Why is a risk analysis and a risk management plan so important?

First of all, medical practices are required to conduct a Risk Analysis 45 CFR § 164.308(a)(1)(ii)(A) to determine if their current safeguards adequately protect the confidentiality, integrity, and availability of electronic protected health information (ePHI)? Even though it is acceptable to conduct an analysis every 1-3 years, the Office for Civil Rights (OCR) recommends annual assessment due to the ever-changing world of technology and employee turnover.

When it comes to managing risk, every organization is different. Depending on the size of the organization, how data is transmitted and stored, and the type of systems that are utilized will be determining factors. For example, an organization that utilizes a cloud EHR system will have different risks and vulnerabilities than an organization that has a premise (server based) EHR. Each organization must review how data flows in and out of their network to understand how to protect it. This includes how you interact with your business associates. Covered entities are responsible for ensuring their business associates are HIPAA compliant by having a business associate agreement that details how the BA will safeguard the covered entities patient information 45 CFR § 164.314(a)(1). This agreement will also detail how the business associate’s subcontractor will safeguard data as well.

Our risk analysis questionnaire is thorough and asks the user many questions to uncover possible vulnerabilities. Through this process we educate how to identify issues and the best reasonable and appropriate mitigation method to implement. This is also a required security standard under the Security Rule, 45 CFR § 164.308(a)(1)(ii)(B) Risk Management.

Did you know that 75% of the Security Rule is policies and procedures, only 25% is technical safeguards? Keep in mind, that 25% is extremely important!

If an organization were to suffer a data breach and they had not updated their risk analysis and a vulnerability was found to be the cause of the breach, heavy fines could be assessed. 

Click below to read about Fines and Resolution Agreements from HHS/OCR:

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

Automated HIPAA Compliance Service

Our HIPAA Compliance service is an online system that makes it easy and affordable to protect your organization from HIPAA violations and fines. The first step in protecting patient data is conducting a system wide risk analysis. Then implementing proper policies, procedures, and documentation. Ensuring your employees are properly trained and understand how critical it is to maintain a watchful eye can be proven to be your best asset in addition to your network security. [Read More]

Click here to learn more how we can work together and get HIPAA compliant