HIPAA: Five Steps to Ensuring Your Risk Assessment Complies with OCR Guidelines | Healthcare Informatics Magazine | Health IT | Information Technology Skip to content Skip to navigation

HIPAA: Five Steps to Ensuring Your Risk Assessment Complies with OCR Guidelines

July 14, 2017
by Janice Ahlstrom, R.N., and Kenneth Zoline
| Reprints
Click To View Gallery

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) and healthcare technology have changed significantly over the past 20 years. Covered entities and their business associates face an ever-evolving risk environment in which they must protect electronic protected health information (ePHI). Although healthcare security budgets may increase this year, the cost of implementing and maintaining adequate security controls to protect an entity’s ePHI far exceeds what is often budgeted. As a result, some ePHI may be under-protected and vulnerable to data breach. A long-term, consistent and cost-conscious approach to HIPAA compliance is needed.

Risk analysis: The foundation of an effective HIPAA compliance plan

Risk analysis is one of four required HIPAA implementation specifications that provide instructions to implement the Security Management Process standard. To further clarify risk analysis, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance on the risk analysis requirement in July 2010. The HIPAA Security Rule states that an organization must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization.

Janice Ahlstrom, R.N.


Components of Strong Cybersecurity Program - A Closer Look at Endpoint Security Best Practices

Endpoint protection remains a core security challenge for many healthcare organizations and it is more important than ever for healthcare organizations to actively manage their full range of...

Additionally, security risk analysis must be performed in order to comply and attest to Meaningful Use of electronic health records as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009.

With the OCR increasing enforcement efforts with a second year of random audits for both covered entities and their business associates related to HIPAA compliance, risk analysis plays a critical role. Organizations need to comply with the HIPAA risk analysis requirement if they are to be fiscally responsible and avoid returning Meaningful Use Medicare and Medicaid payments, avoid OCR fines and avert the cost of breach notification efforts.

Kenneth Zoline

Risk analysis – Five steps to getting it right

Today, we find a range of compliance issues and tools used to conduct risk analysis when providing services. Often, HIPAA risk assessment reports do not meet the guidance defined by OCR or support complete review of the security rule controls. Checklists of policies and procedures, penetration test results and IT assessments barely scratch the surface of the data security safeguards. The wide variance in HIPAA risk analysis scope and reporting suggests that many organizations may not truly understand the HIPAA Security Rule and how to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization as defined by the OCR. The five steps below should put you on the right track to be compliant with OCR guidelines.

1. Evaluate your current HIPAA risk assessment

The following components should be included in your current risk assessment efforts:

  • Identification of assets that create, store, process or transmit ePHI and the criticality of the data
  • Identification of threats and vulnerabilities to ePHI assets, the likelihood of occurrence and the impact to the organization along with a risk rating
  • Evaluation and documentation of the administrative, physical and technical safeguards for the organization, by department where applicable, and for each application with ePHI
  • Evaluation and documentation of the security measures currently used to safeguard ePHI. Are the controls configured and used properly? What are the vulnerabilities?
  • Evaluation of HIPAA policies and procedures – are the documents dated, signed, reviewed periodically and available?

If all of the above items are not included in the scope of your risk assessment, the assessment may not be acceptable with an OCR audit.

2. Select the right HIPAA risk assessment tool

The OCR highlights two tools in its 2010 guidance that provide a framework for risk assessment:

Security Risk Assessment Tool (SRA) - developed by the Office of the National Coordinator for Healthcare Information Technology (ONC). The ONC’s SRA user guide walks users through 156 questions with resources to help understand the context of each question. It also allows users to factor in the likelihood and impact to ePHI in the organization. The tool functions on mobile devices as well. It can be downloaded from HealthIT.gov. The tool is geared towards smaller practices and while a good starting point, it does not take into consideration many of the complexities of larger organizations.

