APMA News - May/June 2017 - 66

IT Consultant
By James R. Christina, DPM

Security Risk Analysis-
What, How, and How Often
The HIPAA Security Rule requires that covered
entities, including podiatrists, conduct a risk
analysis of their health-care organization. A
risk analysis helps your organization ensure it
complies with HIPAA's administrative, physical, and technical safeguards. A risk analysis
also helps reveal risks to your organization's
protected electronic health information (ePHI).
Providers who have been using a certified EHR
and participating in meaningful use over the past
several years should be very familiar with the requirements regarding a security risk analysis relative to their EHR and meeting the requirements for meaningful use.

The important points to remember
are that the HIPAA Security
Rule requires everyone to conduct
an initial security risk analysis and
then perform a periodic review of
security risks. Protecting health
information is an ongoing process
and should be updated based
on changes in circumstances.

66 APMA News May/June 2017

*
*

For each risk to electronic health information your practice
identifies, try to identify how likely it would be for an undesirable action or event to occur as a result of that risk, and evaluate what kind of impact such an action or event would have
on your practice and/or your patients. To mitigate each risk,
your practice can perform two important steps:
1. Review your existing health information security policies and develop new policy statements to address new
risks to electronic health information. These new policy
statements could require using certain technology (e.g.,
encryption of data on mobile computing equipment
such as laptops), further refining who within your practice is authorized to view and administer electronic
health information, or clarifying and improving how
and when electronic health information is provided to
patients or other health-care entities.
2. Institute your updated health information security policies into your practice to mitigate new risks to electronic health information. This step will help your practice keep security policies current and decrease the

Original graphic by Shutterstock/MJ Graphics.

However, the HIPAA Security Rule is more expansive
than both the previous meaningful use EHR requirements
and the new requirements for the Advancing Care Information (ACI) performance category under the Merit-based Incentive Payment System (MIPS). It requires you to assess the
potential risks and vulnerabilities to the confidentiality, integrity,
and availability of all the ePHI an organization creates, receives, maintains, or transmits-not just the ePHI maintained
in Certified EHR Technology (CEHRT). The rule includes
ePHI in other electronic systems and all forms of electronic
media, such as hard drives, floppy disks, CDs, DVDs,
smart cards or other storage devices, personal digital assistants, transmission media, or portable electronic media. In
addition, you will need to review your risk analysis periodical-

ly to assess whether changes in your environment
necessitate updates to your security measures.
Under the HIPAA Security Rule, the frequency of
reviews will vary among providers. Some providers may perform these reviews annually or as
needed depending on circumstances of their
environment. Remember, however, you must perform a security risk analysis to be eligible for any
ACI MIPS score
score.
Information security is the protection of information and information systems from unauthorized access, use,
disclosure, disruption, modification, or destruction. Information security is achieved by ensuring the confidentiality, integrity, and availability of information.
Conﬁdentiality-EHR is not made available or disclosed to unauthorized persons or processes
Integrity-EHR has not been altered or destroyed in an
unauthorized manner
Availability-EHR is accessible and usable upon demand by an authorized person

Table of Contents for the Digital Edition of APMA News - May/June 2017