A HIPAA Risk Analysis creates an understanding for an organization to know what their current compliance level with HIPAA is and where risks within their compliance program exist.  HOWEVER, a lot of confusion is created when determining how to complete a HIPAA Risk Analysis.  It is important that each Covered Entity and Business Associate understand the risk analysis and ensure the risk analysis is being properly conducted for their specific organization.  Understanding common myths to the risk analysis can help an organization create the risk process and task to complete their risk analysis.

Myth #1 – The Security Risk Analysis is optional for small providers.  FALSE

All providers who are classified as a covered entity or a business associate must complete a HIPAA Risk Analysis in order to comply with the HIPAA Security Rule Section 164.308(a)(1).  The HIPAA Security Rule doesn’t define how often the Risk Analysis must be completed, but rather it must be complete and risks identified must be addressed and corrected.

Myth #2 – By Installing a Certified Electronic Health Record (EHR), the Security Risk Analysis Requirement is Complete. FALSE

Even though the certification process requires that EHRs meet some baseline security requirements, it does not satisfy the entire HIPAA Privacy Rule and HIPAA Security Rule regulations.  The Risks Analysis is intended to look at all practices and process that involved protected health information, electronic, verbal, paper, or other media.  Regardless if the healthcare organization has a certified EHR, an electronic practice management system, or a paper base practice, a risk analysis needs to be completed.

Myth #3 – My EHR vendor took care of everything I need to do about privacy and security and the risk analysis. FALSE

The EHR Vendor may have some of the requirements for compliance under the HIPAA Security rule such as contingency plans for back up and restoration of data; however, the covered entity is responsible for the overall compliance with the HIPAA Privacy and Security regulations.  While an EHR vendor may be able to assist with the process, the covered entity needs to ensure the risk analysis is completed, which evaluates their practices for privacy and security.  Many of times these practices include other sources of protected health information (PHI) outside of the EHR.

Myth #4 – I have to outsource the security risk analysis.  FALSE

The HIPAA Security Rule doesn’t define the process for conducting the HIPAA risk analysis.  There are many tools out there to help and assist with conducting a HIPAA risk analysis, both free and paid services.  It is really the preference of the covered entity or business associate as how the risk analysis will be conducted and if they choose to outsource the process.  Having the knowledge and expertise to conduct a complete and thorough risk analysis is an important aspect of the completion of the risk analysis.

Myth #5 – A checklist will suffice for the risk analysis requirement.  FALSE

A checklist can by useful and helpful as you are conducting a risk analysis; however, it should not be the only tool used when conducting the risk analysis.  Covered entities and business associates need to ensure that policies and procedures are in place; physical, technical, and administrative safeguards are implemented; and that the physical space is reviewed as part of the comprehensive risk analysis.  Think of it as evaluating the policies and procedures, reviewing implemented safeguard (technical, administrative, and physical), understanding the auditing and monitoring processes, and evaluating employee education.

Myth #6 – There is a specific risk analysis method that I must follow.  FALSE

The HIPAA Security Rule doesn’t define a specific methodology for the security risk analysis to be completed.  Allowing the security rule to have scalability to each specific organization, the Office for Civil Rights has only issued guidance on the security risk analysis.  It is up to the specific covered entity or business associate to determine how the risk analysis will be performed and the type of documentation that will exist on the findings.  The only item to keep in mind that it needs to be effective on identifying risk to the PHI that the organization creates, maintains, transmits and stores and well as there needs to be effective and efficient risk management to implement appropriate safeguards to reduce the risks identified.  Additionally, each time that a risk analysis is completed, a formal report should be created including the date, process, and findings.

Myth #7 – My security risk analysis only needs to look at my EHR and the PHI we store in it. FALSE

It is important that the covered entity and business associate review and evaluate every device and system that store, capture, transmit, or modify protected health information.  The review should range from reviewing all computers, laptops, and tablets to all copy machines and smart phones that may access PHI.  Additionally, safeguards need to be in place for all paper that is created, maintained, stored, and destroyed by the covered entity or business associate.

Myth #8 – I only need to do a risk analysis once. FALSE

The HIPAA Security Rule doesn’t define how often a security risk analysis should be conducted; however, in order to comply with the regulations, a covered entity or business associate must continue to review, correct, identify, modify, and update security protections that the organization has.  A policy and procedure should be created to manage the HIPAA risk analysis and risk management process within an organization.  If an organization is receiving Medicare or Medicaid EHR Incentive Program funds, a risk analysis needs to be completed or updated for each EHR reporting period.

