HIPAA IT Risk Analysis Template

What is a HIPAA IT Risk Analysis?

Understanding the purpose of a risk analysis is the first step in creating a risk analysis template, or choosing a pre-existing template that works for you. The purpose of a HIPAA risk analysis is to assess your current security practices to ensure that they meet HIPAA standards. To meet HIPAA standards, your security practices must ensure the confidentiality, integrity, and availability of patient information (protected health information).

When you perform your risk analysis, you’re auditing your business’s administrative, physical, and technical safeguards. 

Administrative Safeguards

The administrative assessment takes a look at the processes that your business has in place to ensure the security of PHI. 

• What kind of security policies does your business have in place?
• Are your employees trained on HIPAA security requirements?

Physical Safeguards

The physical assessment is an audit of your business’ physical premises to ensure that proper security safeguards are in place. 

• Are your health records kept in locked cabinets?
• Do you have an alarm system for the physical premises?

Technical Safeguards

The technical assessment audits the safeguards your business has in place that keep the electronic transmission, storage, access, or engagement with PHI secure. 

• What kind of firewall do you have in place?
• Do you use end to end encryption?

HIPAA IT Risk Analysis Template: What to Look For

According to guidance issued by the Department of Health and Human Services (HHS), the scope of security risk analysis includes potential risks and vulnerabilities to the confidentiality, availability, and integrity of all ePHI that an organization:

• Creates
• Receives
• Maintains
• Transmits

There are steps you need to do to make sure your risk analysis is accurate and thorough. 

1. Collect Data
2. Identify and Document Potential Threats and Vulnerabilities
3. Assess Current Security Measures
4. Determine the Likelihood of Threat Occurrence
5. Determine the Potential Impact of Threat Occurrence
6. Determine the Level of Risk

Compliancy Group Can Help with Your Risk Analysis

Using a HIPAA IT risk analysis template is a good first step, but it’s not necessarily the most efficient or effective. Compliancy Group can help you meet your risk analysis requirement with confidence that you have done it the right way. While not a template, our software platform makes it easy to go through the steps you need for an accurate and thorough analysis. 

What’s even better is that you don’t have to do it alone. Our team of Compliance Coaches guide you through our simple analysis questionnaire, showing you how to answer the questions accurately. Find out how we can help you complete your risk analysis today!