What a HIPAA risk assessment covers

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to electronic protected health information (ePHI). The rule does not prescribe one method. A useful assessment still has a clear scope, a current inventory and a written result that someone acts on.

Define the scope

The assessment covers every system, location and service that creates, receives, stores, processes or transmits ePHI. That includes:

• Electronic health record and practice management systems
• Email, file storage and collaboration tools that hold patient information
• Laptops, phones and removable media used by staff
• Cloud services, backups and vendor platforms
• Paper records that are scanned or printed from these systems

Inventory the ePHI

Write down where ePHI lives, who can reach it, how it moves between systems and which vendors handle it. A business associate agreement should be in place with each vendor that creates, receives, maintains or transmits ePHI on your behalf.

Identify threats and vulnerabilities

For each system, list the threats that could affect confidentiality, integrity and availability along with the weaknesses that let those threats succeed. Common examples include phishing, stolen or shared credentials, unpatched software, misconfigured storage, lost devices and insider misuse.

Review the controls in place

Compare the safeguards you have with the Security Rule standards for administrative, physical and technical safeguards. Check access controls, audit logging, encryption, backup and recovery, staff training and the procedures for handling an incident. Record what is in place, what is partly in place and what is missing.

Rate the risks

For each threat and weakness, estimate how likely it is to happen and how much harm it would cause to patients and to the organization. Combine the two into a rating, such as high, medium or low. The rating is a judgment, so write down the reasoning that supports it, which lets a reviewer follow it later.

Build the risk management plan

Each risk that remains above your accepted level needs an owner, an action, a deadline and a way to confirm that the fix worked. The plan is the output that matters most. An assessment with no follow up leaves the same gaps in place.

Keep it current

Repeat the assessment on a set schedule and whenever something significant changes, such as a new system, a new vendor, a move to a new office or a security incident. HIPAA requires documentation to be kept for six years from the date it was created or last in effect, so keep the assessment and its results on file and make sure leaders review them.

What the assessment does not do

A risk assessment does not certify compliance, because HIPAA has no certification. It shows what the organization knows about its risks and what it has decided to do about them. This article is general information, not legal advice. For the framework overview, see the HIPAA page.