What it is
A security risk assessment (the Security Rule calls it a risk analysis, at 45 CFR 164.308) looks at where your practice creates, receives, stores, and sends electronic patient information, what could go wrong with it, and how likely and damaging each risk is.
It's required, not optional, and it's one of the first documents a regulator asks for after a breach or complaint.
What it covers
- Every system that holds patient information: practice management, EHR, imaging, email, and backups
- Who can access each system, and how access is removed when someone leaves
- Computers, laptops, and phones, including whether they're encrypted
- Your network, Wi-Fi, and remote access
- Vendors that handle patient information, and whether you have business associate agreements with them
- Backups and how quickly you could recover
- Physical security of the office and devices
How often
HIPAA doesn't set a fixed schedule, but most practices review their assessment every year and after any major change: a new EHR, a new location, a move to the cloud, or a security incident.
An assessment with no follow-up is a list of known problems. Keep a remediation plan with owners and dates, and record what's been fixed.
How we handle it
We perform risk assessments with our compliance partners and quote them for your practice size and locations. The technical fixes they find, such as MFA, encryption, audit logging, and tested backups, are part of our Healthcare & HIPAA plan, from $170 per user per month.