HIPAA Security Risk Assessment (SRA)

Requirement: The Security Management Process standard in the Security Rule requires organizations to “Implement policies and procedures to prevent, detect, contain, and correct security violations.” (45 C.F.R. § 164.308(a)(1).) Risk analysis is one of four required implementation specifications that provide instructions to implement the Security Management Process standard. Section 164.308(a)(1)(ii)(A) states:

RISK ANALYSIS (Required)

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by the [organization].

Why a Security Risk Assessment? To work towards compliance and mitigate any risks that your organization may face, the first step is to assess your current state of security and identify any security gaps that may be present. This is done through a Security Risk Assessment (SRA), which is required by HIPAA. It's important to note that the SRA process doesn't end after your initial SRA. Compliance is ongoing, meaning it's something you're continuously working towards, and your SRA is a key component of your journey.

Our Annual HIPAA SRA: Our comprehensive Annual HIPAA Security Risk Assessment is contained in a self-paced online format within your compliance portal. Your organization will be asked to provide the details of your assets (computers, servers, testing equipment, portable media, etc.) and to answer an online questionnaire regarding your current security state. When complete, a final report will be generated detailing the potential risks to your organization and recommendations to help lower each risk.

HIPAA Policies & Procedures

Requirement: One of the first standards of the HIPAA Security Rule requires organizations to “implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements in this subpart (the HIPAA Security Rule)…”(164.316(a)). These policies and procedures should be documented, updated when necessary and made available to all appropriate personnel that may be responsible for implementing the procedure described.

Why Policies & Procedures? These policies and procedures are the backbone of how your organization operates and demonstrates the efforts that you take in protecting PHI. These documents will provide a clear definition of how important activities and procedures are conducted across the administrative, physical and technical safeguards within your organization.

Our Policies & Procedures : We provide a suite of 18 HIPAA Security Policies and one full HIPAA Privacy Policy. These documents will cover all of the required and addressable HIPAA standards with detailed procedural guidelines. Each policy has been meticulously crafted to cover each measure throughout the HIPAA rules however, each will be provided in Word document format, allowing for customization as needed to reflect the specifics of your organization more accurately. 

These policies and procedures are stored safely in your compliance portal. Additionally, you can require employees to read and acknowledge these policies and procedures through an online digital acknowledgment. This acknowledgment can be tracked by management and reset when updates to your policies and procedures have been made.

In addition to a full set of HIPAA Security and Privacy Policies, organizations will have access to our full suite of additional template files to aid in additional compliance efforts. These template files will go deeper into certain topics and generally will require additional modifications.

Some available templates include: