Nefarious characters see healthcare organizations as high value yet relatively easy targets. These are referred to as target rich, cyber poor. Given that healthcare organizations have a combination of personally identifiable information, financial information, health records, and countless medical devices, they are essentially a one-stop shop for a bad actor. Understanding the HIPAA risk analysis requirements can help save your organization from these criminals.
There has been a significant rise in the number and severity of cyber-attacks against hospitals and medical practices in the last few years. These attacks expose vulnerabilities and endanger patient safety. The more they happen, the more expensive, and dangerous they become.
Although the HIPAA Security Rule does not specify how often a risk analysis must be conducted, it is recommended to review your systems at least once a year. Keep in mind if you introduce new equipment, software, or suffer a security incident, you may need to evaluate your risks more often.
If you need a HIPAA Security Risk Analysis, check out our:
The OCR conducted a webinar regarding Risk Analysis Requirements and discussed the areas that are deficient.
The OCR mentioned the following:
- The lack of a system wide accurate and thorough analysis. (Step 1 Questionnaire)
- Performing only the MIPS risk analysis does not encompass the system wide requirements.
- PCI/DSS is more than likely not a complete risk assessment since it does not include ePHI.
- Instead of a system wide accurate and thorough risk assessment, a summary or heat map is provided without the backup documentation.
- Lack of inventory list to track which devices access, transmit, or store ePHI. (Located in the Profile)
- No method to track operating systems that become out of date. (Documented in the inventory list)
- Lack of mitigation documentation after the risk analysis was completed. (Step 1 Risk Management Plan)
- Lack of sanctions against staff who violate HIPAA. (Step 3 Policies and Procedures)
- Lack of security software / equipment updates. (Documented in reports from your IT company and stored in the Profile under Uploads)
Let’s all work together to keep patient data safe and secure. If you need assistance with HIPAA Compliance, check out our HIPAA Keeper™. It’s an online compliance system that has everything you need to get compliant and stay compliant. Best of all you will have a HIPAA security analyst to guide you every step of the way!
“Simplifying HIPAA through Automation, Education, and Support”