Myth #9 – Before I attest for an EHR incentive program, I must fully mitigate all risks identified in the Risk Analysis.  FALSE

The EHR incentive program, also known as Meaningful Use, requires that an eligible provider or eligible hospital correct and/or address any deficiencies identified during the risk analysis during the reporting period or as part of the risk management process.

Myth #10 – Each year, I’ll have to completely redo my security risk analysis.  FALSE

A full security risk analysis should be conducted when you adopt the EHR, do major changes to your systems, or implement new regulations regarding privacy and security.  Each year or when changes to your practice or electronic systems occur, review and update the risk analysis for changes in the risks to your practice.

Conducing a risk analysis can be a challenging process that takes time and resources to complete.  A risk analysis that is properly completed allows an organization to identify risks and fix them before a major security incident or data breach occurs.  Don’t take this requirement lightly, make sure you take the time and complete the risk analysis!  Reviewing the corrective action plans and fines assessed by the federal government, failure to complete a risk analysis is a top finding in the documentation.

Unsure how to complete a HIPAA Risk Analysis, check out TriPoint Healthcare Solutions's Services! 

Danika

Even though HIPAA has been around for over a decade, it is making news daily with health data breaches and the upcoming HIPAA audits.  When talking with many healthcare organizations, HIPAA is not and has not been a top priority within the organization.  In fact, many healthcare organizations implemented HIPAA in 2003 and 2005 as required by the compliance dates of the HIPAA Privacy and Security Rule and haven’t done any additional work on compliance. 

With the announcement by the Office of Civil Rights that the Phase 2 HIPAA audits will begin in early 2016, and afterwards a permanent HIPAA Audit program will be established, all healthcare organizations as well as business associates need to evaluate the current level of compliance and understand the risks within the organization.  The best process to take for evaluation of current compliance and risks is conducting a HIPAA risk analysis, as required by the HIPAA Security Rule.

When conducting a HIPAA risk analysis, a checklist of the regulations may be use as a guide, but it is important to understand that a checklist SHOULD NOT be the only item used when conducting a HIPAA Risk Analysis.  A checklist can be a good guide as you evaluate your current level of compliance, but other aspects of HIPAA compliance should also be evaluated during a HIPAA Risk Analysis process.  In addition to a checklist, healthcare organizations should also follow these simple steps to conduct a complete risk analysis:

• Conduct Physical Walk-throughs – Part of the HIPAA regulations focus on the physical features of an organization. A walk-through should be conducted to determine: how information is being processed, where information may be improperly used, what safeguards are established for electronic equipment, how you are protecting paper records, if people are logging out of computers or systems when they are walking away.  These are some basic areas to review during a walkthrough.  A simple walkthrough checklist can be helpful during the process.

• Collect Supporting Evidence of Compliance – An organization should collect evidence to support compliance with privacy and security policies and procedures established. For example, if you state that you will conduct information activity review on a bi-monthly basis, an organization will want to ensure that they have evidence of the bi-monthly information activity reviews. 

• Conduct Workforce Interviews – Workforce members are the first line of defense with safeguarding and protecting PHI. It is important to understand the workforce’s knowledge and comfort with using and protecting PHI throughout the normal course of business.  Ask workforce questions to understand the comfort and adherence to organizational policies and procedures.   

• Review Unauthorized Uses and Disclosures of PHI (and Data Breaches) – one area of non-compliance can be from the history of data breaches or unauthorized uses and disclosures of PHI. During the risk analysis process, an organization should evaluate the recent issues with the use and disclosure of PHI to trend issues and evaluate if potential risks exist.  For example, if 4 unauthorized disclosures are due to wrong faxes sent, there could be an indication a risk exists with employee education on faxing PHI.  Taking time to review this activity can help trend and understand the issues and potential risks within your organization. 

• Evaluate Conducting Network Security Testing (Penetration Testing) – while not a requirement, it is a good idea to have penetration testing done to determine if there are security risks within your network infrastructure. Network security testing involves electronically evaluating the current network infrastructure to determine if here are weakness in the network.  Network weakness can lead to unauthorized intrusion and hacking into a network.  Penetration testing will look very different depending on the size and complexity of the network established. 

Regardless of the size of your organization, the foundational step in any HIPAA compliance program is the completion of a HIPAA Risk Analysis.  Why this is not mandated to be conducted on a yearly basis, the organizations that find themselves most comfortable and compliant with the HIPAA regulations conduct a Risk Analysis on a regular basis.  Don’t be the next headline of a large data breach with a monetary fine and corrective action plan.  Conduct a robust HIPAA risk analysis and feel confident with your compliance.

Danika