Blog

How to Perform a HIPAA Risk Assessment in 2023

There is a prevalent concern for American healthcare providers: how to perform a HIPAA risk assessment in 2023, and how it relates to your organization’s cyber health.

With healthcare data breaches having had the highest security breach costs for over twelve consecutive years (and showing no signs of slowing down), shifting to focus on cybersecurity-related compliance is a must to protect both staff and patient confidentiality

Let’s explore:

What is a HIPAA Risk Assessment?

A HIPAA risk assessment is a method of helping healthcare organizations ensure its compliance with HIPAA (the Health Insurance Portability and Accountability Act.) It works to ensure best practices for all administrative, physical, and technical safeguards, as well as expose areas where an organization’s protected health information (PHI) are at risk.

More specifically, risk assessments dive into:

• What kind of PHI can be accessed

• Scope of the analysis

• Where security gaps and risks are located

• The effectiveness of existing security measure

• What types of threats are most likely to threaten the PHI

• The potential impact of a threat

• Remediation recommendations and required final documentation

 Is a HIPAA Risk Assessment Mandatory?

While HIPAA doesn’t provide instructions on how a risk analysis can or should be conducted, it is mandatory in order to be considered HIPAA compliant.

The U.S Department of Health and Human Services (HHS) created HIPAA to combat PHI fraud and theft risks. HHS’ Office for Civil Rights ( OCR) regulates its implementation. HIPAA’s second section, Title II, contains the security measures a CE must maintain to be considered HIPAA compliant. 

These rules dictate that administrative, physical, and technical safeguards are necessary for compliance. As such, CEs are required to:

• Ensure the confidentiality, integrity, and availability of ePHI

• Pinpoint and protect against reasonably anticipated threats

• Protect against impermissible uses or disclosures

• Ensure consistent employee compliance

Proof that your organization has conducted a risk assessment that outlines the following four points is essential. Although the needs and vulnerabilities of healthcare entities can vary from organization to organization, HIPAA asks that organizations meet these requirements as fully as they can via the resources available to them.

The Three Mandates of HIPAA’s Security Rule

HIPAA’s Security Rule mandates the following safeguards:

Technical

• Access: The ability to read, write, modify, and communicate data (including files, systems, applications, and devices) without sacrificing unique user identifiers, data encryption, and timed automatic logoffs

• Controls: Tools for recording and examining activities within organizational tools and systems

• Authentication: The capacity to verify the identity of all relevant entities or individuals accessing protected information

• Integrity: The process of detailing data protection policies and procedures

Physical

• Access control for facilities: The process of detailing policies and procedures for accessing facilities and physical information systems

• Workstation use and security: The documentation of the appropriate use and security of physical workstations, including browser usage and how to authorize individuals 

• Devices and media: The procedures for the removal of hardware and related electronic media both inside and outside of the organization’s physical location

Administrative

• Security management process: The process of detailing the policies and procedures regarding preventing, detecting, and correcting HIPAA violations

• Assigned security protocols: The ability to assign a designated security official who implements security-related policies

• Workforce security: The documentation for procedures governing employee access to ePHI

• Security training: The implementation of security awareness training across all key stakeholders

• Security incident procedures: The capacity to identify incidents and report them to appropriate persons in a timely manner, including contingency plans for data backup and disaster recovery 

• Business agreements and evaluation: Periodic evaluation of all implemented security and written agreements in place for vendors, contractors, and other business associates that have access to PHI

How to Conduct a HIPAA Risk Assessment in 2023

Here are our recommended steps for conducting a HIPAA risk assessment:

• Determine what PHI you and your organization have access to: Include where the information is stored, what tools are used to transmit and safeguard that data, and what rules employees follow to handle or view that data.

• Assess existing security measures: Document what you find regarding how in-line your existing security measures are with HIPAA’s Title II security requirements.

• Identify areas of vulnerability: Consider the gaps in your existing physical and cybersecurity, as well as the financial and reputation-related ramifications of a potential data breach.

• Determine your organization’s level of risk: Assign risk levels for all found security vulnerabilities (both existing and potential.) Include a list of intended corrective actions.

• Finalize all risk assessment documentation: Once all of this information is collected, distinctly outline it in your risk assessment report. 

HIPAA states that this process needs to be done on a periodic basis, so it’s advised that your organization has a process in place for recurring risk assessment.

Bonus: HIPAA Pentesting

Although pentesting is not a required step of HIPAA risk assessments, penetration testing for healthcare organizations can make the difference between experiencing a monumental data breach and avoiding it altogether.

HIPAA penetration testing identifies a covered entity’s security weaknesses and vulnerabilities. The participating authority reviewing HIPAA compliance permits a qualified analyst to access its networks. From there, that assigned analyst then conducts penetration testing to simulate the actions of a malicious hacker.

Healthcare-related penetration testing involves the controlled, supervised hacking of your networks, applications, and other security components. Once the testing is complete, the tester will provide you and your key stakeholders with the results, detailing the weaknesses, vulnerabilities, and potential threats to your security.

As we like to say here at Packetlabs–there’s no such thing as “passing” a pentest. There’s simply learning from it.

Conclusion

With a 600% increase in cybercrime since 2021, risk assessments for healthcare organizations have never been so vital.

Looking to strengthen your security posture? Reach out to our team today or download our Buyer’s Guide below.