Board Report

Executive summary

This assessment evaluates the security posture of Northbay Regional Health and returns an overall posture score of 58/100 (grade C). ROS identified 2 critical findings requiring executive attention, each prioritized by business impact and regulatory exposure. The plan below sequences remediation to reduce the most material risk first.

Compliance posture

Prioritized remediation plan

Ranked by business impact and regulatory exposure.

1. 1.criticalPR.DS-1
   S3 bucket with PHI exports readable by any authenticated AWS principal
   A misconfigured bucket holding patient record exports is one leaked credential away from a reportable HIPAA breach, HHS OCR penalties, and mandatory patient notification for a regional hospital.
   Action: Remove the cross-account/authenticated-principal grant, enforce a bucket policy denying non-TLS access, and enable SSE-KMS with a dedicated CMK. Confirm no external access via Access Analyzer.
2. 2.criticalPR.AC-1
   Root and admin AWS accounts without MFA
   The keys to the entire hospital cloud estate — including every PHI store — are protected only by a password, meaning one phishing hit could hand an attacker total control.
   Action: Enforce hardware/virtual MFA on root and all admin users via SCP, rotate the exposed admin access keys, and move to federated Okta SSO with no standing IAM users.
3. 3.highPR.DS-1
   Publicly shared Google Drive files containing patient information
   Spreadsheets with patient names and appointment details are shared as 'anyone with the link,' an unmonitored leak path that would count as an impermissible HIPAA disclosure.
   Action: Revoke link-anyone sharing on flagged files, enable a Workspace DLP rule blocking external sharing of PHI patterns, and reassign orphaned files.
4. 4.highPR.AC-7
   Okta admin roles granted without step-up MFA policy
   Okta is the front door to every connected system; weak controls on its administrators mean a single compromised admin can unlock the entire environment, including PHI.
   Action: Enforce FIDO2/WebAuthn for all admin roles, disable SMS as a factor for privileged access, and reduce Super Admin count to the minimum needed.
5. 5.highPR.DS-2
   RDS instance hosting EHR data is publicly accessible
   A database backing electronic health records is reachable from the open internet, dramatically widening the attack surface for the most sensitive data the hospital holds.
   Action: Set PubliclyAccessible=false, restrict the security group to the application subnet, and place the instance behind a private endpoint only.
6. 6.highPR.DS-5
   Hardcoded API secret committed to internal GitHub repo
   A live credential sitting in source code means anyone with repo access — including a departing engineer or a compromised laptop — can quietly reach connected systems.
   Action: Revoke and rotate the exposed secrets immediately, purge them from git history, enable push protection / secret scanning, and move secrets to AWS Secrets Manager.

AI risk governance

NIST AI RMF readiness stands at 34%, with 2 unmanaged AI systems touching sensitive data. Highest priority:

Shadow AI: clinicians are pasting patient notes into an unsanctioned GPT-4 tool with no BAA, creating an undocumented PHI disclosure path outside any HIPAA control.