HIPAA Risk Assessment – When Did You Last Do One, or Have You Ever?

What Is a HIPAA Risk Assessment? 

HIPAA is the acronym for the Health Insurance Portability and Accountability Act, a law that aims to provide privacy protections to patient health information. The law requires all healthcare providers to handle patient data securely and confidentially. A HIPAA risk assessment is the structured process that examines how well an organization is doing to maintain the security and confidentiality of the protected health information (PHI) it is holding.

Why Risk Assessments Are Critical for Healthcare Facilities

Contrary to popular belief, HIPAA risk assessments are mandatory for all healthcare facilities and for the businesses they share their PHI with; like billing companies, IT vendors, and transcription services. All hospitals and clinics, large and small, must continually work to achieve and maintain HIPAA compliance. Every healthcare facility must conduct a HIPAA risk assessment because it enables them to identify areas where PHI is stored and how they can address potential security gaps. Not undertaking a risk assessment can contribute to data breaches, fines, and worse.


What a HIPAA Risk Assessment Entails? 

A HIPAA risk assessment helps you identify potential vulnerabilities with your computer systems, workflow processes, staffing, and vendor relationships. It assesses the physical, administrative, and technical procedures you have in place to guard your PHI. A thorough risk assessment identifies threats, both internal and external, and helps businesses to take action to protect PHI. An extension of the risk assessment involves making sure your staff and vendors understand their role in protecting patient data.


How Often Should a HIPAA Risk Assessment Be Done? 

The risk analysis process should be ongoing. While the law gives some latitude for how often HIPAA risk assessments should be undertaken, businesses with an eye on mitigating risk will perform this annually and when they move, open a new location, or adopt a new EHR. In some cases, it may be appropriate to conduct a risk assessment more infrequently, perhaps once every two or three years. No matter when you perform a risk assessment, hiring a third party to guide you in the process can be beneficial.


Working With HIPAA Compliant Suppliers

If you depend on vendors for healthcare services or technology, make sure they are HIPAA compliant. Beyond simply asking them about HIPAA, ask them when they last conducted their HIPAA risk assessment, and request a copy of it. If their documented compliance efforts are reasonable, ask them to enter into a HIPAA Business Associate Agreement with your organization. If they can’t comply with all of these requests, it signals the vendor could be a security risk for your organization.

When it comes to security, taking shortcuts can lead to fines and other penalties. So, be sure to do your due diligence to avoid damage that could be costly to your business and reputation. Athreon has been providing HIPAA compliant speech to text, HIPAA compliant transcription, and HIPAA compliant scribing services for hospitals, clinics, and private practices for decades. We invite you to contact us to learn more about how Athreon’s physical, administrative, and technical processes can protect PHI for your business and your patients.