What’s in a HIPAA Risk Analysis?

The Department of Health and Human Services requires all organizations handling protected health information (PHI), including HIPAA hosting providers, to conduct a risk analysis as the first step toward implementing safeguards specified in the HIPAA Security Rule, and ultimately achieving HIPAA compliance.

But what does a risk analysis entail, and what do you absolutely have to include in your report? The HHS Security Standards Guide outlines nine mandatory components of a risk analysis that healthcare organizations and healthcare-related organizations that store or transmit ePHI (electronic protected health information) must include in their document:

Scope of the Analysis – Any potential risks and vulnerabilities to the privacy, availability and integrity of ePHI. This includes all electronic media your organization uses to create, receive, maintain or transmit ePHI – portable media, desktops and networks. Network security between multiple locations is also important to include in the scope of the analysis, and may include aspects of your HIPAA hosting terms with a third-party or Business Associate.

Data Collection – Where does the ePHI go? Locate where data is being stored, received, maintained or transmitted. Again, if you’re hosting health information at a HIPAA compliant data center, you’ll need to contact your hosting provider to document where and how your data is stored.

Identify and Document Potential Threats and Vulnerabilities – Identify and document any anticipated threats to sensitive data, and any vulnerabilities that may lead to leaking of ePHI. Anticipating potential HIPAA violations can help your organization quickly and effectively reach a resolution.

Assess Current Security Measures – What kind of security measures are you taking to protect your data? From a technical perspective, this might include any encryption, two-factor authentication, and other security methods put in place by your HIPAA hosting provider.

Determine the Likelihood of Threat Occurrence – Take account of the probability of potential risks to ePHI – in combination with #3 Potential Threats and Vulnerabilities, this assessment allows for estimates on the likelihood of ePHI breaches.

Determine the Potential Impact of Threat Occurrence – By using either qualitative or quantitative methods, assess the maximum impact of a data threat to your organization. How many people could be affected? What extent of private data could be exposed – just medical records, or both health information and billing information combined?

Determine the Level of Risk – HHS suggests taking the average of the assigned likelihood (#5) and impact levels (#6) to determine the level of risk. Documented risk levels should be accompanied by a list of corrective actions that would be performed to mitigate risk.

Finalize Documentation – Write everything up in an organized document – HHS doesn’t specify any format, but they do require the analysis in writing.

Periodic Review and Updates to the Risk Assessment – It’s important the risk analysis process is ongoing – one requirement includes conducting a risk analysis on a regular basis. While the Security Rule doesn’t set a required timeline, HHS recommends organizations conduct another risk analysis whenever your company implements or plans to adopt new technology or business operations. This could include switching your data storage methods from managed servers to cloud computing, or any ownership or key staff turnover.