The Ins and Outs of Risk Management

Risk Assessment and Risk Management

A Risk Assessment¹ is a first step in protecting your organization, but it feeds into something as important – Risk Management. What is Risk Management? It’s the process of identifying, evaluating, and then mitigating the risks in your organization. Your Risk Management Plan feeds off of the results of your Risk Assessment.

Your Risk Assessment evaluates different criteria depending on the industry you are reviewing. Take the case of a bank, you’re not as concerned about Protected Health Information (PHI), but rather about loans and other financial products. Your Risk Assessment might include whether an applicant has the ability to repay the loan in a timely fashion. If you’re an employer group, an insurance agency, or a healthcare provider, your Risk Assessment is centered around PHI. You’re concerned with the possibility of health information being released to unqualified parties who can use the information for their personal gain.

First, the Risk Assessment

Creating your Risk Assessment is the first step of the Risk Management process; it lays the foundation for a detailed understanding of the risks to the confidentiality, integrity, and availability of ePHI and collects the information needed to establish the administrative, physical, and technical safeguards HIPAA requires be included in the Privacy and Security Policies and Procedures.

Yes, it’s a requirement, but it also works in your favor. The Risk Assessment provides the framework needed to complete your HIPAA compliance documents and it also identifies information for the key staff members and management to make risk prioritization and mitigation decisions.

How often you should perform a Risk Assessment depends on the size and complexity of the organization. Larger companies may need to administer one each year. You’ll also want to complete one when major changes occur to your organization.

Complete a Risk Assessment when you:

• experience a security incident
• have a change in ownership
• turn over key management
• plan to incorporate new technology

Check out our blog, “HIPAA Risk Assessment – Is this required?” and also our Risk Assessments Webinar for helpful information regarding Risk Assessments.

Developing The Risk Management Plan

You’ve completed a Risk Assessment – and now you’re ready to create the documents that will protect the information. Health and Human Services (HHS) provides questions your organization should consider for a Risk Management Plan:²

• What security measures are already in place to protect PHI and ePHI? Is executive leadership and/or management involved in Risk Management and mitigation decisions? Figure out the key players and roles that will help safeguard the PHI.
• Are security processes being communicated throughout the organization? See who in your organization knows about the security measures implemented and how you’ll get the information distributed amongst the staff.
• Does the covered entity need to engage other resources to assist in Risk Management? You may decide that there are more practical solutions for your organization by delegating certain security measures to a third-party vendor (cloud file storage).

Although there are many different ways to address Risk Management, the following steps serve as a guideline to completing the Risk Management process:

1. Identify the hazards
2. Decide who could be harmed
3. Establish control measures
4. Record the findings of your assessment and inform those at risk of the controls
5. Review the Risk Assessment on a regular basis

Implementing a Risk Management Plan

After you’ve documented your plan, it’s time to take action. Consider assigning an owner to each action item to avoid any item falling through the cracks.

For each major risk, you should take one of the following actions:

• Avoid the risk – eliminate or protect from a threat. Such as moving a fax machine to a locked and secure location for only staff members with authorization.
• Mitigate the risk – identify ways to reduce the probability of the risk. As an example, creating access levels in your organization.
• Contingency – define actions to be taken in response to risks. Especially, defining HHS’ requirement to report if there is a breach violation.
• Transfer the risk – shift the consequence of a risk to have a third party. For instance, using a cloud service provider and move data from local servers to the cloud or transitioning into shredding yourself to hiring a shredding vendor.

Ongoing Risk Management

Once your Risk Management Plan is documented, consider it to be a living document that you reference and change regularly. Use the following steps to monitor any risks and change the document and rules as necessary:

Step 1: Have the designated workforce members monitor and identify any new risks.

Step 2: Review previously documented risks (through the Risk Assessment) and determine if any risks have changed in nature.

• For example, a desktop computer maintaining ePHI that had not been backed up routinely is now no longer used and the data has been saved to a local server or by cloud storage in accordance with your record retention policies. The risk then no longer exists. Document the reason the risk no longer exists noting the date the risk was eliminated.

Step 3: Review each existing risk and update the status of all incomplete mitigation actions. Note the date of the review and any change in the expected implementation date.

Step 4: Review results with your designated Security Officer.

Summary

Risk Assessment and Risk Management are the foundations of your organization HIPAA Security Rule compliance efforts. Risk Assessment and Risk Management are ongoing processes that will provide you, as a covered entity, business associate or business associate subcontractor, a detailed understanding of the risks to ePHI and the security measures needed to effectively manage those risks. Performing these processes appropriately will ensure the confidentiality, availability, and integrity of ePHI, protect against any reasonably anticipated threats or hazards to the security or integrity of ePHI, and protect against any reasonably anticipated uses or disclosures of ePHI that are not permitted or required under the HIPAA Privacy Rule.²

1. Total HIPAA labels a Risk Assessment as collecting the initial information and Risk Analysis the process of evaluating a potential breach.

2. https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/adminsafeguards.pdf

Sharing is caring!