The HIPAA Security Rule Risk Analysis: What It Requires and Why Most Companies Get It Wrong
The HIPAA Security Rule requires a risk analysis, and it is the requirement regulators cite most often. Here is what a compliant analysis contains, and where companies usually fall short.
The requirement
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). The requirement appears in 45 CFR 164.308(a)(1)(ii)(A), and it is the foundation for the rest of the Security Rule. The analysis must also be reviewed and updated as your environment changes.
What a compliant risk analysis contains
- An inventory of ePHI: every system, application, device, and service that creates, receives, maintains, or transmits ePHI
- Data flows: where ePHI enters, moves, and is stored, including backups and integrations
- Threats and vulnerabilities to each asset, based on how it is actually configured
- Likelihood and impact of each risk, with a documented method
- Current controls that reduce each risk, and whether they work
- Risk determination and a treatment plan, with owners and dates
- Documentation that shows the analysis was done, when, and by whom
Where companies fall short
- Scope too narrow. The analysis covers the EHR and ignores email, file shares, billing, and laptops that hold ePHI.
- Vendors missing. Cloud and SaaS services that store ePHI are left out, even though they carry the risk.
- One-time document. The analysis is written once and never updated after a new system or acquisition.
- No treatment plan. Risks are identified, but nothing is assigned, scheduled, or tracked to closure.
- Misreading "addressable." Addressable implementation specifications are not optional. You must implement them, implement an equivalent alternative, or document why neither is reasonable.
Beyond the risk analysis
The Security Rule also requires administrative, physical, and technical safeguards, including access controls, audit controls, integrity protections, transmission security, and contingency planning. Business associate agreements are required with vendors that handle ePHI for you. Breach notification obligations apply if unsecured PHI is compromised, with notice to affected individuals generally due within 60 days of discovery.
HIPAA has no certification, but some frameworks are certifiable
HIPAA compliance is not certified. Organizations demonstrate it through documentation and, if investigated, through the Office for Civil Rights. Some companies pursue HITRUST, a certifiable framework that maps to HIPAA and is often requested by larger health systems and payers. Whether it is worth the cost depends on your customers.
Start the risk analysis with the data flow map, not the policy binder. The most common finding is an ePHI system nobody listed.
Frequently asked questions
Is a HIPAA risk analysis required every year?
The rule requires the analysis to be accurate and thorough and to be reviewed and updated as your environment changes. Many organizations also perform a formal review annually.
Does HIPAA have a certification?
No. HIPAA compliance is demonstrated through documentation and safeguards. HITRUST is a separate, certifiable framework some organizations pursue for customer assurance.
What does 'addressable' mean in the Security Rule?
It does not mean optional. For an addressable specification, you must implement it, implement an equivalent alternative, or document why it is not reasonable and what you did instead.
Who needs a business associate agreement?
Vendors that create, receive, maintain, or transmit PHI on your behalf generally need a BAA, including cloud and SaaS providers that store ePHI.
Related articles
Want this applied to your company?
A free 30-minute scoping call tells you which frameworks apply and what it would take.