HIPAA Risk Assessment Template

Introduction

Risk analysis is the most acute HIPAA compliance problem that the Department of Health and Human Services (HHS) for Office of Civil Rights (OCR) investigates. An inaccurate or incomplete analysis can lead to serious security breaches and steep monetary penalties. 

But risk analysis can be difficult to implement, especially if your IT department doesn’t have the people or time to spare. The risk assessment template provided here can help you perform a complete and accurate audit of your ePHI security risks so you can put the appropriate mitigation measures in place.

What is a HIPAA risk assessment?

A HIPAA risk assessment helps organizations determine and evaluate threats to the security of electronic protected health information (ePHI), including the potential for unauthorized disclosure as required by the Privacy Rule.

If your organization creates, receives, maintains, or transmits ePHI, even using a certified electronic health record (EHR) system, you must assess your security risks to ensure that you have taken the best steps possible to protect your ePHI. Once you identify those risks, you must implement administrative, physical, and technical safeguards to maintain compliance with the HIPAA Security Rule.

As health care entities work to achieve compliance with HIPAA, risk analysis and risk management tools can be invaluable; they often enable you to protect the confidentiality, integrity, and availability of your ePHI more effectively and efficiently than you could with manual processes.

Tailoring a risk assessment to your organization

HIPAA risk assessment requirements allow you to tailor the assessment to your organization’s environment and circumstances, including:

• Your organization’s size, complexity, and capabilities
• Your organization’s technical infrastructure, hardware, and security capabilities
• The probability and criticality of the potential risks to ePHI
• The cost of the security measures

Implementation specifications: required versus addressable 

A HIPAA risk assessment will contain many implementation specifications, which are detailed instructions to satisfy a certain standard. Some are required, while others are addressable:

• Required specifications document policies or procedures that each covered entity and its business associates must put in place. One example is risk analysis.
• Addressable specifications are not optional, but organizations have the flexibility to choose appropriate processes or controls to meet them. For example, password management is addressable, since there are multiple ways to ensure that only trusted people can access your systems. One way is to use multifactor authentication.

You cannot refuse to adopt an implementation specification based solely on cost.

Key terminology

Here are definitions for terms common to HIPAA, adapted from NIST 800-30:

• ePHI (electronic protected health information) — Data about a patient’s health, treatment, or billing that could identify that patient. ePHI is PHI held in electronic form; it has the same confidentiality requirements as all PHI, but the ease of copying and transmitting ePHI requires special safeguards to prevent breaches.
• Vulnerability — A flaw or weakness in a security system’s procedures, design, implementation of internal controls that could be accidentally triggered or intentionally exploited, resulting in a security breach or violation of the security policy.
• Threat — The potential for a threat source to accidentally trigger or intentionally exploit a specific vulnerability.
• Risk — Refers to IT-related risk. Risk describes the net business impact based on the probability of a specific threat triggering a particular vulnerability. It includes factors like legal liability and mission loss.
• Risk analysis (or risk assessment) — The process of identifying all risks to security of the system, the likelihood they will lead to damage, and safeguards that can mitigate that damage. It is a part of risk management.
• Risk management — The process of implementing security measures and practices to adequately reduce risks and vulnerabilities to a reasonable degree for compliance.

Steps in Risk Analysis 

NIST 800-30 details the following steps for a HIPAA-compliant risk assessment: 

Step 1. Determine the scope of the analysis.

A risk analysis considers all ePHI, regardless of the electronic medium used to create, receive, maintain or transmit the data, or the location of the data. It covers all reasonable risks and vulnerabilities to the confidentiality, integrity, and availability of your ePHI.

Step 2. Gather complete and accurate information about ePHI use and disclosure.

This process includes:

• Reviewing past and existing projects
• Performing interviews
• Reviewing documentation
• Using other data gathering techniques as needed
• Documenting all gathered data

You may have already completed this step to comply with the HIPAA Privacy Rule, even though it was not directly required. 

Step 3. Identify potential threats and vulnerabilities.

Look at the gathered data and consider what types of threats and vulnerabilities exist for each piece of information.

Step 4. Assess your current security measures.

Document the measures you have already implemented to mitigate risks to your ePHI. These measures can be technical or non-technical:

• Technical measures include information system hardware and software, such as access control, authentication, encryption, automatic log-off and audit controls.
• Non-technical measures include operational and management controls like policies, procedures, and physical or environmental security measures.

Then analyze whether the configuration and use of those security measures are appropriate.

Step 5. Determine the likelihood of threat occurrence.

Assess the probability that a threat will trigger or exploit a specific vulnerability. Consider each potential threat and vulnerability combination, and rate them according to the likelihood of an incident. Common rating methods include labeling each risk as High, Medium and Low, or providing a numeric weight expressing the likelihood of occurrence. 

Step 6. Determine the potential impact of threat occurrence.

Consider the possible outcomes of each data threat, such as:

• Unauthorized access or disclosure
• Permanent loss or corruption
• Temporary loss or unavailability
• Loss of financial cash flow
• Loss of physical assets

Estimate the impact of each outcome. Measures can be qualitative or quantitative. Document all reasonable impacts and the ratings associated with each outcome.

Step 7. Determine the level of risk.

Analyze the values assigned to the probability of each threat occurrence and the impact. Assign the risk level based on the average of the assigned probabilities and impact levels. 

Step 8. Identify appropriate security measures and finalize the documentation.

