--- title: Five Nines Blog --- [Skip to the main content.](https://blog.fivenines.com#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # Five Nines Blog #### Five Nines Experts Sharing Actionable IT Advice   Filter by Tag Show All AI Banking Business Continuity Case Studies Clinical IT Cloud Infrastructure Company Awards Compliance Copmany News Cyber Insurance Cybersecurity Finance Five Nines Healthcare IT Services IT Tips & Tricks Incident Response Mobile Device Management Multi-Factor Authentication Office 365 Phishing Ransomware Strategic Planning Tech Operations Insights Tech Trends Webinars [![What Good Looks Like: A Vendor Risk Management Program for Healthcare Under HIPAA (The CFO Governance View)](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/87-good-vendor-risk-healthcare-cfo.docx.png?width=960&height=540&name=87-good-vendor-risk-healthcare-cfo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-vendor-risk-management-program-for-healthcare-under-hipaa-the-cfo-governance-view) #### [What Good Looks Like: A Vendor Risk Management Program for Healthcare Under HIPAA (The CFO Governance View)](https://blog.fivenines.com/what-good-looks-like-a-vendor-risk-management-program-for-healthcare-under-hipaa-the-cfo-governance-view) The Five Functions a Defensible Healthcare Vendor Risk Program Must Operate Tiering and inventory of all vendors handling ePHI. Due diligence proportional to vendor criticality.... [Healthcare](https://blog.fivenines.com/topic/healthcare) [Strategic Planning](https://blog.fivenines.com/topic/strategic-planning) [Compliance](https://blog.fivenines.com/topic/compliance) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Read More](https://blog.fivenines.com/what-good-looks-like-a-vendor-risk-management-program-for-healthcare-under-hipaa-the-cfo-governance-view) [![What Good Looks Like: A Clinical Phishing Program That Doesn't Disrupt Patient Care](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/88-good-clinical-phishing-program-coo.docx.png?width=960&height=540&name=88-good-clinical-phishing-program-coo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-clinical-phishing-program-that-doesnt-disrupt-patient-care) #### [What Good Looks Like: A Clinical Phishing Program That Doesn't Disrupt Patient Care](https://blog.fivenines.com/what-good-looks-like-a-clinical-phishing-program-that-doesnt-disrupt-patient-care) What a Well-Designed Clinical Phishing Program Actually Includes Clinical-realistic scenarios Tiered intervention by impact severity Outcomes measured against actual security... [Phishing](https://blog.fivenines.com/topic/phishing) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Incident Response](https://blog.fivenines.com/topic/incident-response) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/what-good-looks-like-a-clinical-phishing-program-that-doesnt-disrupt-patient-care) [![What Good Looks Like: A HITRUST Readiness Program for a Sub-500-Bed Hospital](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/86-good-hitrust-readiness-ceo.docx.png?width=960&height=540&name=86-good-hitrust-readiness-ceo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-hitrust-readiness-program-for-a-sub-500-bed-hospital) #### [What Good Looks Like: A HITRUST Readiness Program for a Sub-500-Bed Hospital](https://blog.fivenines.com/what-good-looks-like-a-hitrust-readiness-program-for-a-sub-500-bed-hospital) The Five Elements a Defensible HITRUST Readiness Program Requires Gap assessment substantively Remediation roadmap Evidence collection Internal validation Board governance Three... [IT Services](https://blog.fivenines.com/topic/it-services) [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Read More](https://blog.fivenines.com/what-good-looks-like-a-hitrust-readiness-program-for-a-sub-500-bed-hospital) [![What Good Looks Like: A Fractional Security Executive Engagement at a Clinic System](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/85-good-fractional-ciso-clinic-cfo.docx.png?width=960&height=540&name=85-good-fractional-ciso-clinic-cfo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-fractional-security-executive-engagement-at-a-clinic-system) #### [What