HIPAA Security Risk Assessment & Risk Management Plan
HIPAA security risk assessment with clear risk-management priorities
Give your CIO and compliance officer a documented basis for decisions about electronic protected health information (ePHI). ICA’s scoped, interview and evidence-based assessment connects identified risks to a risk register and prioritized risk-management roadmap.
MIS
CISSP
CHISL
CPHIMS
CDH-E
Will Long Sr. · Founder
MIS · CHISL · CDH-E · CISSP · CPHIMS
Nearly 40 years in IT & cybersecurity
Former VP & CISO, Children’s Health System of Texas
Tim Pelikan · Co-Founder
Credential details pending confirmation
30 years in cybersecurity & data risk
Interviews & industry conversations
Coffee With Closers
Cybersecurity With Discern
“ICA provides distinctive security professionals who excel at building strong client relationships, demonstrate exceptional organization, and deliver practical, risk-based consulting recommendations to our clients.”
Michael Cox, CIPP/US
Chief Privacy Consultant & Founder, SoCal Privacy Consultants
Partner endorsement of ICA’s advisory work
Make risk-treatment decisions from a current analysis
Your last risk analysis may predate a new clinical system, an additional location, or a change in outsourced services. A customer may be asking for documentation that explains your present exposure. Leadership needs to know which ePHI risks deserve attention and why.
This assessment is intended for healthcare providers and business associates that need a documented risk analysis or a defensible remediation plan.
Establish where ePHI lives and moves
HHS guidance describes risk-analysis coverage as all ePHI an organization creates, receives, maintains, or transmits. Relevant environments may include workstations and portable devices, cloud services, electronic communications, backups, and vendor-supported workflows.
Scoping considers systems, locations, vendors, and organization size. Coverage boundaries need to be explicit. If an engagement covers only part of the organization, it does not automatically satisfy a complete organization-wide risk analysis; remaining assessment needs must be identified.
Examine evidence behind the risk priorities
The proposed engagement combines stakeholder interviews with evidence review. Relevant evidence may include inventories, policies, prior analyses, and records supporting the operation of safeguards.
The review considers threats and vulnerabilities alongside existing security measures. Likelihood and potential impact provide a basis for prioritizing identified risks. Missing evidence should remain visible rather than become an assumption that a safeguard works.
The assessment approach and prioritization criteria are agreed during scoping. HHS does not prescribe one universal methodology. The HHS SRA tool may support the work where appropriate; its use is optional and may not suit larger organizations.
Use three connected outputs for planning
Typical deliverables are defined in the agreed scope:
Risk assessment report. A documented account of coverage, identified ePHI risks, and the evidence supporting findings. Leadership can use it to understand the basis for the assessment and its limitations.
Risk register. An organized record of identified risks that gives compliance and IT owners a common reference for risk-treatment discussions.
Prioritized risk-management roadmap. Recommendations for addressing risks in priority order. Use it to discuss which actions should lead and how they fit available resources.
These outputs connect the analysis to planning.
Prepare the scope and the people who know the environment
Cost and timing depend on the breadth of the ePHI environment, location and vendor coverage, organization size, and evidence availability. Agree the assessment objective and deliverable detail before the work begins. An incomplete inventory or a lack of access to key stakeholders can affect the effort needed.
Identify an engagement owner and people who understand clinical or service workflows, security safeguards, and compliance responsibilities. Evidence access and handling arrangements should be agreed with ICA, including appropriate protection for sensitive materials. Your team’s participation establishes the context behind the documents.
Keep analysis, safeguard gaps, and technical testing distinct
CMP-01 focuses on risks to ePHI and recommended risk treatment. A HIPAA Security Rule Gap Assessment examines alignment of safeguards and supporting evidence. A privacy and breach-notification evaluation addresses different processes. Those reviews can inform planning, but a limited safeguard or privacy review does not automatically constitute a complete ePHI risk analysis.
Scanning and technical testing require separate scope and appropriate authorization. The roadmap recommends treatment; remediation execution is separately agreed. This assessment does not certify or guarantee HIPAA compliance. Your organization remains responsible for implementing treatment and maintaining an analysis that reflects its environment.
HIPAA assessment questions
Is this assessment suitable for a business associate?
Yes. The scope considers the ePHI your organization handles through its services, the systems supporting those services, and relevant vendor relationships. A business associate should define its own environment rather than assume a healthcare customer’s analysis covers it.
Can the assessment cover multiple locations and systems?
Coverage is agreed around the organization’s ePHI environment. Identify locations, systems, and information flows during scoping. Any exclusions need to be documented so leadership understands what was reviewed and where further analysis may be needed.
Will the HHS SRA tool be the assessment method?
Only where it fits the agreed approach. The tool targets small and medium providers and may be unsuitable for larger organizations. Interviews and supporting evidence remain important; tool completion alone does not guarantee compliance or exhaustive risk identification.
What affects the assessment’s cost and timing?
The main factors are organization size, systems, locations, vendor coverage, and evidence readiness. The number of stakeholders and the depth of review also matter. These details establish the engagement scope before cost or timing can be confirmed.
How does this differ from a Security Rule gap review?
A gap review examines safeguard alignment. CMP-01 evaluates ePHI risk and recommends prioritized treatment. Where both are needed, their scopes should be coordinated so safeguard findings support the analysis without being mistaken for the whole risk assessment.