Risk Assessment Toolkit - developed by a team of Health Information Management Systems Society (HIMSS) professionals. The HIMSS Risk Assessment guide and data collection matrix contains a PDF user guide, Excel workbooks with NIST risk analysis references, application and hardware inventory workbooks, HIPAA Security Rule standards, implementation specifications and a defined safeguards workbook. The safeguards are numbered 1-92 and correspond to the Security Scorecard workbook.

The scorecard differentiates numbered safeguard components to be assessed for the organization, by department and within applications that contain ePHI. The HIMSS Risk Assessment toolkit is available at: http://www.himss.org/himss-security-risk-assessment-guidedata-collection-matrix. The tool includes NIST Special Publication 800-30 Revision 1 guidance for completing a risk assessment.

3. Determine the risk analysis frequency

One of the most prevalent challenges in complying with the HIPAA Security Rule’s risk analysis requirement is determining the frequency or triggering conditions for performing a risk analysis.

The HIPAA Security Rule and 2010 OCR risk analysis guidance state that risk analysis should be “ongoing” to document and update security measures as needed. The security rule states that continuous risk analysis should be completed to identify when updates are needed. OCR guidance notes that the frequency of performance will vary among covered entities.

Some covered entities may perform these processes annually or as needed (e.g., bi-annual or every three years) depending on circumstances of their environment. Typically, covered entities that are attesting to Meaningful Use and complying with the spirit of the security rule will conduct an annual HIPAA risk assessment.

4. Perform the risk assessment: insource or outsource

HIPAA does not specify who should perform the risk assessment. Some organizations insource, some outsource and some do both – alternating between insourcing and outsourcing. For example, an organization may hire external resources to conduct the HIPAA risk assessment every other year, and on the off year, the organization may choose to conduct it internally. Where practical, a separation of duties should exist between the HIPAA risk assessment team and the systems implementers and operations staff. Hiring an outside professional to conduct the risk analysis reduces risk by providing an impartial assessment from someone who was not involved in the implementation of your systems or the development of your policies, procedures and security controls.

5. Support cost savings without sacrificing risk assessment quality

How do you contain costs in performing a HIPAA risk analysis? Use an industry standard tool for assessment and stick with it. The industry standard tools also help to define a clear scope of effort. Often organizations can become disconcerted trying to conduct a self-assessment with a previous year’s report provided by an outside professional.

Final analysis: What could be missed, overlooked or found?

Healthcare organizations must implement strong data security safeguards. Doing so supports compliance with the HIPAA Security Rule, reduces risk and helps ensure the confidentiality, integrity and availability of the ePHI the organization creates, receives, maintains or transmits. Conducting internal risk analysis along with annual risk assessments that leverage a professional services provider every other year also reduces risk and maximizes the value of the resources engaged. Finally, leveraging an industry standard toolkit will help your organization be comfortable with conducting self-assessments on alternating years while saving time and money.



Janice Ahlstrom, R.N., director of risk, internal audit and cybersecurity, Baker Tilly janice.ahlstrom@bakertilly.com

Kenneth Zoline, manager of technology risk and cybersecurity, Baker Tilly kenneth.zoline@bakertilly.com

Baker Tilly is a Chicago-based advisory firm.


The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


Cybersecurity, Telehealth and Interoperability “Top of Mind” for IT Execs in 2019

November 19, 2018
by Heather Landi, Associate Editor
| Reprints
Click To View Gallery

As health system leaders look ahead to the challenges and opportunities of the coming year, they are increasing their spending to defend against cyberattacks, expressing optimism about reimbursement for telehealth services, and feeling anxiety about Apple, Amazon and Google entering the health care space, according to a new survey.

The second annual survey, conducted by the Pittsburgh-based Center for Connected Medicine (CCM) in partnership with the Health Management Academy, reflects the opinions of healthcare C-suite leaders from nearly 40 major U.S. health systems across the country about their IT priorities for the year ahead. CCM is a collaborative health care executive briefing center jointly operated by GE Healthcare, Nokia and UPMC. The Alexandra, Va.-based Health Management Academy is a membership organization consisting of executives from the country’s top 100 health systems focused on sharing best practices.

