HIPAA Risk Analysis Conductor

Overview

The HIPAA Security Rule requires covered entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This skill provides the methodology, frameworks, and documentation templates to execute compliant risk analysis.

Legal Requirement

45 CFR § 164.308(a)(1)(ii)(A) - Risk Analysis (Required)
"Conduct an accurate and thorough assessment of the potential risks 
and vulnerabilities to the confidentiality, integrity, and availability 
of electronic protected health information held by the covered entity 
or business associate."

Key Points:

• Required, not addressable
• Must be "accurate and thorough"
• Must be documented
• Documentation retained 6 years (45 CFR § 164.316)
• Must be updated when changes occur

Risk Analysis Workflow

┌─────────────────────────────────────────────────────────────────┐
│                    RISK ANALYSIS PROCESS                        │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  STEP 1         STEP 2         STEP 3         STEP 4           │
│  ────────       ────────       ────────       ────────          │
│  Scope &        Asset          Threat &       Risk              │
│  Inventory      Analysis       Vulnerability  Assessment        │
│                                                                 │
│       │              │              │              │            │
│       ▼              ▼              ▼              ▼            │
│                                                                 │
│  STEP 5         STEP 6         STEP 7         STEP 8           │
│  ────────       ────────       ────────       ────────          │
│  Risk           Risk Mgmt      Document       Review &          │
│  Scoring        Plan           Everything     Monitor           │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Step 1: Define Scope and ePHI Inventory

Scope Definition

Document the boundaries of the analysis:

SCOPE DOCUMENTATION
───────────────────
Organization: {legal_name}
Locations covered: {list all physical locations}
Systems covered: {all systems that create, receive, maintain, transmit ePHI}
Workforce covered: {all workforce members with ePHI access}
Business associates: {list BAs with ePHI access}
Date of analysis: {date}
Analysis conducted by: {name/title}

ePHI Asset Inventory

Identify ALL locations where ePHI exists:

Asset Inventory Template

ASSET ID: {unique_id}
Asset Name: {name}
Asset Type: {system/device/media/network}
Description: {what it does}
ePHI Types: {what PHI it contains}
Location: {physical/cloud location}
Owner: {responsible person/dept}
Users: {who has access}
Criticality: {High/Medium/Low}
Current Safeguards: {existing protections}

Step 2: Identify Threats and Vulnerabilities

Threat Categories

Common Healthcare Vulnerabilities

Threat-Vulnerability Pairing

For each asset, document applicable threat-vulnerability pairs:

ASSET: {asset_name}

THREAT-VULNERABILITY PAIRS:
┌─────────────────────┬──────────────────────┬──────────────────────┐
│ Threat              │ Vulnerability        │ Potential Impact     │
├─────────────────────┼──────────────────────┼──────────────────────┤
│ Ransomware attack   │ Unpatched OS         │ Loss of availability │
│ Lost laptop         │ No encryption        │ Breach of PHI        │
│ Misdirected email   │ No DLP controls      │ Unauthorized access  │
│ Terminated employee │ No access revocation │ Unauthorized access  │
└─────────────────────┴──────────────────────┴──────────────────────┘

Step 3: Assess Current Security Measures

Security Rule Safeguard Mapping

Evaluate current state against required/addressable safeguards:

Administrative Safeguards (§164.308)

Physical Safeguards (§164.310)

Technical Safeguards (§164.312)

Step 4: Determine Likelihood and Impact

Likelihood Scale

Impact Scale

Impact Factors to Consider

• Number of individuals affected
• Sensitivity of PHI involved
• Financial harm to individuals
• Reputational harm to organization
• Regulatory/legal consequences
• Operational disruption

Step 5: Calculate Risk Scores

Risk Scoring Matrix

RISK SCORE = LIKELIHOOD × IMPACT

              │ Impact                        │
              │ Low (1)  Medium (2)  High (3) │
──────────────┼──────────────────────────────│
Likelihood    │                              │
  High (3)    │   3         6          9     │
  Medium (2)  │   2         4          6     │
  Low (1)     │   1         2          3     │
──────────────┴──────────────────────────────┘

Risk Level Classification

Risk Register Entry

RISK ID: R-{number}
Asset: {asset_name}
Threat: {threat_description}
Vulnerability: {vulnerability_description}
Existing Controls: {current_safeguards}
Likelihood: {H/M/L} ({score})
Impact: {H/M/L} ({score})
Risk Score: {calculated_score}
Risk Level: {Critical/High/Medium/Low}
Risk Response: {Mitigate/Accept/Transfer/Avoid}
Remediation Plan: {description}
Target Date: {date}
Owner: {responsible_person}
Status: {Open/In Progress/Closed}

Step 6: Develop Risk Management Plan

Risk Response Options

Risk Management Plan Template

RISK MANAGEMENT PLAN
────────────────────

For each identified risk:

RISK ID: {id}
Risk Description: {description}
Current Risk Level: {level}
Response: {Mitigate/Accept/Transfer/Avoid}

MITIGATION ACTIONS (if mitigating):
┌────────────────────┬──────────┬───────────┬────────────┐
│ Action             │ Owner    │ Due Date  │ Status     │
├────────────────────┼──────────┼───────────┼────────────┤
│ {action_1}         │ {name}   │ {date}    │ {status}   │
│ {action_2}         │ {name}   │ {date}    │ {status}   │
└────────────────────┴──────────┴───────────┴────────────┘

ACCEPTANCE RATIONALE (if accepting):
{documented_rationale}
Approved by: {name/title}
Date: {date}

RESIDUAL RISK LEVEL: {level after mitigation}
NEXT REVIEW DATE: {date}

Step 7: Document Everything

Required Documentation

Documentation Best Practices

• Date all documents
• Version control (track changes over time)
• Identify authors and approvers
• Store securely (it's sensitive information)
• Make retrievable for audits

Step 8: Review and Update Triggers

Mandatory Review Triggers

Continuous Monitoring

ONGOING ACTIVITIES:
□ Monitor security alerts and incidents
□ Track remediation progress
□ Update asset inventory as changes occur
□ Review access logs periodically
□ Test backup/recovery procedures
□ Assess new vendor risks before onboarding
□ Evaluate changes before implementation

OCR Audit Preparation

What OCR Looks For

Common OCR Findings

Resources

references/

• security-rule-checklist.md — Full §164.308-312 safeguard checklist
• threat-vulnerability-catalog.md — Common healthcare threats and vulnerabilities
• risk-analysis-template.md — Fillable risk analysis document

scripts/

• risk-calculator.py — Calculates risk scores from inputs

assets/

• risk-register-template.xlsx — Excel risk register template
• risk-analysis-report-template.docx — Final report template