Turnkey Privacy / Security Risk Analysis & Mitigation Plan for HIPAA

Any Covered Entity or Business Associate is required to perform a HIPAA Risk Assessment.

In preparation for a security risk assessment it is helpful to have a list of users and hardware for the organization ready for the assessment.

The hardware list should have a list of all the hardware inventory, all operational and non-operational hardware, operating system of the hardware, the software applications used for protection of the hardware (anti-virus, anti-malware, anti-spyware and advanced endpoint protection for ransomware, etc..).

The user list should have a list of all their active users in the system and what health information technology they have access to.

Additionally, the Security Official needs to have administrative access to complete the Security Risk Assessment to be able to review audit trails/ audit logs, review password requirements and the details of what a person has access to.

Among some of the most important risks are as follows:

• Giving someone too much access for their job responsibility.
• Not completing pre-employment background check and drug test for employees.
• Having unencrypted patient electronic protected health information (ePHI) on computers creates a compliance issue.
• Lack of employee privacy & security training in the organization.
• Using unencrypted emails when releasing patients electronic health information (ePHI).
• Unsecured or misconfigured firewall which can compromise the organization’s data or network.
• Improper Disposal of patients electronic protected health information (ePHI) or other company records.
• Not having Anti-virus, Anti-Malware, Anti-Spyware and advanced endpoint detection and remediation.

The risk assessment should have the following areas: Physical/ Environmental, Technical and Administrative Safeguards. Under each of these assessment areas the required items needed to be assessed and addressed.

1. 1. Physical safeguards in a risk assessment refers to the measures an organization takes to protect its physical facilities, equipment, and other assets from unauthorized access or damage. Examples of physical safeguards include locked doors, security cameras, and restricted access to sensitive areas.
   2. Technical safeguards in a risk assessment refers to the measures an organization takes to protect its electronic information systems and data from unauthorized access or disclosure. Risk management entails evaluation of the organization’s physical security measures, including the security of computer systems (including encryption, access controls, and intrusion detection systems), management of servers, and other electronic equipment. Additionally, a description of the organization’s data backup and disaster recovery plans should be included in the risk assessment.
   3. Administrative safeguards in a risk assessment refers to the policies, procedures, and training programs an organization has in place to protect the confidentiality, integrity, and availability for handling, storing, and transmitting ePHI. As part of the risk assessment it needs to be determined if there are gaps in the organization’s policies, procedures and practices that need to be addressed. Examples of administrative safeguards include HIPAA compliance training and correct management of health information, periodic risk assessments, and incident response plans.

Overall, a HIPAA security risk assessment audit should include an evaluation of all three types of safeguards to ensure that the organization is adequately protected against potential threats to the confidentiality, integrity, and availability of ePHI.

HIPAA Security Risk Assessment Report should address the assessment items and should document the following for each Vulnerability:

• • Vulnerability Assessments
    • Threat
    • How the Threat was identified
    • Analysis of Threat Likelihood
    • Impact
    • Impact Level
    • Overall Risk Level Anaylsis
    • Recommended HIPAA Approved Safeguard

Then, a Summary table can be completed as follows which include recommendations to mitigate these risks identifying the following:

• • Risk (Vulnerability/ Threat Pair)
  • Safeguard Recommendations
  • Risk Level Analysis
  • Responsible Owner of Mitigating the Risk
  • When the Risk was identified
  • When The Target Completion Date is to Mitigating the Risk
  • Area to Mark the Completion Date and by Whom

The goal of a HIPAA security risk assessment audit report is to provide the organization with a clear and actionable plan for improving its compliance program and reducing its risk of non-compliance with HIPAA Privacy and Security regulations.