Good Looks Like: A Fractional Security Executive Engagement at a Clinic System](https://blog.fivenines.com/what-good-looks-like-a-fractional-security-executive-engagement-at-a-clinic-system) The Five Elements a Fractional Security Executive Engagement Must Deliver Program leadership designation. Executive integration. Documented operation. Incident response... [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/what-good-looks-like-a-fractional-security-executive-engagement-at-a-clinic-system) [![What Good Looks Like: A Clinic CFO's Annual IT and Security Budget Defense](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/90-good-clinic-cfo-budget-defense-cfo.docx.png?width=960&height=540&name=90-good-clinic-cfo-budget-defense-cfo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-clinic-cfos-annual-it-and-security-budget-defense) #### [What Good Looks Like: A Clinic CFO's Annual IT and Security Budget Defense](https://blog.fivenines.com/what-good-looks-like-a-clinic-cfos-annual-it-and-security-budget-defense) The Six Components a Clinic Board Defense Package Must Include Regulatory obligation tied to HIPAA framework Exposure analysis with clinic-specific dollar magnitude Current... [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Finance](https://blog.fivenines.com/topic/finance) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/what-good-looks-like-a-clinic-cfos-annual-it-and-security-budget-defense) [![What Good Looks Like: A Clinical Platform Vendor Governance Program Over a Multi-Year Relationship](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/89-good-clinical-platform-vendor-governance-ceo.docx.png?width=960&height=540&name=89-good-clinical-platform-vendor-governance-ceo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-clinical-platform-vendor-governance-program-over-a-multi-year-relationship) #### [What Good Looks Like: A Clinical Platform Vendor Governance Program Over a Multi-Year Relationship](https://blog.fivenines.com/what-good-looks-like-a-clinical-platform-vendor-governance-program-over-a-multi-year-relationship) The Six Elements of Defensible Clinical Vendor Governance Selection criteria documented. Contract review substantive. Implementation oversight. Ongoing performance review.... [Healthcare](https://blog.fivenines.com/topic/healthcare) [Compliance](https://blog.fivenines.com/topic/compliance) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/what-good-looks-like-a-clinical-platform-vendor-governance-program-over-a-multi-year-relationship) [![What a Vendor BAA Actually Obligates the Vendor To, and What It Does Not: The CEO Accountability View](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/92-vendor-baa-obligations-ceo.docx.png?width=960&height=540&name=92-vendor-baa-obligations-ceo.docx.png)](https://blog.fivenines.com/what-a-vendor-baa-actually-obligates-the-vendor-to-and-what-it-does-not-the-ceo-accountability-view) #### [What a Vendor BAA Actually Obligates the Vendor To, and What It Does Not: The CEO Accountability View](https://blog.fivenines.com/what-a-vendor-baa-actually-obligates-the-vendor-to-and-what-it-does-not-the-ceo-accountability-view) Where the Vendor's BAA Obligations End and the CEO's Program Begins A healthcare CEO whose organization runs on cloud, software-as-a-service, or any third-party platform handling... [IT Services](https://blog.fivenines.com/topic/it-services) [Business Continuity](https://blog.fivenines.com/topic/business-continuity) [Strategic Planning](https://blog.fivenines.com/topic/strategic-planning) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Read More](https://blog.fivenines.com/what-a-vendor-baa-actually-obligates-the-vendor-to-and-what-it-does-not-the-ceo-accountability-view) [![The HIPAA Security Rule Is Changing for the First Time in Over a Decade: What a Healthcare CEO Needs to Know and Do Now](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/91-hipaa-security-rule-update-ceo.docx.png?width=960&height=540&name=91-hipaa-security-rule-update-ceo.docx.png)](https://blog.fivenines.com/the-hipaa-security-rule-is-changing-for-the-first-time-in-over-a-decade-what-a-healthcare-ceo-needs-to-know-and-do-now) #### [The