Doing and maintaining the HIPAA risk analysis OCR asks for first: the free HHS tool, the risk management plan, mapping where ePHI lives, how often to update, and what OCR's enforcement record shows about risk analysis failures.
What the free HHS SRA Tool does and does not do: who it is for, the current version and formats, how it handles your data, its disclaimer, and when a practice needs more than the tool to meet the risk analysis requirement.
Turning risk analysis findings into a risk management plan: the required specification, the factors for choosing measures, enterprise-wide risk reduction, OCR guidance and penalties where risk management failed, and the proposed written plan.
Building the ePHI inventory and data-flow map that a risk analysis depends on: what OCR's guidance says must be documented, OCR's recommendations after recent cases, hardware and media accountability, and the proposed asset inventory and network map.
Why HIPAA has no fixed risk analysis interval and what triggers an update: ongoing review duties, evaluation after environmental or operational change, documentation updates, six-year retention, and the proposed annual review.
Why a missing or incomplete risk analysis is the most common finding in OCR settlements: the Risk Analysis Initiative and recent cases against hospitals, practices, health plans and business associates with their resolution amounts.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.