Source: https://clearwatercompliance.com/blog/top-5-things-need-know-healthcare-risk-management/
Timestamp: 2017-03-28 06:07:54
Document Index: 596673509

Matched Legal Cases: ['§164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

Top 5 Facts You Need to Know About Healthcare and Risk Management | Clearwater Compliance
Top 5 Facts You Need to Know About Healthcare and Risk ManagementHome/Blog/Top 5 Facts You Need to Know About Healthcare and Risk Management	Top 5 Facts You Need to Know About Healthcare and Risk Management
Throughout the past month, we’ve received several questions regarding Information Risk Management in healthcare. These questions come from both HIPAA Covered Entities as well as Business Associates. Many of these organizations are hearing different things about the upcoming OCR Audits from various sources. We at Clearwater want to be a guide to help navigate the often complicated world of compliance, so we have rounded up some of the common questions below along with some guidance and resources.
Here are the top 5 facts you should know about Risk Management.
1. What’s the difference between risk analysis and risk management?
In a nutshell, risk analysis is a systematic, rigorous process that is undertaken to identify all the possible ways in which a compromise of the confidentiality, integrity or availability of any sensitive information (electronic Protected Health Information [ePHI], in our case) may be compromised. The main deliverable from a risk analysis is risk register or risk rating report prioritizing these possible compromises.
Risk management uses the risk rating report as the basis for making informed decisions with respect to these risks. As a practical matter, these decisions typically include choices such as accepting a risk, avoiding a risk, mitigating a risk and/or transferring a risk. Risk management decisions should result in lowering inherent risks to levels of residual risk that are acceptable to the organization.
2. How often must an organization complete a risk analysis?
The HIPAA Security Rule does not state whether a risk analysis is required with a specific frequency. Industry best practice, across all industries, is to conduct a risk analysis at least on an annual basis and at the time of any major organizational, operational or technological change in the organization.
3. What exactly do the HIPAA Security Rule risk analysis and risk management implementation specifications require? What is the language?
45 C.F.R. §164.308(a) (1) (i) Standard: Security Management Process
4. Did HHS / OCR provide any additional clarification on the risk analysis and risk management requirements?
Yes, HHS / OCR published a 9-­‐page PDF in July 2010 entitled “HHS / OCR Guidance on Risk Analysis Requirements under the HIPAA Security Rule”. The guidance specifies none (9) essential requirements as follows:
Scope of the Analysis -­‐ all ePHI that an organization creates, receives, maintains, or transmits must be included in the risk analysis. (45 C.F.R. § 164.306(a)).
Data Collection -­‐ the data on ePHI gathered using these methods must be documented. (See 45 C.F.R. §§ 164.308(a) (1) (ii) (A) and 164.316 (b) (1).)
Identify and Document Potential Threats and Vulnerabilities -­‐ Organizations must identify and document reasonably anticipated threats to ePHI. (See 45 C.F.R. §§ 164.306(a) (2), 164.308(a) (1) (ii) (A) and 164.316(b) (1) (ii).)
Assess Current Security Measures -­‐ Organizations should assess and document the security measures an entity uses to safeguard ePHI. (See 45 C.F.R. §§ 164.306(b) (1), 164.308(a) (1) (ii) (A), and 164.316(b) (1).)
Determine the Likelihood of Threat Occurrence -­‐ The Security Rule requires organizations to take into account the likelihood of potential risks to ePHI. (See 45 C.F.R. § 164.306(b) (2) (IV).)
Determine the Potential Impact of Threat Occurrence -­‐ The Rule also requires consideration of the “criticality,” or impact, of potential risks to confidentiality, integrity, and availability of ePHI. (See 45 C.F.R. § 164.306(b) (2) (IV).)
Determine the Level of Risk -­‐ the level of risk could be determined, for example, by analyzing the values assigned to the likelihood of threat occurrence and resulting impact of threat occurrence. (See 45 C.F.R. §§ 164.306(a) (2), 164.308(a) (1) (ii) (A), and 164.316(b) (1).)
Finalize Documentation -­‐ The Security Rule requires the risk analysis to be documented but does not require a specific format. (See 45 C.F.R. § 164.316(b) (1).)
