The HIPAA Risk Analysis

by Sarah Harvey / May 15th, 2017

The HIPAA risk analysis is the starting point for any HIPAA audit, and the most important component for achieving and maintaining HIPAA compliance. If risk analysis is such a critical part of HIPAA compliance, why is it the number one finding by the Office for Civil Rights (OCR)? Unfortunately, this means that a lot of business associates and covered entities, who are required to comply with HIPAA laws, just aren’t completing a HIPAA risk analysis.

Why is HIPAA Risk Analysis Important?

Aside from being the most common issue found during the Phase 1 HIPAA audits, the HIPAA risk analysis is necessary in order to meet requirements under 45 CFR 164.308(a)(1)(ii)(A). Performing a HIPAA risk analysis is uniquely designed to help you identify your specific risks to ePHI by laying out a roadmap that allows you to prioritize risks and properly protect ePHI.

How do you Perform a HIPAA Risk Analysis?

Performing a HIPAA risk analysis begins with documenting the flow of electronic Protected Health Information (ePHI) within your organization and understanding where all of your sensitive data lies. By taking a systematic, risk-based approach, you can begin to ask yourself a series of questions. What ePHI do you encounter? Where is it stored? How is it transmitted? How is it processed? Once you have documented these answers, you can prioritize your risks by the likelihood and impact these risks have on your organization.

Utilizing a third party, like KirkpatrickPrice, to conduct your HIPAA risk analysis can be helpful when you only have limited resources and understanding of the risk analysis process. Contact us today with any questions regarding getting started with your HIPAA risk analysis.