HIPAA Security Rule Is Changing for the First Time in Over a Decade: What a Healthcare CEO Needs to Know and Do Now](https://blog.fivenines.com/the-hipaa-security-rule-is-changing-for-the-first-time-in-over-a-decade-what-a-healthcare-ceo-needs-to-know-and-do-now) Why the HIPAA Security Rule Is Being Revised — And What Changed Since 2013 The HIPAA Security Rule's last meaningful update came through the Omnibus Rule in 2013. In 2013, the... [Healthcare](https://blog.fivenines.com/topic/healthcare) [Strategic Planning](https://blog.fivenines.com/topic/strategic-planning) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/the-hipaa-security-rule-is-changing-for-the-first-time-in-over-a-decade-what-a-healthcare-ceo-needs-to-know-and-do-now) [![When a Third-Party Clinical App Breach Becomes Your Hospital's HHS Problem: The Financial View](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/80-third-party-clinical-app-breach-cfo.docx.png?width=960&height=540&name=80-third-party-clinical-app-breach-cfo.docx.png)](https://blog.fivenines.com/when-a-third-party-clinical-app-breach-becomes-your-hospitals-hhs-problem-the-financial-view) #### [When a Third-Party Clinical App Breach Becomes Your Hospital's HHS Problem: The Financial View](https://blog.fivenines.com/when-a-third-party-clinical-app-breach-becomes-your-hospitals-hhs-problem-the-financial-view) Why a Vendor Breach Is the Hospital's Financial Problem A third-party breach involving the hospital's ePHI is the hospital's problem regardless of vendor responsibility. CFOs... [Healthcare](https://blog.fivenines.com/topic/healthcare) [Finance](https://blog.fivenines.com/topic/finance) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/when-a-third-party-clinical-app-breach-becomes-your-hospitals-hhs-problem-the-financial-view) [![What Good Looks Like: A Hospital Board's Annual Cyber Risk Briefing](https://blog.fivenines.com/hs-fs/hubfs/blog/taya-migration/84-good-hospital-board-cyber-briefing-ceo.docx.png?width=960&height=540&name=84-good-hospital-board-cyber-briefing-ceo.docx.png)](https://blog.fivenines.com/what-good-looks-like-a-hospital-boards-annual-cyber-risk-briefing) #### [What Good Looks Like: A Hospital Board's Annual Cyber Risk Briefing](https://blog.fivenines.com/what-good-looks-like-a-hospital-boards-annual-cyber-risk-briefing) Why the CEO Should Design the Board Cyber Briefing, Not Accept What IT Prepares A hospital CEO walking into the next annual board cyber briefing is rarely framed as a governance... [Healthcare](https://blog.fivenines.com/topic/healthcare) [Incident Response](https://blog.fivenines.com/topic/incident-response) [Tech Operations Insights](https://blog.fivenines.com/topic/tech-operations-insights) [Clinical IT](https://blog.fivenines.com/topic/clinical-it) [Read More](https://blog.fivenines.com/what-good-looks-like-a-hospital-boards-annual-cyber-risk-briefing) [1](https://blog.fivenines.com/page/1) [2](https://blog.fivenines.com/page/2) [3](https://blog.fivenines.com/page/3) [4](https://blog.fivenines.com/page/4) [5](https://blog.fivenines.com/page/5) [Next](https://blog.fivenines.com/page/2) ### Topics [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Outsourced IT](https://blog.fivenines.com/topic/outsourced-it) [IT Tips & Tricks](https://blog.fivenines.com/topic/it-tips-tricks) [Business Continuity](https://blog.fivenines.com/topic/business-continuity) [Strategic Planning](https://blog.fivenines.com/topic/strategic-planning) --- ![email icon](https://blog.fivenines.com/hs-fs/hubfs/email%20icon.png?width=70&height=57&name=email%20icon.png) ### Stay Informed Subscribe to our newsletter to get fresh insights delivered to your inbox. ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLIyrERpMwjMapDQouHsgUCE8B7Py0E2Lo2nOEroptdciW3SK77%2BfD8pvTMGb3FIbJpqOc%2F7vxi0CWvIGzwXF%2Bf%2Bsl5%2F4Qlcn3sOVv8aaMCJL3J%2FhfIWFmkZk3EgdBvRxmJg%2FJvnvC6AdUIvR6n8DECfQKIe%2BvLPUxs3AJ8nFkUFR2Zf4PyTdDZNUvcLEfnc%2BaRKRQ%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top