Periodic Review and Updates to the Risk Assessment -­‐ the risk analysis process should be ongoing. In order for an entity to update and document its security measures “as needed,” which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed. (45 C.F.R. §§ 164.306(e) and 164.316(b)(2)(iii)
5. How does HHS / OCR enforce compliance with the HIPAA Security Rule risk analysis and risk management implementation specifications?
The HITECH Act mandated increased enforcement of all HIPAA regulations. The increased enforcement includes, but is not limited to:
Mandated audits -­‐ 2012, which began in pilot form in 2012 (115 Covered Entities were audited; 68% had adverse findings related to risk analysis)
Increased Investigations, with focus on risk analysis and risk management. Following is a sample of language from a recent OCR Investigation Letter “Initial Data Request”:
“9. Please submit a copy of XYZ Hospital’s most recent risk analysis, as well as a copy of all risk analyses performed for or by copy XYZ Hospital within the past 6 years pursuant to 45 C.F.R. § 164.308(a)(l)(ii)(A). If no risk analysis has been performed, please state so.”
SAG provided jurisdiction by The HITECH Act, with several civil suits already filed on behalf of their state’s citizens
Mandated audits – 2015, HHS/OCR has announced that 350 Covered Entities and 50 Business Associates will be audited in the next wave expected to commence in January 2015. HHS / OCR has announced that the audit focus for the HIPAA Security Rule in this next wave will be risk analysis and risk management.
If you or your organization is looking for assistance in establishing, and maturing your Risk Management program, Clearwater can help!
Since the HIPAA Security Rule is based on the NIST Security Framework and the HHS / OCR “HHS / OCR Guidance on Risk Analysis Requirements under the HIPAA Security Rule” refers heavily to the NIST Security Framework, we encourage organizations to study the compendium of NIST Special Publications that comprise this framework.
Clearwater Compliance provides a full suite of resources and solutions to assist Covered Entities and Business Associates of all sizes establish, operationalize and mature their risk management program. These resources and solutions include, but are not limited to:
Clearwater HIPAA Security Risk Analysis™ software Free Trial (for qualified organizations – Click here contact us today to request yours!)
About Latest Posts Michelle CaswellSenior Director, Legal & Compliance at Clearwater ComplianceMichelle Caswell has over 14 years legal and healthcare experience and worked as a HIPAA Investigator for the U.S. Department of Health and Human Services, Office for Civil Rights where she ensured covered entities were in compliance with HIPAA, conducted complaint investigations and educated entities on HIPAA compliance. Michelle brings that experience to Clearwater Compliance as Senior Director, Legal and Compliance. Latest posts by Michelle Caswell (see all)	What to Know About OCR Pre-Audit Questionnaires - June 3, 2016	HIPAA and Firearms. Balancing privacy with public safety. - February 1, 2016	Cornell Faces Heavy Fines with Latest OCR Resolution Agreement - May 4, 2015	By Michelle Caswell|2015-12-21T22:42:32+00:00October 16th, 2014|Blog|0 Comments	About the Author: Michelle Caswell	Michelle Caswell has over 14 years legal and healthcare experience and worked as a HIPAA Investigator for the U.S. Department of Health and Human Services, Office for Civil Rights where she ensured covered entities were in compliance with HIPAA, conducted complaint investigations and educated entities on HIPAA compliance. Michelle brings that experience to Clearwater Compliance as Senior Director, Legal and Compliance.	Related PostsPermalinkGalleryFive Frequently Overlooked Assets to Include in Your HIPAA Risk AnalysisMarch 13th, 2017|0 CommentsPermalinkGalleryCall for State Privacy Laws to Align with HIPAAMarch 1st, 2017|0 CommentsPermalinkGalleryChaos in Data Transfer Laws between the EU and USFebruary 1st, 2017|0 CommentsPermalinkGalleryHIPAA Risk Analysis Tip – OCR CAP Data: Learn Why 9 of 10 Organizations FailJanuary 28th, 2017|0 CommentsPermalinkGalleryIF YOU HAVE TO DISCLOSE, LOOK YOUR BESTDecember 27th, 2016|0 Comments	Leave A Comment Cancel reply	Stay Up-To-Date On Clearwater & Industry News | Subscribe to the Clearwater Newsletter	Testimonials	The Clearwater Compliance website has been a critical source of information for my HIPAA compliance efforts over many years. The information format is easy to read and understand, and it gets to the point. Clearwater Compliance obviously cares about helping us keep out of trouble!Tim Moser, Shawnee Township Fire Department