Does the risk-management plan include fixing the findings?
The roadmap provides recommendations for your organization’s planning. Implementation requires action by your team or separately agreed work. Scanning and testing are also separately scoped; an assessment report does not establish that recommended changes have been completed.
Define the ePHI assessment your decisions require
Bring your current risk-analysis concern and the decisions leadership needs to make. A scoped HIPAA security risk assessment can connect your environment’s evidence to a report, risk register, and prioritized roadmap. Discuss the coverage needed to give your team a useful basis for risk-management planning.
Make risk-treatment decisions from a current analysis
Your last risk analysis may predate a new clinical system, an additional location, or a change in outsourced services. A customer may be asking for documentation that explains your present exposure. Leadership needs to know which ePHI risks deserve attention and why.
This assessment is intended for healthcare providers and business associates that need a documented risk analysis or a defensible remediation plan.
Establish where ePHI lives and moves
HHS guidance describes risk-analysis coverage as all ePHI an organization creates, receives, maintains, or transmits. Relevant environments may include workstations and portable devices, cloud services, electronic communications, backups, and vendor-supported workflows.
Scoping considers systems, locations, vendors, and organization size. Coverage boundaries need to be explicit. If an engagement covers only part of the organization, it does not automatically satisfy a complete organization-wide risk analysis; remaining assessment needs must be identified.
Examine evidence behind the risk priorities
The proposed engagement combines stakeholder interviews with evidence review. Relevant evidence may include inventories, policies, prior analyses, and records supporting the operation of safeguards.
The review considers threats and vulnerabilities alongside existing security measures. Likelihood and potential impact provide a basis for prioritizing identified risks. Missing evidence should remain visible rather than become an assumption that a safeguard works.
The assessment approach and prioritization criteria are agreed during scoping. HHS does not prescribe one universal methodology. The HHS SRA tool may support the work where appropriate; its use is optional and may not suit larger organizations.
Use three connected outputs for planning
Typical deliverables are defined in the agreed scope:
Risk assessment report. A documented account of coverage, identified ePHI risks, and the evidence supporting findings. Leadership can use it to understand the basis for the assessment and its limitations.
Risk register. An organized record of identified risks that gives compliance and IT owners a common reference for risk-treatment discussions.
Prioritized risk-management roadmap. Recommendations for addressing risks in priority order. Use it to discuss which actions should lead and how they fit available resources.
These outputs connect the analysis to planning.
Prepare the scope and the people who know the environment
Cost and timing depend on the breadth of the ePHI environment, location and vendor coverage, organization size, and evidence availability. Agree the assessment objective and deliverable detail before the work begins. An incomplete inventory or a lack of access to key stakeholders can affect the effort needed.
Identify an engagement owner and people who understand clinical or service workflows, security safeguards, and compliance responsibilities. Evidence access and handling arrangements should be agreed with ICA, including appropriate protection for sensitive materials. Your team’s participation establishes the context behind the documents.
Keep analysis, safeguard gaps, and technical testing distinct
CMP-01 focuses on risks to ePHI and recommended risk treatment. A HIPAA Security Rule Gap Assessment examines alignment of safeguards and supporting evidence. A privacy and breach-notification evaluation addresses different processes. Those reviews can inform planning, but a limited safeguard or privacy review does not automatically constitute a complete ePHI risk analysis.
Scanning and technical testing require separate scope and appropriate authorization. The roadmap recommends treatment; remediation execution is separately agreed. This assessment does not certify or guarantee HIPAA compliance. Your organization remains responsible for implementing treatment and maintaining an analysis that reflects its environment.
HIPAA assessment questions
Is this assessment suitable for a business associate?
Yes. The scope considers the ePHI your organization handles through its services, the systems supporting those services, and relevant vendor relationships. A business associate should define its own environment rather than assume a healthcare customer’s analysis covers it.
Can the assessment cover multiple locations and systems?
Coverage is agreed around the organization’s ePHI environment. Identify locations, systems, and information flows during scoping. Any exclusions need to be documented so leadership understands what was reviewed and where further analysis may be needed.
Will the HHS SRA tool be the assessment method?
Only where it fits the agreed approach. The tool targets small and medium providers and may be unsuitable for larger organizations. Interviews and supporting evidence remain important; tool completion alone does not guarantee compliance or exhaustive risk identification.
What affects the assessment’s cost and timing?
The main factors are organization size, systems, locations, vendor coverage, and evidence readiness. The number of stakeholders and the depth of review also matter. These details establish the engagement scope before cost or timing can be confirmed.
How does this differ from a Security Rule gap review?
A gap review examines safeguard alignment. CMP-01 evaluates ePHI risk and recommends prioritized treatment. Where both are needed, their scopes should be coordinated so safeguard findings support the analysis without being mistaken for the whole risk assessment.
Does the risk-management plan include fixing the findings?
The roadmap provides recommendations for your organization’s planning. Implementation requires action by your team or separately agreed work. Scanning and testing are also separately scoped; an assessment report does not establish that recommended changes have been completed.
Define the ePHI assessment your decisions require
Bring your current risk-analysis concern and the decisions leadership needs to make. A scoped HIPAA security risk assessment can connect your environment’s evidence to a report, risk register, and prioritized roadmap. Discuss the coverage needed to give your team a useful basis for risk-management planning.