Conducted in three parts, the research started with a survey of health system information officers—CIOs, chief medical informatics officers (CMIOs) and chief nursing informatics officers (CNIOs— in May 2018 to determine the top areas of health IT for 2019. A quantitative survey was conducted in July 2018 with questions focused on cybersecurity, telehealth and interoperability. In September 2018, qualitative interviews were completed with 18 C-suite executives, including chief executive officers, chief operating officers, CIOs and CMIOs.

According to the survey report, “Top of Mind for Top Health Systems 2019,” health system executive leaders identified cybersecurity, telehealth and interoperability as the top three areas of health IT that will have the most impact in 2019. Cybersecurity remained at the top of the list from the previous year’s survey, and telehealth and interoperability climbed the ranking. The previous year’s Top of Mind report had identified cybersecurity, consumer-facing technology, and predictive analytics as the top three areas of focus for 2018.

“While consumerism and analytics remain hot topics in health care, it was not surprising to see telehealth and interoperability rise in the minds of health IT executives for 2019. Policymakers, in particular, have emphasized telehealth and interoperability in the past year, and the threats of cyberattacks and data breaches are constant in health care,” the report authors wrote.

While healthcare executive leaders cited those three topics as immediate, pressing concerns, when asked what health IT technologies they anticipated would have the most impact on health care five year from now, health system executive leaders identified artificial intelligence, consumer technology, and genomics. According to the report, one CNIO said: “The technology is moving so fast that it is hard to predict five years out. I would not have picked some of these for 2019 one year ago.”


Hackers and other cyber-criminals are stepping up their attacks on the health care industry, leading 87 percent of respondents to say they expect to increase spending on cybersecurity in 2019; no health system was expecting to decrease spending. Half of respondents expect a spending increase greater than five percent.

For 2019, health systems said they would invest cybersecurity resources to bolster current areas of investment, with many focusing on both staff and technology, such as firewalls, intruder detection software, and dual authentication that guard against breach of protected health information (PHI).

Despite increasing financial investment and prioritization of cybersecurity at health systems, executives did not express robust confidence in their organization’s IT recovery and business continuity plans after an attack or breach. Seven out of 10 respondents reported being “somewhat confident” in their recovery and continuity plans; only 20 percent said they were “very confident.”

The most commonly cited challenge in cybersecurity was employee education—62 percent of respondents named “staff” as greatest point of cybersecurity weakness. What’s more, phishing and spear-phishing were cited as the most common types of cyberattacks in the previous 12 months.

According to the report, one CEO commented during an interview: “The people that are up to no good have far better tools than we do on our platforms. If they really target you, they will likely find a way in.… We are not trying to make it impenetrable, but we are trying to make it more difficult to break into our system than others in our market.”


Health information technology (IT) leaders overwhelmingly expect government and commercial reimbursement to provide the majority of funding for telehealth services by 2022; internal funding and patient payments are expected to provide the majority of funding for telehealth in 2019.

Government policy is driving some of this optimism, the report authors wrote. “For example, CMS [The Centers for Medicare & Medicaid Services] published a proposal in July 2018 that provided three new remote patient monitoring reimbursement medical codes. While some critics have said the proposal’s $14 reimbursement for virtual check-ins is too low, the move by CMS appears to cement telehealth reimbursement as a priority for the agency.”

All responding health systems report telehealth accounts for 10 percent or less of their organization’s total care delivery, however, over the next three years, 45 percent of respondents expect use of telehealth to increase by 10 percent or more. Lack of reimbursement was cited as the most significant barrier to adopting greater telehealth services, cited by 70 percent of respondents.

