Call Today 1-877-740-5028

What's in a HIPAA Risk Analysis?

The Department of Health and Human Services requires organizations to conduct a risk analysis as the first step toward implementing safeguards specified in the HIPAA Security Rule, and ultimately achieving HIPAA compliance.

But what does a risk analysis entail, and what do you absolutely have to include in your report? The HHS Security Standards Guide outlines nine mandatory components of a risk analysis that healthcare organizations and healthcare-related organizations that store or transmit ePHI (electronic protected health information) must include in their document:

Scope of the Analysis – Any potential risks and vulnerabilities to the privacy, availability and integrity of ePHI. This includes all electronic media your organization uses to create, receive, maintain or transmit ePHI – portable media, desktops and networks. Network security between multiple locations is also important to include in the scope of the analysis, and may include aspects of your HIPAA hosting terms with a third-party or Business Associate.

Data Collection – Where does the ePHI go? Locate where data is being stored, received, maintained or transmitted. Again, if you’re hosting health information at a HIPAA compliant data center, you’ll need to contact your hosting provider to document where and how your data is stored.

Identify and Document Potential Threats and Vulnerabilities – Identify and document any anticipated threats to sensitive data, and any vulnerabilities that may lead to leaking of ePHI. Anticipating potential HIPAA violations can help your organization quickly and effectively reach a resolution.

Assess Current Security Measures – What kind of security measures are you taking to protect your data? From a technical perspective, this might include any encryption, two-factor authentication, and other security methods put in place by your HIPAA hosting provider.

Determine the Likelihood of Threat Occurrence – Take account of the probability of potential risks to ePHI – in combination with #3 Potential Threats and Vulnerabilities, this assessment allows for estimates on the likelihood of ePHI breaches.

Determine the Potential Impact of Threat Occurrence – By using either qualitative or quantitative methods, assess the maximum impact of a data threat to your organization. How many people could be affected? What extent of private data could be exposed – just medical records, or both health information and billing information combined?

Determine the Level of Risk – HHS suggests taking the average of the assigned likelihood (#5) and impact levels (#6) to determine the level of risk. Documented risk levels should be accompanied by a list of corrective actions that would be performed to mitigate risk.

Finalize Documentation – Write everything up in an organized document – HHS doesn’t specify any format, but they do require the analysis in writing.

Periodic Review and Updates to the Risk Assessment – It’s important the risk analysis process is ongoing – one requirement includes conducting a risk analysis on a regular basis. While the Security Rule doesn’t set a required timeline, HHS recommends organizations conduct another risk analysis whenever your company implements or plans to adopt new technology or business operations. This could include switching your data storage methods from managed servers to cloud computing, or any ownership or key staff turnover.


HIPAA Compliant Data CentersLooking for more information on HIPAA IT requirements, recommendations, and the foundation of a secure HIPAA compliant data center?
 
Download our HIPAA Compliant Hosting white paper now for a complete guide to HIPAA hosting with IT vendors.
 
Still have questions? Contact us or chat with us now. Find out more about our fully compliant, HIPAA hosting solutions, or submit a quote request for your project today.
 

HIPAA Compliant Cloud Hosting

The primary reason that Online Tech was our first choice was the people that are there. They were really attentive to our needs and went out of their way to make us feel like we were in the right place.

- Judson Pitt, CIO, Biotronic

Have Questions?
Call Today 1-734-213-2020

live-chatemail-us

Live Chat
Events 5