Regardless of what changes the Bush administration or others hope to make to the regulations, covered entities should not delay their HIPAA preparations. An important first step on the road to implementation is to conduct a comprehensive HIPAA privacy risk assessment. Each central bank must overcome organization-specific challenges in attempting to maintain a consistent program for conducting HIPAA security risk assessments. All ECs and third-party payers or BAs that have access to PHI are required to conduct HIPAA security risk assessments on a regular basis, regardless of the size, structure, or complexity of the organization. While small hospitals and individual providers may not be as complex as large health systems, they are still considered centralized entities and therefore are equally responsible for protecting personally identifiable information. Physical protections include access to both the physical structures of a covered entity and its electronic equipment (45 CFR §164.310).

We begin our assessment by capturing and understanding your business processes and taking an inventory of the areas where PHI / ePHI is used or stored. We will work with and interview key personnel from your organization’s business units and information technology to understand your information security policies, procedures, and practices. We will review the administrative, physical, and technical safeguards your organization has in place HIPAA security risk assessment to protect PHI / ePHI. In this step, we will assign risk levels to the risks identified in the assessment for all security threats and vulnerabilities to which your organization may be exposed. The assigned risk level is determined by evaluating the likelihood of all identified threats and impact combinations. The highest risk level is assigned when a threat is likely to occur and have a significant impact on your organization.

It is critical to continually assess and update your organization’s processes and safeguards to reduce the risk of security breaches and regulatory violations. Use healthcare compliance software, such as ComplyAssistant, to manage HIPAA security risk assessments. All covered entities must assess their security risks, including entities that use certified electronic health records.

The Department of Health and Human Services does not endorse or recommend any particular risk analysis or risk management model. The documents referenced below do not constitute legally binding guidance for covered entities, and compliance with any or all of the standards contained in these materials is not evidence of compliance with the risk analysis requirements of the Safety Rule. Rather, the materials are presented as examples of frameworks and methodologies that some organizations use to guide their risk analysis.

Conducting consistent HIPAA security risk assessments helps organizations ensure compliance with HIPAA administrative, physical, and technical safeguards and helps uncover areas where an organization’s PHI may be at risk. In addition to conducting assessments, healthcare organizations should implement rigorous control and governance measures to mitigate the risks identified in the security risk assessment. Conducting HIPAA security risk assessments on a regular basis helps covered entities ensure compliance with HIPAA administrative, physical, and technical safeguards and uncover areas where an organization’s protected health information may be at risk. Risk analysis is one of four required implementation specifications needed to achieve broad compliance with many other HIPAA standards and implementation specifications. The security standard identifies some implementation specifications as addressable or required. From a risk management perspective, all controls implemented by management should be developed based on the identified risk.

The Health Insurance Portability and Accountability Act requires healthcare entities to implement policies and procedures to protect the privacy and security of patients’ protected health information. This article explains what a HIPAA risk assessment is and provides guidance on the steps to follow. The SRA tool is very useful in helping organizations identify some, but not all, of the places where vulnerabilities and susceptibilities may exist. Security risk analysis is the first step in identifying and implementing these safeguards. A security risk analysis is an accurate and comprehensive assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of PHI. As health systems and regulations evolve, potential cybersecurity risks and non-compliance issues arise.

A HIPAA risk assessment should identify all areas of an organization’s security that require attention. Organizations should then develop a risk management plan to address the vulnerabilities revealed by the assessment and, if necessary, implement new procedures and policies to close the vulnerabilities most likely to result in a personal data breach. The final stage of a HIPAA risk assessment should be the development and implementation of a HIPAA privacy compliance program. The program should include measures to address the risks to personal information identified in the HIPAA Privacy Risk Assessment and be revised as suggested by HHS as new work practices are implemented or new technologies are introduced. Many organizations undergo some level of third-party reporting on HIPAA security compliance. Typically, these types of HIPAA audits evaluate the structure and effectiveness of the current process for meeting the requirements of the HIPAA Security Rule.