Exploring Risk Assessment Software
Channel: HIPAA Survival Guide
Date: 20/11/2018

Risk Assessment ("RA") software is a type of "process ware" that should encompass an industry standard methodology for conducting RAs. In the healthcare space there is no de jure standard for conducting a Risk Assessment; however, a de facto standard has emerged in the form of NIST SP800-30 Rev.1 ("Standard"). NIST is the federal government agency responsible for providing cybersecurity advice to all U.S. government agencies, and what NIST recommends is the aforementioned Standard. With respect to HIPAA, this Standard is only a recommendation.  Covered entities ("CEs") and business associates ("BAs") are free to choose their own methodologies for achieving the same objective. However, it would be both misleading and misguided to suggest that CEs and BAs may select any arbitrary methodology as a substitute for the Standard. In short, if OCR is recommending a particular Standard then any substitute that is as good as or better than the Standard is likely to meet the "reasonable and appropriate" requirement of the Security Rule; all others are likely to fall far short.