What is a HIPAA risk assessment?

A HIPAA risk assessment is an important first step for all healthcare organizations that must properly comply with HIPAA rules. HIPAA (the Health Insurance Portability and Accountability Act of 1996) is U.S. legislation created to improve healthcare standards. Covered entities (CEs) and their business associates (BAs) must be HIPAA compliant to protect the rights and privacy of patients and their protected health information (PHI). Let’s explore the significance of a risk assessment under HIPAA’s Security Rule and why it is a useful and mandatory tool for HIPAA compliance.

HIPAA Security Rule

The U.S. Department of Health and Human Services ( HHS) created HIPAA largely to combat fraud and abuse as related to PHI. HHS’ Office for Civil Rights ( OCR) regulates its implementation. The act's second section (Title II) contains the actual security measures a CE must maintain for HIPAA compliance.

RELATED: Understanding and Implementing HIPAA Rules

Several addendums further explain how CEs achieve HIPAA compliance, but the one we are examining today is the Security Rule. This rule establishes the security standards necessary for the protection of electronic PHI (ePHI). It addresses the how of PHI use and disclosure. The rule specifies that administrative, physical, and technical safeguards are necessary for compliance.

CEs must:

• Ensure confidentiality, integrity, and availability of ePHI
• Identify and protect against reasonably anticipated threats
• Protect against reasonably anticipated, impermissible uses or disclosures
• Ensure employee compliance

If such safeguards are in place, the chance of a data breach and/or HIPAA violation is minor.

RELATED: What to Do After You Violate HIPAA

A HIPAA risk assessment is the first step to knowing what protections a CE should utilize.

What is a HIPAA risk assessment?

HHS calls the risk assessment the foundational step to HIPAA compliance. It helps figure out the most effective and most appropriate administrative, physical, and technical safeguards to properly protect ePHI. All while considering each CE’s unique needs and characteristics. There is no one way to perform a risk assessment as there is no one solution to cybersecurity.

A HIPAA risk assessment can tackle and analyze:

• Scope of the analysis
• Potential threats and vulnerabilities
• Current security measures
• The likelihood of a threat
• The potential impact of a threat
• The level of risk
• Helpful security measures and final documentation needed

It can also figure out what data to collect for future needs.

RELATED: How Does an IT Asset Inventory Aid HIPAA Compliance?

There are several ways for a CE to conduct a risk assessment. OCR and the Office of the National Coordinator for Health Information Technology provide one such tool: the HIPAA Security Risk Assessment Tool for small- and medium-sized covered entites. The two agencies recently provided a newer, more user-friendly version. Another tool is the National Institute of Standards and Technology’s HIPAA Security Toolkit Application which any size CE can use to understand and implement HIPAA requirements.

Why is a HIPAA risk assessment mandatory?

A HIPAA risk assessment is not only useful but also mandatory under the Security Rule, though CEs do not have to use either tool above. It’s required because the assessment helps CEs wade through HIPAA’s addressable and required specifications. And keeps cyberattacks from succeeding. Rather than thinking of a risk assessment as daunting, a CE should embrace this foundational step.

CEs can use the information provided by a risk assessment to:

• Design appropriate personnel screening processes
• Identify what data to backup and how
• Decide whether and how to use encryption
• Address what data must be authenticated to protect data integrity
• Determine the appropriate way to protect PHI transmissions

Moreover, a mandatory risk assessment encourages CEs to continuously check, assess, and update their policies and procedures.

HIPAA compliant email—a great second step

A great second step after a risk assessment is to focus on secure communication with HIPAA compliant email. This is because communication with patients is important for proper patient care. Paubox Email Suite offers security and HIPAA compliance as well as ease of use for both CEs and patients. Paubox Email Suite works on every type of device so patients can always be in contact. There is nothing to download or any account to create/monitor. No password to remember. No extra clicks or web pages to wade through to get to a place where a patient can read an email from their doctor. With our  HITRUST CSF certified solution, all emails are encrypted and sent directly from existing email platforms (such as  Microsoft 365 and  Google Workspace). With Paubox Email Suite, CEs can effectively care for their patients and engage them in their health outcomes. All while remaining safe and secure. Start with a risk assessment and ensure that you only use strong cybersecurity to protect yourself and your patients today.