabilities should be prioritized not only by technical severity scores but also by their potential impact on patient care and clinical operations [12].

The fourth step is Patient Safety and Operational Impact Scoring. Risk scoring should incorporate both likelihood and impact. In a healthcare environment, impact assessments must extend beyond financial loss and reputational damage to include patient safety considerations. For example, a vulnerability affecting an infusion pump or patient monitoring system may present a significantly higher risk than the same vulnerability affecting a non-clinical administrative workstation because of its potential effect on patient outcomes [12][20].

The fifth step is Risk Prioritization and Treatment Planning. Identified risks should be categorized according to one of four treatment strategies: accept, mitigate, transfer, or avoid. Recommended actions should include estimated implementation costs and resource requirements so that remediation activities can be aligned with organizational budgeting and strategic planning processes [12].

The primary output of this process is a formal risk register that documents risk descriptions, impact and likelihood ratings, assigned risk owners, mitigation strategies, and treatment decisions. This output serves as the foundation for a prioritized remediation roadmap that supports resource allocation, budget planning, and implementation timelines [12].

This methodology supports compliance with HIPAA Security Rule §164.308(a)(1), which requires covered entities to conduct an accurate and thorough risk analysis [19]. It also produces defensible, audit-ready documentation that supports regulatory reviews, leadership decision-making, and continuous cybersecurity program improvement.

18 of 22

Gap Analysis & Strategic Priorities

GAP	IMPACT	PRIORITY
Medical Device Inventory	Patient Safety	Immediate
Disaster Recovery Testing	Clinical Continuity	Q3 2026
Vendor Risk Management	Regulatory & Third-Party Risk	Q3 2026
AI-assisted Monitoring	Threat Detection	Q4 2026
AI Governance & Acceptable Use	AI Risk Management	Year 1

12-month investment: $295K–$440K | Average healthcare breach cost: $7.42M [9]

SECTION 4: GAP ANALYSIS

The prioritized remediation roadmap identifies five initiatives that will have the greatest impact on Sinai's cybersecurity maturity, regulatory compliance, patient safety, and operational resilience over the next 12 months [8][12]. These priorities were derived from the risk assessment and gap analysis process by comparing Sinai's current security posture against NIST Cybersecurity Framework recommendations, healthcare cybersecurity best practices, and regulatory requirements.

The highest-priority initiative is the development of a comprehensive Medical Device Asset Inventory. Network-connected medical devices support critical patient care functions, yet visibility is often fragmented across information technology and biomedical engineering teams. Without a complete inventory,

Sinai cannot effectively assess risk, prioritize remediation efforts, or satisfy risk analysis requirements under the HIPAA Security Rule [19]. Implementing a healthcare-specific asset discovery platform is estimated to cost between $85,000 and $120,000 and should be treated as an immediate priority.

The second priority is Disaster Recovery Testing. While backup capabilities may exist, recovery objectives and restoration procedures must be validated through regular testing to ensure critical systems can be restored within acceptable timeframes [8]. Establishing a disaster recovery testing program with defined Recovery Time Objectives and Recovery Point Objectives is estimated to cost between $40,000 and $60,000 and should be completed during the next planning cycle.

The third priority is strengthening Vendor Risk Management. Sinai depends on numerous third-party vendors, cloud providers, and business associates that may create, receive, maintain, or transmit protected health information. Current oversight should be expanded beyond Business Associate Agreement reviews to include formal security assessments, ongoing monitoring, and vendor accountability measures [18]. This initiative is estimated to require an investment of $30,000 to $50,000.

The fourth priority is the implementation of User and Entity Behavior Analytics and AI-assisted monitoring capabilities. Current monitoring processes rely heavily on manual review of security event data [8]. Deploying behavioral analytics and automated alerting capabilities is estimated to cost between $120,000 and $180,000 and would significantly improve threat detection, incident response, and overall security operations.

The fifth priority is the development of a formal AI Governance and Acceptable Use Policy. As artificial intelligence becomes increasingly integrated into healthcare and cybersecurity workflows, Sinai requires a structured governance framework to address bias, transparency, privacy, security, and oversight responsibilities [11]. Policy development, governance planning, and legal review are estimated to cost between $20,000 and $30,000 during the first year.

The total estimated investment for these initiatives ranges from approximately $295,000 to $440,000 over a 12-month period. Compared with the healthcare industry's average data breach cost of $7.42 million, reported by IBM in 2025 [9], this investment represents a proactive approach to reducing organizational risk.