Most health system executives interviewed for the study said their health system had not yet calculated a specific return on investment (ROI) for telehealth. But systems are investing anyway as a hedge that future reimbursement will outweigh the potential losses of today, according to the survey report. “For the moment, reimbursement is widely thought of in terms of physician time, but as technologies evolve, the question will be whether reimbursement will expand to hardware. Investment can also be seen as a bellwether for provider sentiment toward transformation to value-based care,” the report authors wrote.

When considering a telehealth technology system, top features/priorities are “integration with the clinical workflow” and “ease of patient triage and virtual follow-up,” according to the survey.

Need for Innovation Drives Focus on Interoperability

Interoperability has emerged as a key challenge in health care as hospitals and health systems pursue value-based care, consumerism, and other initiatives that require broad sets of data from disparate IT systems, the report noted. As the health care industry continues to evolve, provider health systems are having to think more creatively about their strategies in order to remain successful.

A lack of interoperability has made it more difficult for health systems to address certain key priorities, most commonly improved efficiency / cost reduction, and advanced analytics, the report said. Additionally, executives report challenges addressing care gap closure, longitudinal patient data, and integration with non-owned partners

More than half of respondents (61 percent) said the use of a major electronic health record (EHR) system was not stifling digital innovation at their health system. However, in qualitative interviews, several executives said an EHR was limiting their ability to innovate by locking them into a single vendor’s products, according to the report.

Seventy percent of informatics executive said they were “somewhat concerned” about big tech companies, such as Apple, Amazon and Google, disrupting the health care market; 10 percent were “very concerned,” the survey found.

The report quotes one CEO who said: “They are new competitors that look very different from traditional health care competitors. They are better in their space and can catch up quickly. Current stakeholders are resistant to change. If we’re slow and dodgy we’re going to get lapped.”

The survey also examined the role of the cloud in the future of health IT. The majority of health care data is expected to be stored in on-premises data centers (20 percent) or hybrid / private cloud (60 percent) in the next three years, according to the survey, and 10 percent said they anticipate storing health data in a public cloud.


More From Healthcare Informatics


Health First Data Breach Exposes Information of 42K Patients

November 15, 2018
by Rajiv Leventhal, Managing Editor
| Reprints

A data breach at Florida-based Health First exposed the personal information of some 42,000 patients, according to various industry media reports this week.

The website DataBreaches.net reported that in early October, the healthcare provider Health First notified the Department of Health & Human Services (HHS) of a breach that affected 42,000 patients.  The breach actually occurred earlier in the year, however, between February and May 2018, according to the report, which received a statement from the organization’s senior vice president, consumer and retail services.

The Health First executive noted that “a small number of our employees were the victims of a phishing scam which compromised some of our customers’ information. The criminals were able to gain access of these employees’ email accounts for a limited period of time.”

Health First officials also told Florida Today this week that the data breach “was fairly low-level, though it could have included some customers' Social Security numbers. Mostly it appears to have involved information such as addresses and birth dates. No medical information was compromised,” according to this report.

Phishing attacks continue to plague the healthcare industry; the single largest breach this year was a hacking incident affecting 1.4 million patient records that involved UnityPoint Health, an Iowa-based health system. That said, cybersecurity professionals are still looking for more advanced ways to get out in front of these attacks, as healthcare has traditionally lagged behind other industries in in phishing resiliency.

Related Insights For: Cybersecurity


Components of Strong Cybersecurity Program - A Closer Look at Endpoint Security Best Practices

Tuesday, December 18, 2018 | 1:00 p.m. ET, 12:00 p.m. CT

Endpoint protection remains a core security challenge for many healthcare organizations and it is more important than ever for healthcare organizations to actively manage their full range of endpoints.

Attend this session to learn why it's more important than ever for healthcare organizations to actively manage their full range of endpoints, endpoint security best practices, and how your endpoint management strategy may need to evolve over time.

See more on Cybersecurity

betebettipobetngsbahis bahis siteleringsbahis