Security

Why an Effective HIPAA Compliance Risk Assessment Is Crucial to Securing PHI

When it comes to keeping protected health information secure and within regulation, these tips can get you started.

Juliet is the senior web editor for BizTech and HealthTech magazines. In her six years as a journalist she has covered everything from aerospace to indie music reviews — but she is unfailingly partial to covering technology.

Healthcare professionals everywhere are embracing digital technologies to safeguard patient information. As this trend continues, there is an industrywide need to ensure the digital ecosystem is compliant with regulations, specifically the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

While protecting patient data should be enough incentive in its own right to secure protected health information, healthcare organizations can see significant penalties for noncompliance with HIPAA regulations, with fines that can range between $100 and $1.5 million. And these violations are not uncommon: In 2018, providers racked up more than $25 million in HIPAA fines.

Moreover, healthcare organizations are particularly susceptible to insider threats that can result in significant PHI breaches. Healthcare IT leaders aren’t blind to the fact that protecting PHI should be high on their to-do lists: According to a recent survey by CDW, the top IT concern for providers in the coming year is protecting patient information.

So how can providers get a jump on safeguarding PHI effectively and compliantly? The first step is to conduct a risk assessment.

LEARN MORE: See what HIPAA compliance risk assessments can do for your organization.

What Is a Risk Assessment?

Also known as a security assessment or risk analysis, a risk assessment is a comprehensive look at an organization’s security structure that aims to uncover potential threats and vulnerabilities within the IT ecosystem.

When it comes to healthcare organizations, this pertains to “the confidentiality, integrity, and availability of electronic protected health information” held by the organization, according to the Health and Human Services Department notes in guidance on risk analysis.

Providers Stay HIPAA Compliant with Risk Assessments

Conducting a risk assessment specifically aimed at staying HIPAA compliant can be a key way to keep patient protected health information safe while avoiding breaches and penalties for violations. It’s also important to note that, for providers, regular risk assessments are required.

“The outcome of the risk analysis process is a critical factor in assessing whether an implementation specification or an equivalent measure is reasonable and appropriate,” HHS notes.

Moreover, risk assessments can do more than just help organizations stay compliant; they can go one step further in aiding providers and others in the health ecosystem to address possible vulnerabilities outside of the regulations.

“While compliance with these regulations may be mandatory, it is usually not sufficient to protect an organization against cybersecurity risks. A more effective option for organizations is to adopt a risk-based approach to security that performs a holistic assessment of the threats facing an organization and the vulnerabilities in its current operating environment,” notes a CDW white paper entitled “Move to a Risk-Based Security Strategy.”

HIPAA Risk Assessment Template

While there isn’t an official risk analysis method, HHS does provide guidelines to ensure that the risk assessment meets its ultimate goal: to help organizations understand how their organization’s technologies and strategies line up with HIPAA and implement the necessary security measures in their operational environment.

HHS lays out the aims of a HIPAA risk assessment for healthcare organizations as follows, suggesting organizations undertake a risk assessment in order to:

Design appropriate personnel screening processes
Identify what data to back up and how
Decide whether and how to use encryption
Address what data must be authenticated in particular situations to protect data integrity
Determine the appropriate manner of protecting health information transmissions

The typical risk assessment template includes stakeholder interviews, gap analysis for security, practices and procedures, penetration and vulnerability testing, and detailed reporting.

Recommended Risk Assessment Tools for HIPAA Compliance

There are several toolkits available for organizations that want to assess their HIPAA compliance and security practices around PHI. Some tools for conducting risk assessments include:

Vulnerability assessments
Penetration tests
External perimeter tests
Wireless security tests
Internal assessments
Social engineering tests to prevent phishing exploits

Often, however, it can be difficult — especially for small providers with limited resources — to ensure that an in-house security team has conducted a thorough audit. This is where a third-party risk assessment can prove helpful.

By tapping an outside source to conduct the assessment and provide actionable feedback, the provider can ensure that the assessment touches all places PHI could be lurking and can receive help in moving forward to close security gaps.

Want more info on staying HIPAA compliant? Check out HealthTech’s HIPAA compliance checklist on cloud storage!

andrei_r/Getty Images