U.S. Department of Health and Human Services (HHS) The Office of the National Coordinator for Health Information Technology (ONC) Security Risk Assessment (SRA) Tool Administrative Safeguards Content Version Date: March 2014 DISCLAIMER The Security Risk Assessment Tool at HealthIT.gov is provided for informational purposes only. Use of this tool is neither required by nor guarantees compliance with federal, state or local laws. Please note that the information presented may not be applicable or appropriate for all health care providers and professionals. The Security Risk Assessment Tool is not intended to be an exhaustive or definitive source on safeguarding health information from privacy and security risks. For more information about the HIPAA Privacy and Security Rules, please visit the HHS Office for Civil Rights (OCR) Health Information Privacy website at: NOTE: The NIST Standards provided in this tool are for informational purposes only as they may reflect current best practices in information technology and are not required for compliance with the Security Rule’s requirements for risk assessment and risk management. This tool is not intended to serve as legal advice or as recommendations based on a provider or professional’s specific circumstances. We encourage providers, and professionals to seek expert advice when evaluating the use of this tool.
Please include any additional Please detail your remediation plan: Please rate the likelihood of a threat/vulnerability affecting your ePHI: Low Medium High Please rate the impact of a threat/vulnerability affecting your ePHI: Low Medium High Related Information: Things to Consider to Help Answer the Question: The definition of workforce includes employees, volunteers, and trainees. Consider whether your workforce members who are authorized to access ePHI have a unique identifier, and their role and corresponding access to ePHI is the minimum necessary to carry out their duties.
Medium High Related Information: Things to Consider to Help Answer the Question: Consider whether your practice understands that training is an ongoing, evolving process that responds to environmental and operational changes affecting the security of ePHI. Possible Threats and Vulnerabilities: Your practice may not be able to safeguard its ePHI if it does not periodically review and update its security awareness and training program in response to changes in organization, facilities or environment. Some potential impacts include: Unauthorized or inappropriate access to ePHI can compromise the confidentiality, integrity, and availability of your practice’s ePHI. Unauthorized disclosure, loss, or theft of ePHI can lead to medical identity theft. Accurate ePHI may not be available when needed, which can adversely impact your healthcare professionals’ ability to diagnose and treat their patients. Examples of Safeguards: Some potential safeguards to use against possible threats/vulnerabilities. NOTE: The safeguards you may choose will depend on the degree of risk (likelihood) and the potential harm that the threat/vulnerability poses to you and the individuals who are the subjects of the ePHI. Implement a security awareness and training program for all members of its workforce (including management). [45 CFR §164.308(a)(5)(i)] Review and update the current security awareness and training policy and procedures based on environmental and operational changes affecting the security of ePHI. [NIST SP 800-53 AT-1] A36 - §164.308(a)(5)(i) Standard Does your practice provide ongoing basic security awareness to all workforce members, including physicians? Yes
Please detail your current activities: Please include any additional notes: Please detail your remediation plan: Please rate the likelihood of a threat/vulnerability affecting your ePHI: Low Medium High Please rate the impact of a threat/vulnerability affecting your ePHI: Low