HIPAA Security Risk Analysis

HIPAA SRA Service Description:

Blue Goat Cyber’s HIPAA Security Risk Analysis includes the following activities:

• A Kickoff Meeting with your team (e.g., Security, Privacy, Compliance official, IT, HR, Legal, and Facilities) who will be involved with the engagement. The purpose of the meeting is to explain the SRA process, expectations, roles, and timeline. 
• Review your existing policies and procedures documentation correlating to the 49 HIPAA Security Rule regulations.
• Guide your team in identifying and documenting where HIPAA-covered ePHI data exists (e.g., on servers, workstations, portable devices, medical devices, or with Business Associates, etc.) and the security controls to protect the data. 
• Conduct a Checkpoint Meeting with your team to offer initial feedback regarding the provided policies and procedures documentation and review the documented ePHI inventory. 
• Conduct a Compliance Review Meeting with your team to assess the existing controls in place for each of the Security Rule regulations, determine whether evidence is being maintained to support your organization’s compliance with the regulations, assess the organization’s preparedness for various natural, man-made and malicious threats, and note the findings (e.g., compliance risks) and recommendations (e.g., corrective actions) to be included in the Security Risk Analysis Report. 
• Document the preliminary risk findings and recommendations based on the Compliance Review Meeting discussions and provide this draft information to your team for review. 
• Provide your team an opportunity to send feedback and proposed language changes to the preliminary risk findings and recommendations.
• Deliver a final Security Risk Analysis Report (i.e., one report) which contains the following sections:
  
  • Overview
  • Executive Summary
  • Assessment Methodology
  • Qualitative Analysis
  • Findings
    • ePHI Inventory
    • Criticality of ePHI Applications
    • Threat Matrix
    • Risk Matrix
    • Site Review
    • Best Security Practices
  • Next Steps
  • Final Thoughts
  • Appendix A – Security Rule Compliance Matrix
  • Appendix B – ePHI Inventory Table
  • Appendix C – Criticality of ePHI Applications Table
  • Appendix D – Threat Matrix Table
  • Appendix E – Policies & Procedures Documentation Compliance Table, if applicable
  • Appendix F – Facility Walk-Through Checklist, if applicable
  • Appendix G – Disclaimer
• Deliver a Risk Management Plan that includes the risk findings and recommendations documented in the SRA Report.
• If requested, deliver a presentation of the significant SRA Report findings and recommendations to your Executive/IT management.