Arrange a free, no-obligation 30-minute consultation with Blue Team Alpha for your organization. (This expert session is normally valued at $250.)

Cyberattacks on healthcare organizations can do far more than expose data. They can disrupt patient care, take essential systems offline, interrupt revenue, and leave organizations facing costly recovery work, regulatory scrutiny, and lasting reputational damage.

That is why The HIPAA Journal conducted an extensive search for a cybersecurity partner capable of helping organizations of all sizes to protect the electronic protected health information (ePHI) entrusted to them. We chose Blue Team Alpha and arranged to provide HIPAA Journal readers with a free cybersecurity consultation.

How to use your session which will be tailored to your organization’s needs.

You can use the time to obtain specific advice about a cybersecurity concern, discuss a known or suspected weakness, review an area of your security program, or identify the most important next steps for reducing risk. It’s up to you how you use the session.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The consultation can also serve as the starting point for your organization’s annual HIPAA Security Risk Assessment.

In 30 minutes, a Blue Team Alpha specialist can help clarify the scope of the assessment, identify the people and information that will be needed, discuss likely areas of exposure, and help you determine what to prioritize. The consultation is not, by itself, a complete HIPAA Security Risk Assessment, but it can help you begin the process with clearer direction and expert support.

Whether you have an immediate question or want to take a more proactive look at your organization’s security posture, this is an opportunity to speak directly with an experienced cybersecurity professional and receive practical guidance tailored to your organization.

Learn More About This Offer

Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha

Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.

Learn More About This Offer

Who is Blue Team Alpha?

Blue Team Alpha is a veteran-owned cybersecurity firm that helps protect America’s critical infrastructure through cybersecurity leadership. More than 65% of its experts have backgrounds with the U.S. Department of Defense, Department of Homeland Security, and other government organizations, bringing extensive hands-on experience.

To protect health information organizations must understand where their real vulnerabilities are, take practical steps to reduce risk, detect threats quickly, and be ready to contain and recover from an incident when defenses are breached.

Blue Team Alpha’s experts have extensive first-hand experience responding to serious cyber incidents, combined with a strong understanding of regulated industries, and the ability to support organizations before, during, and after an attack.

Why The HIPAA Journal Chose Blue Team Alpha

The HIPAA Journal’s goal was to find a partner that could offer healthcare organizations credible, practical support across the full cybersecurity lifecycle. Blue Team Alpha stood out for several reasons:

Proven incident-response capabilities: Its specialists are available around the clock to investigate attacks, contain threats, support recovery, and help organizations restore business-critical operations.

A highly experienced team: Blue Team Alpha combines military, government, and private-sector cybersecurity experience with a wide range of professional security certifications.

Support before, during, and after an incident: The firm can identify weaknesses, strengthen defenses, respond to active attacks, and help organizations improve their security following an incident.

Experience in healthcare and other critical sectors: Its team understands that downtime and data loss in healthcare can affect both business operations and patient care.

A practical approach to risk: Assessments are designed to identify and prioritize risk and provide an actionable path for improvement, rather than simply generating another report that sits unused.

Cybersecurity Services Available to Healthcare Organizations

Through our partnership, HIPAA Journal readers can access Blue Team Alpha’s broad range of cybersecurity services, including:

Emergency Incident Response and Recovery
Blue Team Alpha provides 24/7 support for organizations experiencing ransomware, malware, data breaches, business email compromise, insider threats, and other security incidents. Services include rapid breach assessment, containment, threat eradication, digital forensics, system restoration, and assistance with re-establishing business continuity.

Digital Forensics and Incident Investigation
Digital forensics and incident response services help determine what happened, how attackers gained access, which systems and data may have been affected, and whether the threat has been fully removed.

Penetration Testing
Penetration testing goes beyond an automated vulnerability scan by emulating the techniques a real attacker may use to gain access to systems and data. Blue Team Alpha combines testing technology with manual analysis by experienced specialists to uncover weaknesses and provide prioritized recommendations for remediation.

Vulnerability Assessments and Vulnerability Management
Blue Team Alpha can identify technical vulnerabilities, prioritize them according to risk, track security improvements over time, and assist with remediation. This gives healthcare organizations a clearer understanding of which weaknesses require the most urgent attention.

Ransomware Readiness Assessments and Tabletop Exercises
Ransomware readiness assessments help organizations identify gaps in their ability to prevent, respond to, and recover from an attack. Tabletop exercises allow leadership, IT, security, compliance, legal, and communications teams to test their response plans in a controlled environment before they face a real emergency.

Managed Security Operations Center (SOC)
Blue Team Alpha’s managed SOC services  include security monitoring, managed detection and response, ransomware protection, security information and event management (SIEM), log ingestion, and managed security awareness and phishing training.

Virtual CISO Services
Organizations that do not need or cannot justify a full-time Chief Information Security Officer can access strategic cybersecurity leadership through Blue Team Alpha’s virtual CISO service. This can include risk assessment, security planning, policy development, incident-response planning, oversight, and support for regulatory and contractual requirements.

Cybersecurity Risk Assessments and Compliance Assistance
Blue Team Alpha conducts risk assessments to help organizations identify threats, vulnerabilities, control weaknesses, and compliance gaps. The resulting recommendations can help leadership prioritize investments and develop a practical risk-treatment plan. The company also provides compliance assistance for frameworks and standards that include HIPAA, HITRUST, and the NIST Cybersecurity Framework.

Incident Response Retainers and Cyber Insurance Preparation
Incident response retainers give organizations access to a team that is prepared to act when an incident occurs, reducing delays at a time when every hour matters. Blue Team Alpha can also help organizations review their preparedness for cyber insurance applications and requirements.

Learn More About This Offer

Avail of a Free 30-Minute
Cybersecurity Consultation
with Blue Team Alpha

Review your security program, get advice on a specific cybersecurity concern, identify risk-reduction priorities, or take the first step toward your annual HIPAA Security Risk Assessment.

Learn More About This Offer

The post Free 30-Minute Review of Your Cybersecurity Priorities appeared first on The HIPAA Journal.

Website tracking privacy risks can remain hidden across a health system’s digital estate until a patient, regulator, or plaintiff discovers them. By then it may be too late.

A pixel installed for one advertising campaign, a script introduced through a plugin, or an analytics tool added by an outside agency can continue operating long after anyone remembers approving it, creating a website tracking privacy risk.

Privacy and compliance teams may not know every tool that is operating, what information it collects, or where that information is sent. For a health system managing multiple hospitals, locations, subdomains, service-line websites, and campaign pages, one forgotten or incorrectly configured script can affect hundreds or thousands of webpages.

Request a complimentary web scan* to understand what’s running on your website, and whether it matches what you promised.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Health system websites are constantly being updated

A large healthcare organization may operate a main corporate website alongside hospital websites, provider directories, service-line pages, campaign landing pages, patient portal login pages, recruitment sites, blogs, mobile applications, and websites inherited through acquisitions. Different marketing teams, agencies, developers, and technology vendors may all be able to introduce new code.

The result is a constantly changing web environment in which compliance, privacy, and information security teams may not have a complete picture of every third-party technology operating across the organization.

Website tracking is widespread in healthcare

Research suggests that third-party data transfers are present on the overwhelming majority of hospital websites.

A 2024 study of a nationally representative sample of 100 nonfederal acute care hospitals found that 96% of their websites transferred user information to at least one third party. The websites communicated with a median of nine third-party domains, and 86% had at least one third-party cookie.

Only 71 of the 100 hospital websites had a publicly accessible website privacy policy. Among those 71 policies, just 40 specifically identified third-party companies or services receiving user information.

The findings highlight an important distinction. Having a privacy policy does not necessarily mean that the organization knows everything its website is doing or that the policy accurately describes current activity.