More importantly, these initiatives strengthen patient safety, improve regulatory compliance, increase operational resilience, and establish the governance foundation required to support future technology and AI investments. Cost estimates are based on healthcare industry implementation ranges and vendor pricing benchmarks and should be validated through formal procurement processes.

19 of 22

SWOT Analysis: Sinai Chicago IA Program

SECTION 4: SWOT ANALYSIS

STRENGTHS	WEAKNESSES
Epic EHR audit & access controls	Cybersecurity leadership embedded within IT governance
Established HIPAA compliance culture	Legacy devices with unpatched OS
HIPAA-compliant cloud infrastructure in place	Limited security budget vs. peers
Community trust and mission engagement	No formal AI governance structure

OPPORTUNITIES	THREATS
HHS Cybersecurity Performance Goals	Ransomware targeting safety-net hospitals
HRSA cybersecurity funding opportunities	Third-party vendor breach precedents
ARPA-H healthcare resilience initiatives	Illinois BIPA litigation exposure
AI extends small security team's reach	AI-generated phishing on the rise

The SWOT analysis highlights both the organizational strengths that can accelerate cybersecurity improvements and the challenges that require strategic attention. Several existing strengths can be leveraged immediately to improve the Identify and Protect functions of the NIST Cybersecurity Framework [8].

These include Epic EHR's built-in audit logging and access control capabilities, an established culture of HIPAA compliance supported by a dedicated Privacy Officer, existing cloud infrastructure that supports HIPAA-compliant clinical operations, and a workforce strongly aligned with Sinai's safety-net healthcare mission [1]. These assets provide a strong foundation for enhancing security controls without requiring a complete redesign of existing processes.

The organization also faces several important weaknesses. Cybersecurity leadership currently operates as a director-level function within the information technology organization [4]. While dedicated security leadership exists, healthcare organizations are increasingly elevating cybersecurity governance to positions with greater organizational visibility and influence. Sinai should evaluate whether its current governance structure provides sufficient authority, resources, and strategic oversight to support long-term cybersecurity objectives. Additional challenges include medical devices that may require manufacturer validation and testing before updates can be implemented [20], cybersecurity funding levels that may be lower than those of larger academic medical centers, and the absence of a formal AI governance framework [11].

Several opportunities can support future program development. The HHS Cybersecurity Performance Goals provide a recognized framework that can strengthen security controls and improve alignment with healthcare cybersecurity best practices [13]. Sinai may also benefit from federal cybersecurity and resilience initiatives sponsored by the Advanced Research Projects Agency for Health, including the UPGRADE program, which focuses on strengthening hospital cybersecurity and medical device resilience [21]. These initiatives may help offset implementation costs associated with cybersecurity modernization efforts. AI-assisted monitoring and analytics also offer an opportunity to expand the effectiveness of the security program without requiring significant increases in staffing [8].

The threat landscape continues to evolve rapidly. Ransomware attacks increasingly target healthcare organizations with limited cybersecurity resources because operational disruptions can create pressure to restore services quickly [3]. Third-party vendor breaches remain a significant source of risk, highlighting the importance of annual vendor security reviews, updated Business Associate Agreements, and continuous monitoring of business associates [18]. Organizations that use biometric technologies may also face legal exposure under the Illinois Biometric Information Privacy Act if governance requirements are not met [14].

Finally, AI-generated phishing campaigns are becoming increasingly sophisticated and represent a growing threat to credential security and workforce awareness programs [11]. Taken together, these findings reinforce the need for stronger governance, improved asset visibility, enhanced monitoring capabilities, and formal AI oversight as Sinai continues to mature its cybersecurity program [8][11].

20 of 22

Executive Summary

COMPLIANCE CONVERGENCE IS A STRATEGIC ADVANTAGE

One IA program satisfies HIPAA, HITECH, and PIPA

THREE IMMEDIATE ACTIONS

Device inventory · MFA on Epic · 90-day DR exercise

AI AS A FORCE MULTIPLIER WITH GUARDRAILS

Extends team capacity under NIST AI RMF governance

THE INVESTMENT CASE

$295–440K program cost vs. $7.42M average breach cost [9]

SECTION 5 · SUMMARY

This presentation highlights four key conclusions for executive leadership.

First, HIPAA, HITECH, and the Illinois Personal Information Protection Act align closely with the controls and risk management practices defined in the NIST Cybersecurity Framework. By implementing a unified Information Assurance program based on NIST CSF, Sinai can address multiple regulatory requirements through a single governance structure, reducing duplicated compliance efforts while strengthening audit readiness and overall cybersecurity resilience [8][14][18][19].

