What is a HIPAA risk assessment?
A HIPAA Security Rule risk analysis helps a regulated organization
identify potential risks and vulnerabilities to the confidentiality,
integrity, and availability of electronic protected health information (ePHI).
What should a HIPAA risk assessment review?
- Where ePHI is created, received, maintained, and transmitted
- Potential threats and vulnerabilities affecting ePHI
- Administrative, physical, and technical safeguards
- User access and authentication practices
- Computers, phones, tablets, servers, and other devices
- EHR systems, cloud services, telehealth platforms, and backups
- Vendors and business associate relationships
When should risks be reviewed?
HIPAA does not establish one universal schedule for performing
a Security Rule risk analysis. Risk analysis should be an ongoing
process that reflects relevant changes to systems, operations,
technology, threats, and the environment.
Changes that may trigger another review
- Adding or replacing an EHR or practice-management system
- Starting or changing telehealth services
- Moving information to a new cloud service
- Introducing new devices or remote-access workflows
- Changing vendors that may create, receive, maintain, or transmit ePHI
- Identifying new threats, vulnerabilities, or security concerns
Common areas that may need attention
- Unmanaged devices that access ePHI
- Access permissions that are no longer appropriate
- Incomplete documentation of identified risks
- Safeguards that no longer reflect current workflows
- Vendor relationships that have not been reviewed
Risk assessment vs. general HIPAA compliance review
A Security Rule risk analysis focuses specifically on potential
risks and vulnerabilities affecting ePHI.
A broader HIPAA compliance review may also consider Privacy Rule
requirements, documentation, training, vendor relationships,
policies, and other compliance areas.
For a broader review, see the
HIPAA Compliance Checklist
.
Start a structured HIPAA review
GetHIPAAcheck provides a guided HIPAA Compliance Assessment
to help organize your review, identify potential gaps,
and receive recommended next steps.
Start Free HIPAA Compliance Assessment