When your organization shares sensitive information with a third-party vendor, you are also extending a level of trust to that organization.
For healthcare organizations, financial institutions, insurers and other businesses handling sensitive or regulated information, choosing the right communications partner involves much more than evaluating print quality, turnaround times or postage costs. Information security and third-party risk should be part of that decision.
At Compu-Mail, LLC, we experience this responsibility firsthand. Our team works with organizations that rely on us to securely process data and produce critical customer communications. That is one reason we continue to invest in independently validated security and compliance programs.
We are proud to announce that Compu-Mail has once again achieved HITRUST i1 certification.
But what does HITRUST certification actually mean, and why should it matter when evaluating a direct mail, transactional mail or customer communications provider?
What Is HITRUST i1 Certification?
The HITRUST i1 Validated Assessment provides organizations with an independent evaluation of cybersecurity controls designed to address current and emerging threats.
According to HITRUST, the i1 assessment incorporates a defined set of cybersecurity controls and provides one-year, threat-adaptive assurance. The assessment includes external assessor testing and HITRUST quality assurance before certification is awarded.
In other words, HITRUST certification goes beyond an organization simply stating that it has strong security practices. Those practices are subjected to an established assessment and validation process.
For organizations evaluating third-party vendors, that independent validation can provide valuable additional assurance.
Why Does HITRUST Matter to Compu-Mail Clients?
Compu-Mail provides secure direct mail, transactional mail and other communications services for organizations that may entrust us with sensitive information.
Depending on the program, the data required to produce those communications can include personally identifiable information (PII), protected health information (PHI), financial information or other confidential data.
That means information security isn’t separate from what we do.
It’s part of the service we provide.
Our experience with HITRUST requires us to continually examine how security controls are implemented, documented and supported by evidence. The certification process involves collaboration across our organization and requires our team to demonstrate that applicable controls aren’t simply written into policies — they are implemented within our operating environment.
That distinction is important when clients are evaluating organizations that will handle their information.
Independent Validation Can Strengthen Vendor Risk Management
Third-party risk is an important consideration when outsourcing any process involving sensitive information.
Organizations evaluating a new vendor may need answers to questions such as:
- How will our data be protected?
- Who has access to our information?
- What security controls are in place?
- Are those controls actually implemented?
- Has an independent party evaluated the organization’s security practices?
- How does the vendor continually evaluate and improve its security posture?
HITRUST certification can help organizations evaluate some of these considerations as part of their broader vendor due diligence process.
For procurement, compliance, IT and information security teams evaluating Compu-Mail, our certification provides another independent source of assurance to consider when assessing the security practices of a potential communications partner.
Security Goes Beyond Technology
When people hear “cybersecurity,” they often think about firewalls, encryption, passwords and software.
Those safeguards are important, but protecting sensitive information requires more than technology alone.
Within a secure communications environment, security can involve multiple layers of protection, including:
- Access controls
- Information security policies and procedures
- Employee security awareness
- Physical security
- Risk assessments
- Vendor management
- Incident response
- Business continuity
- Monitoring and testing
- Documentation and evidence
- Ongoing process improvement
Our HITRUST work requires participation from multiple areas of Compu-Mail because effective information security is an organizational responsibility, not simply an IT responsibility.
That has been one of the most valuable aspects of maintaining our certification: it reinforces a culture in which protecting information is part of everyday operations.
Why Recertification Matters
Achieving a certification is important.
Continuing to earn it is even more meaningful.
Cybersecurity threats, technology and compliance expectations continue to change. Security controls therefore cannot be treated as a one-time project.
HITRUST i1 certification operates on a one-year certification cycle, requiring organizations that want to maintain certification to continue through the applicable reassessment and recertification process.
For Compu-Mail, successfully achieving HITRUST i1 certification again provides independent validation of something our clients expect from us every day: continued attention to the security of the information entrusted to us.
Our latest recertification also required a significant team effort. Employees across the organization contributed documentation, evidence and operational knowledge throughout the assessment process.
That firsthand involvement is important because compliance isn’t something one department can accomplish alone.
What Should You Ask Your Communications Provider About Security?
Whether you’re evaluating Compu-Mail or another provider, organizations handling sensitive information should look beyond a statement that a vendor is “secure.”
Ask for evidence.
Consider asking prospective providers:
What independent security assessments or certifications do you maintain?
How frequently are those controls reassessed?
How do you protect sensitive information throughout your workflow?
How is employee access to sensitive information managed?
How do you evaluate your own third-party vendors?
What processes are in place for incident response and business continuity?
How do employees receive ongoing security and compliance training?
The answers can help your organization make a more informed vendor-risk decision.
Security Is Part of the Partnership
Our clients don’t simply send us print files.
They may entrust us with information connected to their customers, patients, members and businesses. We recognize the responsibility that comes with that trust.
Our latest HITRUST i1 recertification represents another step in Compu-Mail’s ongoing commitment to maintaining a secure, compliant and resilient environment for the communications we produce.
We’re proud of the certification.
We’re even more proud of the team and the processes behind it.
Because when sensitive information is involved, choosing the right communications partner matters.
When Secure Mail Matters®, trust Compu-Mail.
Learn More
Looking for a communications partner that understands the importance of security, compliance and protecting sensitive information?
Contact Compu-Mail to learn more about our secure direct mail and transactional communications solutions.
