Source: https://clearwatercompliance.com/hipaa-hitech-news/hipaa-and-it-security/hipaa-security-risk-analysis-tips-9-essential-elements/
Timestamp: 2018-06-22 09:15:39
Document Index: 227890807

Matched Legal Cases: ['§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164', '§ 164']

HIPAA Security Risk Analysis Tips – 9 Essential Elements
Home/Archived News & Content, Blog, HIPAA and IT Security, HIPAA Laws, HIPAA Privacy-Security Reminders, HIPAA Security Risk Analysis Tips, HITECH Act/HIPAA Security Risk Analysis Tips – 9 Essential Elements
The HIPAA Security Final Rule requires all that all Covered Entities and Business Associates (and, soon likely, their sub contractors) complete a Risk Analysis (45 C.F.R. § 164.308(a)(1)). Here’s a big tip – you can’t simply make up how you’re going to do it! Nor can you always rely on so-called experts who use their own approach. The HHS/OCR Final Guidance on Risk Analysis is clear: Regardless of methodology (and some don’t make the grade!), HHS/OCR cites nine (9) essential elements that must be included in your risk analysis…
9 Essential Elements of a HIPAA Security Risk Analysis
Regardless of the risk analysis methodology employed, your work must include these elements:
Scope of the Analysis – all ePHI that an organization creates, receives, maintains, or transmits must be included in the risk analysis. (45 C.F.R. § 164.306(a)).
Data Collection – The data on ePHI gathered using these methods must be documented. (See 45 C.F.R. §§ 164.308(a)(1)(ii)(A) and 164.316 (b)(1).)
Identify and Document Potential Threats and Vulnerabilities – Organizations must identify and document reasonably anticipated threats to ePHI. (See 45 C.F.R. §§ 164.306(a)(2), 164.308(a)(1)(ii)(A) and 164.316(b)(1)(ii).)
Assess Current Security Measures – Organizations should assess and document the security measures an entity uses to safeguard ePHI. (See 45 C.F.R. §§ 164.306(b)(1), 164.308(a)(1)(ii)(A), and 164.316(b)(1).)
Determine the Likelihood of Threat Occurrence – The Security Rule requires organizations to take into account the likelihood of potential risks to ePHI. (See 45 C.F.R. § 164.306(b)(2)(iv).)
Determine the Potential Impact of Threat Occurrence – The Rule also requires consideration of the “criticality,” or impact, of potential risks to confidentiality, integrity, and availability of ePHI. (See 45 C.F.R. § 164.306(b)(2)(iv).)
Determine the Level of Risk – The level of risk could be determined, for example, by analyzing the values assigned to the likelihood of threat occurrence and resulting impact of threat occurrence. (See 45 C.F.R. §§ 164.306(a)(2), 164.308(a)(1)(ii)(A), and 164.316(b)(1).)
Finalize Documentation – The Security Rule requires the risk analysis to be documented but does not require a specific format. (See 45 C.F.R. § 164.316(b)(1).)
Periodic Review and Updates to the Risk Assessment – The risk analysis process should be ongoing. In order for an entity to update and document its security measures “as needed,” which the Rule requires, it should conduct continuous risk analysis to identify when updates are needed. (45 C.F.R. §§ 164.306(e) and 164.316(b)(2)(iii).)
We suggest you use the list above as an initial screening tool when you’re considering building or buying a methodology or hiring someone to do the work.
In addition to an express requirement to conduct a risk analysis, the Rule indicates that risk analysis is a necessary tool in reaching substantial compliance with many other standards and implementation specifications. We have assembled many useful documents, tools and resources related to Risk Analysis on our site here. Please feel free to use and enjoy them!
Series Navigation << HIPAA Security Risk Analysis Tips – Make it a Team SportHIPAA Security Risk Analysis Tips – What’s a Threat? >>
By Bob Chaput|2017-09-12T15:09:29+00:00October 6th, 2011|Archived News & Content, Blog, HIPAA and IT Security, HIPAA Laws, HIPAA Privacy-Security Reminders, HIPAA Security Risk Analysis Tips, HITECH Act|2 Comments
HIPAA Security Risk Analysis Tips – Recommended Documentation December 23, 2014 at 6:59 am - Reply
[…] Nine (9) essential elements of an acceptable Risk Analysis are cited in the final “Guidance on Risk Analysis Requirements under the HIPAA Security Rule”. The first one addresses the scope of the analysis; that is, what information assets should be included in the review. Then the question arises: how should I inventory and document these assets? Here’s today’s big tip – Take advantage of the time investment and document thoroughly. Learn the guidance; Here’s how… […]
HIPAA Security Risk Analysis Tips - Risk Analysis Methodology December 23, 2014 at 8:39 am - Reply
[…] care what methodology you use as long as your approach incorporates what they identified as nine (9) essential elements in their guidance. Here’s today’s big tip – Don’t re-invent the […]