HIPAA: Five Steps to Ensuring Your Risk Assessment Complies with OCR Guidelines | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HIPAA: Five Steps to Ensuring Your Risk Assessment Complies with OCR Guidelines

July 14, 2017
by Janice Ahlstrom, R.N., and Kenneth Zoline
| Reprints
Click To View Gallery

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and healthcare technology have changed significantly over the past 20 years. Covered entities and their business associates face an ever-evolving risk environment in which they must protect electronic protected health information (ePHI). Although healthcare security budgets may increase this year, the cost of implementing and maintaining adequate security controls to protect an entity’s ePHI far exceeds what is often budgeted. As a result, some ePHI may be under-protected and vulnerable to data breach. A long-term, consistent and cost-conscious approach to HIPAA compliance is needed.

Risk analysis: The foundation of an effective HIPAA compliance plan

Risk analysis is one of four required HIPAA implementation specifications that provide instructions to implement the Security Management Process standard. To further clarify risk analysis, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance on the risk analysis requirement in July 2010. The HIPAA Security Rule states that an organization must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization.

Janice Ahlstrom, R.N.

Additionally, security risk analysis must be performed in order to comply and attest to Meaningful Use of electronic health records as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.

With the OCR increasing enforcement efforts with a second year of random audits for both covered entities and their business associates related to HIPAA compliance, risk analysis plays a critical role. Organizations need to comply with the HIPAA risk analysis requirement if they are to be fiscally responsible and avoid returning Meaningful Use Medicare and Medicaid payments, avoid OCR fines and avert the cost of breach notification efforts.

Kenneth Zoline

Risk analysis – Five steps to getting it right

Today, we find a range of compliance issues and tools used to conduct risk analysis when providing services. Often, HIPAA risk assessment reports do not meet the guidance defined by OCR or support complete review of the security rule controls. Checklists of policies and procedures, penetration test results and IT assessments barely scratch the surface of the data security safeguards. The wide variance in HIPAA risk analysis scope and reporting suggests that many organizations may not truly understand the HIPAA Security Rule and how to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization as defined by the OCR. The five steps below should put you on the right track to be compliant with OCR guidelines.

1. Evaluate your current HIPAA risk assessment

The following components should be included in your current risk assessment efforts:

  • Identification of assets that create, store, process or transmit ePHI and the criticality of the data
  • Identification of threats and vulnerabilities to ePHI assets, the likelihood of occurrence and the impact to the organization along with a risk rating
  • Evaluation and documentation of the administrative, physical and technical safeguards for the organization, by department where applicable, and for each application with ePHI
  • Evaluation and documentation of the security measures currently used to safeguard ePHI. Are the controls configured and used properly? What are the vulnerabilities?
  • Evaluation of HIPAA policies and procedures – are the documents dated, signed, reviewed periodically and available?

If all of the above items are not included in the scope of your risk assessment, the assessment may not be acceptable with an OCR audit.

2. Select the right HIPAA risk assessment tool

The OCR highlights two tools in its 2010 guidance that provide a framework for risk assessment:

Security Risk Assessment Tool (SRA) - developed by the Office of the National Coordinator for Healthcare Information Technology (ONC). The ONC’s SRA user guide walks users through 156 questions with resources to help understand the context of each question. It also allows users to factor in the likelihood and impact to ePHI in the organization. The tool functions on mobile devices as well. It can be downloaded from HealthIT.gov. The tool is geared towards smaller practices and while a good starting point, it does not take into consideration many of the complexities of larger organizations.

Risk Assessment Toolkit - developed by a team of Health Information Management Systems Society (HIMSS) professionals. The HIMSS Risk Assessment guide and data collection matrix contains a PDF user guide, Excel workbooks with NIST risk analysis references, application and hardware inventory workbooks, HIPAA Security Rule standards, implementation specifications and a defined safeguards workbook. The safeguards are numbered 1-92 and correspond to the Security Scorecard workbook.


Get the latest information on Health IT and attend other valuable sessions at this two-day Summit providing healthcare leaders with educational content, insightful debate and dialogue on the future of healthcare and technology.

Learn More