HIPAA Risk Assessment: What a Small Practice Must Document

A HIPAA risk assessment is a written review of where your electronic patient information lives, what could expose it, how well current safeguards hold up and how serious each risk is. The Security Rule calls it a risk analysis. It’s required. It has to be written down. And it has to keep up with the office.

A filled-in template from years ago may not describe the computers, accounts and vendors the office uses. An assessment that was never done, or one that no longer fits the office, may not show where patient data is exposed or what to fix first. The requirement is part of the HIPAA Security Rule. It isn’t a nice-to-have.

What Is a HIPAA Risk Assessment?

It’s a documented review of the risks to the electronic patient information a practice creates, receives, keeps or sends. The HIPAA Security Rule calls it a risk analysis and lists it as required. The review looks at the systems that hold the data, the threats to it, the safeguards in place and the risk each one carries.

The U.S. Department of Health and Human Services (HHS) spells out what that means. Its guidance on risk analysis quotes the rule itself: “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the [organization].”

HHS says the rule doesn’t prescribe one method. Methods vary with the size, complexity and capabilities of the organization. HHS also says, “Risk analysis is the first step in an organization’s Security Rule compliance efforts.” A small office tends to have fewer people and fewer systems to cover, per HHS. So the work can be proportionate. It still has to be done, and it still has to be written down.

What Does the Assessment Have to Document?

HHS’s guidance describes what the analysis covers, and it says the results of each step get documented. The form is flexible: “The Security Rule requires the risk analysis to be documented but does not require a specific format.” What goes inside it is less flexible. HHS describes each piece a practice works through.

• Where patient data lives. HHS says an organization has to identify where the electronic patient information is stored, received, kept or sent. In an office that can mean workstations and laptops, practice-management software, the imaging system, the email system, cloud storage, backups and staff phones. HHS says electronic media runs from a single workstation up to networks that connect several locations.
• Who else touches it. HHS’s sample questions ask whether vendors or consultants create, receive, keep or send the information. A billing service, the IT provider, cloud services and a lab can all belong on that list.
• What could go wrong. HHS says organizations have to identify and document the threats to the information they can reasonably anticipate. The weak spots those threats could use belong in the review too. HHS sorts threats into natural, human and environmental, and floods sit among the natural ones. A Florida office can put storms and flooding on its own list.
• How current safeguards hold up. HHS says organizations should document the security measures they use. The review also covers whether the measures the rule requires are in place, and whether they’re set up and used properly. Encryption and backups belong here. Owning a safeguard and setting it up right are two different things.
• How likely and how serious. HHS says the rule requires weighing how likely each threat is and what the impact would be. Every threat and weak-spot pair gets a risk level.
• What will be fixed. HHS says the output should document those risk levels along with a list of corrective actions for each one. That list is what turns the review into a work plan.

Finding every place patient data goes can be the hardest part. Email threads, a laptop at home, a backup drive, a vendor’s portal: the list can run long. For a closer look at the paths data takes out of a small office, see where customer data actually leaves an office.

What Happens If a Practice Never Does One?

HHS’s Office for Civil Rights enforces the Security Rule, and the agreements it publishes show what a missing risk analysis can lead to. They’re examples, not a price list, and none of them predicts anything about a particular office. One of them involves a one-location imaging provider.

In a resolution agreement HHS published, patient images the provider kept were alleged to be reachable from the internet through an unsecured image server. HHS’s investigation indicated the provider had never done an accurate and thorough risk analysis. It agreed to pay twenty-five thousand dollars and to follow a corrective action plan lasting two years. The agreement says it is not an admission of liability.

What the plan required reads like a to-do list any practice could write. A complete inventory of the equipment, data systems, off-site storage and applications that hold the information. A risk analysis that includes vulnerability scans and penetration testing. The scope and method of that analysis sent to HHS. That’s work a practice can do on its own schedule, before anyone asks for it.

Those two tests aren’t the same thing, and the difference matters when you scope the work. For what each one does, see how a penetration test differs from a vulnerability scan.

How Often Should a Small Practice Redo It?

The rule sets no calendar. HHS says, “The risk analysis process should be ongoing,” and it says, “The Security Rule does not specify how frequently to perform risk analysis as part of a comprehensive risk management process.” Some organizations repeat the process every year, or as needed, according to HHS.

HHS also names the changes that call for a fresh look. A security incident. A change in ownership. Turnover in key staff or management. Plans to bring in new technology. In office terms, that last one can mean putting in a different practice-management or imaging system, adding a patient portal, letting staff work from home, or changing IT providers.

For a Florida medical or dental office, a written assessment that’s kept current can also make an insurer’s or partner’s security questionnaire easier to answer. The answers are already on paper.

O&O Systems’ Cybersecurity and Compliance page names HIPAA among the regulatory standards its team helps businesses meet, and says the team performs assessments and audits to uncover vulnerabilities and prepare for regulatory inspections.

The team also helps with HIPAA questionnaires so a business can prove its controls and keep work moving. How HIPAA applies to a particular practice is a question for that practice’s own attorney or compliance adviser.

Frequently Asked Questions About a HIPAA Risk Assessment

Is a HIPAA risk assessment required?

HHS lists risk analysis as a required part of the Security Rule’s security management process. It applies to the electronic patient information a practice creates, receives, keeps or sends. The specifics for a given practice belong with its own compliance adviser.

Is a risk analysis the same thing as a risk assessment?

Risk analysis is the rule’s term. The two terms tend to be used for the same documented review, and HHS’s guidance uses both words. If one person asks for an assessment and another asks for an analysis, they’re after the same document.

Does a small practice need the same assessment as a hospital?

HHS says the rule doesn’t prescribe one method, and that methods vary with size and complexity. Small organizations tend to have fewer workforce members and fewer systems to consider, per HHS. The same elements still have to be covered, and the results still have to be written down. A shorter document can still be a complete one.

Can a template do the job?

HHS requires no specific format, so a template can be a reasonable starting point. It does the job only when it names the office’s real systems, vendors, threats, safeguards and fixes. A blank form filled with generic answers describes someone else’s office. And the document has to keep up as the office changes.

Who should do the assessment?

The practice is responsible for it. An IT provider can help with the technical parts, such as the inventory, how safeguards are set up, and scans or tests. Legal and compliance questions go to the practice’s own adviser.

Make the Assessment Match the Office

Offices change. Equipment gets replaced. Staff turn over. Vendors come and go. A review written for an older setup stops describing the place, and the file can look complete while it’s out of date.

The practical test is simple. Could someone pick up the written review and find every system that holds patient data? If your HIPAA risk assessment no longer matches how the office works, ask O&O Systems about the IT side of your risk assessment.