WIXLIB

HIPAA: Five steps to ensuring yourrisk assessment complies with OCR guidelinesAn independent member of Baker Tilly International

The information on the following pages highlights the essentialcomponents of a HIPAA risk analysis as required by the Officeof Civil Rights (OCR) and shares a cost effective approach tocompleting a risk analysis annually.

HIPAA: Five steps to ensuring your risk assessment complieswith OCR guidelinesHIPAA and healthcare technology have changed significantlyover the past 20 years. See timeline on page 5. Coveredentities and their business associates face an ever-evolvingrisk environment in which they must protect electronicprotected health information (ePHI). Although healthcaresecurity budgets may increase this year, the cost ofimplementing and maintaining adequate security controls toprotect an entity’s ePHI far exceeds what is often budgeted.As a result, some ePHI may be under-protected and vulnerableto data breach. A long-term, consistent and cost-consciousapproach to HIPAA compliance is needed.Additionally, security risk analysis must be performed in orderto comply and attest to Meaningful Use of electronic healthrecords as required by the Health Information Technology forEconomic and Clinical Health (HITECH) Act of 2009.With the OCR increasing enforcement efforts with a secondyear of random audits for both covered entities and theirbusiness associates related to HIPAA compliance, risk analysisplays a critical role. Organizations need to comply with theHIPAA risk analysis requirement if they are to be fiscallyresponsible and avoid returning Meaningful Use Medicare andMedicaid payments, avoid OCR fines and avert the cost ofbreach notification efforts.Current state of healthcareRisk analysis – Five steps to getting it rightHIPAA’s role and importance continues to rise with the valueof the data it was created to protect. Healthcare providers areincreasingly targeted by cybersecurity attacks, and patientdata now commands more than credit card accounts onthe black market and dark web. Distributed denial-of-service(DDoS), ransomware, malware, phishing and rogue softwareare frequently used in cyberattacks launched against hospitalsand other healthcare entities.Today, we find a range of compliance issues and tools usedto conduct risk analysis when providing services. Often, HIPAArisk assessment reports do not meet the guidance defined byOCR or support complete review of the security rule controls.Checklists of policies and procedures, penetration test resultsand IT assessments barely scratch the surface of the datasecurity safeguards. The wide variance in HIPAA risk analysisscope and reporting suggests that many organizations maynot truly understand the HIPAA Security Rule and how toconduct an accurate and thorough assessment of the potentialrisks and vulnerabilities to the confidentiality, integrity andavailability of ePHI held by the organization as defined by theOCR. The five steps below should put you on the right track tobe compliant with OCR guidelines.The message is clear: if you are responsiblefor securing patient and proprietaryhealthcare information, you cannotafford to be unprepared.According to the Ponemon Institute’s Sixth Annual BenchmarkStudy on Privacy & Security of Healthcare Data, nearly 90percent of surveyed healthcare organizations suffered a databreach in the past two years. The average cost of a databreach for the surveyed healthcare organizations exceeded 2.2 million. The projected cost of all data breaches for thehealthcare industry surpassed 6.2 billion.11Evaluate your current HIPAA risk assessmentThe following components should be included in your currentrisk assessment efforts: Identification of assets that create, store, process ortransmit ePHI and the criticality of the data Identification of threats and vulnerabilities to ePHI assets,the likelihood of occurrence and the impact to theorganization along with a risk ratingIn 2016 the U.S. Department of Health and Human Services(HHS) reported that over 12 million patient health recordswere breached.2 The department’s Office for Civil Rights (OCR)levied over 24 million in fines and a prison sentence wasordered for inappropriately obtaining ePHI.3 Evaluation and documentation of the administrative,physical and technical safeguards for the organization, bydepartment where applicable, and for each application withePHIRisk analysis: The foundation of an effectiveHIPAA compliance plan Evaluation and documentation of the security measurescurrently used to safeguard ePHI. Are the controlsconfigured and used properly? What are the vulnerabilities?Risk analysis is one of four required HIPAA implementationspecifications that provide instructions to implement theSecurity Management Process standard. To further clarifyrisk analysis, the OCR released guidance on the risk analysisrequirement in July 2010. The HIPAA Security Rule statesthat an organization must conduct an accurate and thoroughassessment of the potential risks and vulnerabilities to theconfidentiality, integrity and availability of ePHI held by theorganization. Evaluation of HIPAA policies and procedures – are thedocuments dated, signed, reviewed periodically andavailable?If all of the above items are not included in the scope of yourrisk assessment, the assessment may not be acceptable withan OCR audit.1