Identify the possible security measures you could use to reduce each risk to a reasonable level. For each measure, consider:

• The effectiveness of the measure
• Legislative or regulatory requirements for implementation
• Organizational policy and procedure requirements

Document all findings to complete your risk assessment.

HIPAA Risk Assessment Template

Below is a HIPAA risk assessment template with a description and an example for each section. This is a general template that you will need to adapt to your organization’s specific needs. All company and personal names used in this template are fictional and are used solely as examples. 

1. Introduction

Explain the reason for the document.

This document outlines the scope and approach of the risk assessment for Allied Health 4 U, Inc. (hereafter referred to as Allied Health 4 U). It includes the organization’s data inventory, threat and vulnerability determination, security measures, and risk assessment results.

1.1 Purpose

State why you need a risk assessment.

The purpose of the risk assessment is to identify areas of potential risk, assign responsibilities, characterize the risk mitigation activities and systems, and guide corrective action procedures to comply with the HIPAA Security Standard.

1.2 Scope 

Document the flow of patient data within your organization. Describe all system components, elements, field site locations, users (including use of a remote workforce) and any additional details about the EHR system.

Document and define your IT systems, components and information, including removable media and portable computing devices.

The scope of this document includes the technical, physical and administrative processes governing all ePHI received, created, maintained or transmitted by Allied Health 4 U. 

The goal is to assess and analyze the use of resources and controls, both planned and implemented, to eliminate, mitigate or manage the exploitation of vulnerabilities by internal and external threats to the electronic health records (EHR) system.

Allied Health 4 U serves the needs of patients and practitioners at Medical City in Regency Park, IL. The related medical center provides the primary internet firewall and basic physical security for the facility. The organization provides all other technology and security needs for Allied Health 4 U, Inc. 

Allied Health 4 U uses laptops, tablets and desktop PCs to access patient ePHI. Remote access from outside Allied Health 4 U is strictly prohibited. Three servers are located in a locked server room with video surveillance enabled.

2. Risk Assessment Approach

Define the methods you use to perform the risk assessment. 

Allied Health 4 U performs the risk assessment by inventorying all physical devices and electronic data created, received, maintained or transmitted by the organization; interviewing users and administrators of the EHR system; and analyzing system data to determine potential vulnerabilities and threats to the system. 

2.1 Participants

Identify the participants, such as all IT staff and management, responsible for or interacting with the EHR. Include a list of participants' names and roles, such as Chief Information Officer or Asset Owner.

The ePHI security officer and the Risk Management Team are responsible for maintaining and executing the ePHI security risk analysis and risk management process for Allied Health 4 U.

1. Chief Information Officer: Bradley Gray, MD
2. Compliance Officer: Jean Parker, MD
3. Risk Assessment Team: William Brown, Takisha Lutrelle, and Lili Obrador 

2.2 Techniques Used to Gather Information

List the methods used to identify and inventory ePHI data, physical devices, processes and procedures.

The following techniques are used to gather information for the risk assessment:

• Interviews with Chief Information Officer, Risk Management Team, users
• Documentation Review — IT policies and processes, threat and vulnerability reports, incident reports, information classification documents.
• Site Visits — Regency Park location, any future locations

2.3 Development and Description of the Risk Scale

Describe when risk assessments are performed, the risk-level matrix in use, how risks are determined, and a risk classification with at least three levels.

Allied Health 4 U conducts risk assessments at the following times:

• After software updates to the EHR
• After the implementation of new hardware, software, or firmware
• After a report of a data breach

Use the following risk matrix to determine the scale of the risk:

Risk scale: 

• HIGH: >25 to 50
• MEDIUM: >5 to 25
• LOW: >0.5 to 5

3. System Characterization

Identify the boundaries of the IT system under consideration and the resources and information making up the system. Characterization establishes risk assessment scope effort, shows the authorization or accreditation pathway, and provides information on connectivity, responsibility and support.

The Allied Health 4 U EHR system is comprised of all laptops, desktops, tablets, servers and ePHI contained therein.

3.1 System-Related Information

Provide related information and a brief description of the processing environment. 

3.2 System Users

Describe who uses the system, including details on user location and level of access.

3.3 Data Inventory

Document all ePHI and where it is stored, received, maintained, or transmitted. 

4. Threats and Vulnerabilities

List all credible threats and vulnerabilities to the system being assessed. Often, you can provide a brief description here and provide the detailed results in an appendix or a separate spreadsheet. 

4.1 Threat Identification

Develop a catalog of reasonably anticipated threats. Your most significant concern is human threats from ex-employees, criminals, vendors, patients or anyone else with motivation, access and knowledge of the system.

4.2 Vulnerability Identification

List all technical and non-technical system vulnerabilities that potential threats could trigger or exploit. Include incomplete or conflicting policies and procedures, insufficient safeguards (both physical and electronic), and other flaws or weaknesses in any part of the system.

Allied Health 4 U identifies the following vulnerabilities:

4.3 Security Measures

Document and assess the effectiveness of all technical and non-technical controls that are currently or will be implemented to mitigate risk. 

5. Risk Assessment Results

Describe the observations (the vulnerabilities and the threats that can trigger them), measure each risk, and offer recommendations for control implementation or corrective action. The detailed results are often better presented in an appendix or a separate spreadsheet. 

6. Revision History

Track all changes to your HIPAA risk assessment.