Eight steps to conducting a meaningful use risk analysis

Identify the scope of the analysis.

Create a statement identifying the scope of the analysis at your medical practice, said Coleman. That scope should include all the potential risks and vulnerabilities to the confidentiality, availability, and integrity of ePHI that your organization uses, stores, and transmits. If your practice is using mobile devices, be sure to include them. Total failure to account for mobile devices is a common problem cited by OCR, said Pritts.

Gather the data.

Identify where ePHI is stored, received, maintained, or transmitted at your practice. To accomplish this step, Coleman suggests using information pulled from past or existing projects, and interviewing staff and physicians to determine how they use information.

Identify and document potential threats.

Document potential threats to ePHI, including:

• Threats involving people with network access (such as hackers)

• Threats involving people with physical access (such as loss and theft)

• Environmental threats (such as natural disasters)

• System threats (such as spontaneous hardware failure or software defects).

Assess current security measures.

Determine whether your current security measures to protect ePHI are adequate, said Coleman. Consider:

• Administrative security measures (such as policies)

• Technical measures (such as encryption and automatic log off of computers)

• Physical measures (such as physical access to computers and theft prevention systems).

Determine the likelihood of occurrence.

Assess the probability that a threat will trigger or exploit a particular vulnerability, said Coleman. For instance, if your practice is located in an area prone to power outages, that threat should rate high on your risk probability. "Looking at what’s happened in the past is a good indicator" of vulnerability, he said.

To capture this information (and provide documentation of your risk analysis, if necessary), Coleman recommends creating a table listing threats to ePHI, a scenario in which that threat could occur, the possible outcome of that threat, your existing controls to mitigate those risks, and the likelihood that the threat will occur.

Determine the potential impact.

Determine what potential impact a threat could have on your practice and your patients, said Coleman. Add that information to the table you created in Step 5.

For instance, if one of the threats you have identified is: "Hacker gains access to the network and posts ePHI on a website," the impact you identify might be: "Confidentiality of multiple patient records is jeopardized compromising the practice’s reputation, customer confidence, and leading to financial and legal ramifications."

Determine the level of risk.

Weigh the likelihood of a threat occurring versus the potential impact of that threat. For instance, if the likelihood that a hacker will gain access to your network is low, but the potential impact on your practice and patients is high, you might rank that level of risk as "medium," said Coleman. Again, document this information.

Identify security measures and finalize documentation.

Prioritize each risk area according to its overall ranking. Then, identify the actions required to mitigate the risk, said Coleman.

"Document, document, document," he said. "If you have all of this stuff in a binder, not only will you be able to demonstrate your due diligence, but in a year or so when you redo your risk assessment, it will make that repeat assessment much easier to do."