Second, three actions should be prioritized within the next 90 days. The organization should establish a comprehensive medical device asset inventory, require multi-factor authentication for all Epic EHR access, and conduct a disaster recovery tabletop exercise. These initiatives address the highest-priority risks identified during the assessment and provide meaningful improvements in security, compliance, and operational continuity at a relatively modest cost [8][12].

Third, AI-assisted monitoring offers a practical opportunity to improve cybersecurity operations without increasing staffing levels. However, successful adoption depends on the establishment of a formal AI Governance and Acceptable Use framework. Policies addressing algorithmic bias, explainability, data governance, privacy, and human oversight should be implemented before AI technologies are deployed. Governance must precede automation to ensure that AI supports organizational objectives while maintaining compliance and patient trust [8][11].

Finally, the financial case for investment is compelling. The estimated 12-month implementation cost of approximately $295,000 to $440,000 is significantly lower than the healthcare industry's average data breach cost of $7.42 million [9]. These investments should be viewed as strategic risk reduction measures that strengthen patient safety, regulatory compliance, and organizational resilience. In addition, the governance structures established through this program create the foundation necessary to support future artificial intelligence initiatives across clinical, operational, and cybersecurity functions.

For Sinai's leadership team, the path forward is clear. The NIST Cybersecurity Framework provides the strategic structure, the three priority initiatives establish the near-term roadmap, and the five recommended policies create the governance foundation needed to support long-term cybersecurity maturity, operational resilience, and responsible innovation [8].

21 of 22

[1] Sinai Chicago. (2024). 2023 annual report. https://www.sinaichicago.org/wp-content/uploads/2024/03/2023_Annual-Report_Sinai-Chicago.pdf

[2] Mount Sinai Hospital Medical Center. (n.d.). GuideStar nonprofit profile [Self-reported organizational profile, EIN 36-1509000]. Candid/GuideStar. https://www.guidestar.org/profile/36-1509000

[3] U.S. Department of Health and Human Services, Administration for Strategic Preparedness and Response. (2023). Healthcare sector cybersecurity. https://aspr.hhs.gov/cyber/Pages/default.aspx

[4] Sinai Chicago. (n.d.). Leadership and organizational information [LinkedIn company profile]. https://www.linkedin.com/company/sinaichicago

[7] Kapko, M. (2023, August 7). Ransomware attack on Prospect Medical Holdings impacts hospitals across 4 states. Cybersecurity Dive. https://www.cybersecuritydive.com/news/ransomware-hospitals/690130/

[8] National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). U.S. Department of Commerce. https://doi.org/10.6028/NIST.CSWP.29

[9] IBM Security. (2025). Cost of a data breach report 2025. https://www.ibm.com/reports/data-breach

[11] National Institute of Standards and Technology. (2023). Artificial intelligence risk management framework (AI RMF 1.0). U.S. Department of Commerce. https://doi.org/10.6028/NIST.AI.100-1

[12] National Institute of Standards and Technology. (2012). Guide for conducting risk assessments (SP 800-30, Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1

[13] U.S. Department of Health and Human Services. (2024). Healthcare and Public Health Cybersecurity Performance Goals (HPH CPGs). https://hhscyber.hhs.gov/cybersecurity-performance-goals.html

REFERENCES

22 of 22

[14] Illinois General Assembly. (n.d.). Personal Information Protection Act, 815 ILCS 530/1 et seq. https://www.ilga.gov/Legislation/ILCS/Articles?ActID=2702&ChapterID=67

[15] European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union, L 2024/1689. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng

[18] U.S. Department of Health and Human Services, Office for Civil Rights. (n.d.). Breach notification rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html

[19] U.S. Department of Health and Human Services, Office for Civil Rights. (n.d.). HIPAA Security Rule: Administrative safeguards, 45 CFR §164.308. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308

[20] U.S. Food and Drug Administration. (2023, September 27). Cybersecurity in medical devices: Quality system considerations and content of premarket submissions; guidance for industry and Food and Drug Administration staff. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions

[21] Advanced Research Projects Agency for Health. (2024). UPGRADE: Universal PatchinG and Remediation for Autonomous DEfense. https://arpa-h.gov/research-and-funding/programs/upgrade

[22] U.S. Senate Committee on Finance. (2024). Hacking America's health care: Assessing the Change Healthcare cyber attack and what's next [Hearing]. https://www.finance.senate.gov/hearings/hacking-americas-health-care-assessing-the-change-healthcare-cyber-attack-and-whats-next

REFERENCES