2Select the right HIPAA risk assessment toolThe OCR highlights two tools in its 2010 guidance that providea framework for risk assessment:Selecting a third-party HIPAArisk assessment partnerSecurity Risk Assessment Tool (SRA) - developed by theOffice of the National Coordinator (ONC) for HealthcareInformation Technology. The ONC’s SRA user guide walksusers through 156 questions with resources to helpunderstand the context of each question. It also allowsusers to factor in the likelihood and impact to ePHI in theorganization. The tool functions on mobile devices as well.It can be downloaded from HealthIT.gov. The tool is gearedtowards smaller practices and while a good starting point, itdoes not take into consideration many of the complexities oflarger organizations.If your organization lacks theknowledge, experience or requisitetraining to perform a HIPAA riskassessment, we recommendengaging security specialists whounderstand healthcare, healthcaretechnology and the HIPAA SecurityRule. However, it is often hard tofind all of these skills in one person.Often, it is a team of two or moreindividuals who together have thisknowledge and the right skills toprovide the best service.Risk Assessment Toolkit - developed by a team of HealthInformation Management Systems Society (HIMSS)professionals. The HIMSS Risk Assessment guide anddata collection matrix contains a PDF user guide, Excelworkbooks with NIST risk analysis references, applicationand hardware inventory workbooks, HIPAA Security Rulestandards, implementation specifications and a definedsafeguards workbook. The safeguards are numbered 1-92and correspond to the Security Scorecard workbook.The scorecard differentiates numbered safeguard componentsto be assessed for the organization, by department and withinapplications that contain ePHI. The HIMSS Risk Assessmenttoolkit is available at: -guidedata-collection-matrix. The tool includesNIST Special Publication 800-30 Revision 1 guidance forcompleting a risk assessment.When assessing resources, Understand how long the vendorhas been providing theseservices Understand the types ofcertifications and qualificationsthe vendor has Be sure the resources haveyears of experience providingsecurity, risk and complianceservices Look for qualified professionalswith certifications such as: CISA,CPHIMS, CCSFP, CISSP, HCISSP,CIPT, CISM, ISSMP or CCSFPRegardless of the tool chosen to helpwith the assessment, the most importantaspect of the risk analysis is taking anopen and honest view of the threatsand vulnerabilities to the environment.3Determine the risk analysis frequencyOne of the most prevalent challenges in complying with theHIPAA Security Rule’s risk analysis requirement is determiningthe frequency or triggering conditions for performing a riskanalysis.The HIPAA Security Rule and 2010 OCR risk analysis guidancestate that risk analysis should be “ongoing” to document andupdate security measures as needed. The security rule statesthat continuous risk analysis should be completed to identifywhen updates are needed. OCR guidance notes that thefrequency of performance will vary among covered entities.2

Some covered entities may perform these processes annually or as needed (e.g., bi-annual or every three years) depending oncircumstances of their environment. Typically, covered entities that are attesting to Meaningful Use and complying with the spiritof the security rule will conduct an annual HIPAA risk assessment.4Perform the risk assessment: insource or outsourceHIPAA does not specify who should perform the risk assessment. Some organizations insource, some outsource and some doboth – alternating between insourcing and outsourcing. For example, an organization may hire external resources to conductthe HIPAA risk assessment every other year, and on the off year the organization may choose to conduct it internally. Wherepractical, a separation of duties should exist between the HIPAA risk assessment team and the systems implementers andoperations staff. Hiring an outside professional to conduct the risk analysis reduces risk by providing an impartialassessment from someone who was not involved in the implementation of your systems or the development of yourpolicies, procedures and security controls. See sidebar for selection tips.5Support cost savings without sacrificing risk assessment qualityHow do you contain costs in performing a HIPAA risk analysis? Use an industry standard tool for assessment and stick with it.The industry standard tools also help to define a clear scope of effort. Often organizations can become disconcerted trying toconduct a self-assessment with a previous year’s report provided by an outside professional.A practical approach for risk assessmentYear 1 Conduct the assessment with anexternal professional(s) Define internal resources inyour organization and be surethey are educated on use of theassessment toolkit – make it partof the risk assessment serviceengagementYear 2 Conduct an internal selfassessment using the selectedtoolkit Consult your year one externalprofessional, should you requireguidanceYear 3 Benefit from additional costsavings beyond doing the year twoassessment internally by engagingthe same external professional(s)for the year three assessment forless cost than in year one - as longas the scope of your environmenthas remained stable The toolkit being used will befamiliar to everyone involved andprevious assessment informationwill be documented and ready forefficient review and analysis3