Businesses applying for payments under the Promoting Interoperability program have to “conduct or review a security risk analysis in accordance with the requirements in 45 CFR § 164.308”. Additionally, businesses must attest to having implemented all security updates as necessary and corrected any security deficiencies that have been identified in the risk analysis.