HIPAA regulations encourage enhanced information sharing through the use of electronic health records. On one hand, it improves the quality and efficiency of the healthcare systems but on the other hand, it puts a big burden on the healthcare companies as lapses in fulfilling HIPAA requirements can lead to steep monetary penalties.
Performing a risk assessment is an important step for ensuring compliance. However, erroneous or incomplete risk analysis can leave holes in your security systems and lead to data breaches. Risk assessments can be especially challenging if you do not have in-house IT experts or the necessary time or resources.
In this blog post, we share with you a step-by-step process that will help you perform a thorough and accurate risk assessment of your electronic Protected Health Information (ePHI).
What Is A HIPAA Risk Assessment?
Any organization that creates, receives, maintains, or transmits ePHI needs to ensure that it is taking adequate measures to protect ePHI. This involves identifying security risks to the ePHI and implementing safeguards to maintain compliance with the HIPAA Security Rule.
A risk analysis done to evaluate the security threats to an organization’s electronic protected health information (ePHI) that can lead to violations of the Privacy Rule is called HIPAA Risk Assessment.
A HIPAA risk assessment will contain detailed instructions to satisfy a certain standard, some of which are required, while others are addressable. Required specifications document an organization's policies and procedures, while addressable specifications are those where the organization has the flexibility to choose appropriate controls to meet those specifications.
For example, a risk analysis is a required specification while password management is an addressable specification since you can choose different measures such as multi-factor authentication to fulfill it.
How To Perform A HIPAA Risk Assessment
There are many methods of performing risk assessment and HIPAA does not specify any single method or “best practice”. What you have to keep in mind is to use a method that is aligned with the Security Rule. The process outlined in the NIST SP 800-30 is a good example.
Here is a step-by-step process for performing a HIPAA-compliant risk assessment:
1. Customize The Risk Assessment To Your Organization
Organizations, even within the same industry, differ widely based on their size, infrastructure, business model, etc. HIPAA risk assessment can be tailored to fit an organization based on such differences. The risk assessment can be tailored based on:
The size, complexity, and capabilities of the organization,
IT infrastructure and security capabilities,
Probability and criticality of potential security risks, and
Cost of security measures.
2. Define The Scope
Like any other project, one of the first things you need to do for a risk assessment is to define the scope. For HIPAA risk assessment, this is fairly straightforward. You need to consider all ePHI irrespective of how or where the data is created, received, stored, or transmitted. The assessment must cover all reasonable risks to the ePHI and possible vulnerabilities in your security systems.
3. GATHER INFORMATION ABOUT ePHI USE AND DISCLOSURE
This step requires you to review all documentation for projects in the past and present to gather information about your use of ePHI. You need to define the following:
What ePHI your organization has access to,
Where the ePHI is stored,
How the ePHI is transmitted, and
Who has access to the data and how it is accessed.
If you are HIPAA compliant, you may have already completed this step. For subsequent risk assessments, you can use the information gathered in this step as the starting point.
4. Assess Current Security Measures
Once you define where your data is stored and who has access to it, you need to assess your current security measures. You can start by documenting all the security measures you have in place to protect the ePHI. It should include both the technical controls, such as access controls, encryption, etc., and the non-technical controls, such as physical locks, security desk, policies, etc.
Once you have a complete picture of the security controls, you can determine whether the security measures are appropriate and sufficient to meet the requirements of the Security Rule.
5. Identify Threats And Vulnerabilities
All the information that you have gathered so far should enable you to identify if there are any vulnerabilities in your security systems. You should also be able to determine the likelihood of potential threats to the security and integrity of ePHI maintained by your organization
6. Determine The Risks
Risk is a combination of the likelihood of a threat occurring and the impact that threat can have on the organization, i.e. risk is equal to the product of likelihood and impact. So, the first thing you need to do is to determine the probability of a threat occurring. This information usually comes from historical data or environmental factors.
To arrive at a risk score, first, you attach numeric values ranging from 0 for “not likely to occur” to 5 for “very likely to occur”. Similarly, you determine the impact that each threat and vulnerability poses to your organization and attach numerical values ranging from 0 for “no impact” to 5 for “very high impact”. And then, for each threat or vulnerability, you multiply their corresponding likelihood and impact scores to arrive at their risk score.
Based on this risk score, you can assign risk levels to the threats and vulnerabilities. This helps you create a risk-level matrix and a risk classification system. To summarize, here’s what this step involves:
Determine the probability of threat occurrence
Determine the potential impact of the threats
Assign risk levels
7. Identify Suitable Security Measures
Once the risk levels have been assigned, you have to create a list of corrective actions that should be taken to mitigate the risks or to reduce them to a reasonable level. For each of these measures consider the following:
How effective the measure is,
Regulatory requirements for its implementation, and
Internal policy requirements.
8. Document The Findings
The final step of your risk assessment is documentation. You need to document all your findings to clearly outline what PHI you work with, the threats and vulnerabilities, and to demonstrate how you seek to mitigate the identified threats to the security and integrity of ePHI. Documentation is a mandatory requirement and is critical not only for HIPAA compliance audits but also serves as an insight into your preparedness and progress with respect to data security.
Conclusion
A risk assessment is the first step towards safeguarding ePHI and compliance with HIPAA Security Rule. HIPAA requires covered entities and business associates to perform thorough risk assessments to identify risks and document their mitigation efforts.
Failure to demonstrate your organization’s commitment to protecting ePHI and violations of HIPAA requirements can lead to staggeringly huge penalties. Regular risk assessments not only enable you to address threats and vulnerabilities in a timely manner but can also protect your organization from monetary penalties and even jail time for responsible individuals.
Another important thing to note is that risk assessments are not a one-time project. You should conduct risk assessments at least annually and in the event of any major changes within your organization.
Risk assessments can be overwhelming, especially if you lack proper control over your technical infrastructure, cloud storage, and third-party applications. However, a trusted technology partner can take a lot of the headache away and help you ensure security and compliance. Reach out to us by clicking the button below for HIPAA-compliant IT services.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.