COSHI project ensures cybersecurity compliance with thorough audit processes

The Colorado Office of eHealth Innovation has taken significant steps to ensure the security and accountability of health information systems during the recent 2025 Health IT Data Governance Workgroup Meeting held on May 23, 2025. A key focus of the meeting was the stringent cybersecurity measures required for sharing Protected Health Information (PHI) and Personally Identifiable Information (PII).

Participants discussed the necessity of adhering to state policies that mandate a secure system for handling sensitive data. The Office of Information Technology has established a system security plan that requires approval from the state's information security office, ensuring that all cybersecurity protocols are rigorously evaluated and audited.

The meeting highlighted the multiple layers of oversight in place. The Centers for Medicaid and Medicare Services fund 90% of the project, granting them the authority to conduct audits at any time. Additionally, the state’s Office of the State Auditor and the Department of Health Care Policy and Finance can also perform audits, reinforcing the commitment to transparency and security.

Annual audits, including SOC 2 Type 2 compliance and independent HIPAA compliance assessments, are conducted to maintain high standards of system integrity. This proactive approach aims to build trust and ensure that the health information systems are well-designed and secure.

As the meeting progressed, participants addressed questions from the audience regarding the protection of information, emphasizing the importance of safeguarding sensitive data. The discussions underscored the commitment of the Colorado Office of eHealth Innovation to uphold the highest standards of data governance and security in health IT systems, paving the way for a safer healthcare environment for all Coloradans.