A privacy policy may have been correct when it was written but subsequently become outdated as new technologies, vendors, campaigns, and websites were introduced.

Why larger healthcare organizations face greater challenges

Health systems and multi-location healthcare groups can have hundreds of people involved in their digital operations. Marketing may select an analytics platform, an agency may deploy advertising pixels, a service line may introduce a new scheduling application, and a recently acquired practice may continue using its existing website technology.

Each decision may appear reasonable in isolation. Collectively, however, they can create a complex and poorly documented network of data connections.

Common problems include:

• No central inventory of websites, subdomains, microsites, and landing pages
• Different privacy and consent practices across affiliated organizations
• Inconsistent use of tag management systems
• Technologies added without privacy, security, or legal review
• Inherited tracking code following mergers and acquisitions
• Expired campaigns with active tags
• Privacy policies that do not reflect actual website behavior
• Vendors introducing additional subprocesses or technologies
• Unclear responsibility for approving and monitoring website tools

A review of the main health system homepage will not necessarily reveal what is happening on a specialty clinic website, an appointment page, a recruitment portal, or a location-specific landing page.

When does website tracking become a HIPAA issue?

The HIPAA Rules apply when information collected through tracking technologies or disclosed to tracking technology vendors includes PHI.

Pages that deserve particularly careful examination include:

• Authenticated patient portals
• Patient portal login and registration pages
• Online appointment scheduling pages
• Symptom checkers
• Provider search tools
• Pages that collect an email address or other identifying information
• Forms through which an individual describes a condition or reason for seeking care
• Pages containing treatment, prescription, billing, or medical record information

The Department of Health and Human Services’ Office for Civil Rights states that a privacy policy, website notice, or terms of use document does not, by itself, make a disclosure of PHI permissible. OCR also states that an ordinary cookie consent banner is not a HIPAA-compliant authorization.

If a tracking vendor creates, receives, maintains, or transmits PHI on behalf of a regulated entity for a covered function, the vendor may be a business associate. The organization must determine whether the disclosure is permitted and whether an appropriate Business Associate Agreement is required.

Simply asking a vendor to remove or de-identify information after receiving it does not necessarily resolve the problem. If PHI has already been disclosed to the vendor, the disclosure itself must have a lawful basis.

The solution for website tracking privacy risks

Automated website privacy monitoring tools can help close the visibility gap. Tools can scan public-facing pages for third-party scripts and cookies, identify external technologies operating across websites and subdomains, and flag activity that may require further investigation.

They can also compare observed website behavior with statements in the organization’s privacy policy and monitor for changes over time.

These tools do not replace legal analysis or determine whether a disclosure violates HIPAA, but they can help privacy, compliance, marketing, and technology teams find potential risks sooner, prioritize their response, and demonstrate ongoing oversight.

Get a free web scan by filling in the form on this page and receive a report the details any hidden compliance risks on your website with a high, medium or low score for each.

Get a complimentary scan that identifies third-party scripts by risk level: high, medium, or low.

Not every visit to a healthcare webpage involves PHI

The legal position is more nuanced than some early reporting on tracking technologies suggested.

In June 2024, a federal court vacated part of OCR’s tracking technology guidance in *American Hospital Association v. Becerra*. The court rejected the position that an IP address combined with a visit to a public, unauthenticated webpage about a particular condition or healthcare provider was sufficient, by itself, to trigger HIPAA obligations.

OCR’s current guidance acknowledges that a visit to a public healthcare webpage does not automatically constitute a disclosure of individually identifiable health information simply because a tracking technology connects the visit with an IP address.

For example, someone may visit an oncology page because they are conducting academic research, helping a relative, reading the news, or looking for employment. The webpage visit alone does not establish that the visitor has cancer or is seeking cancer treatment.

However, the court decision did not create a general exemption for healthcare websites. HIPAA may still apply when identifiable information is connected with an individual’s health, care, or payment for care. Information entered into an appointment form, registration page, symptom checker, or authenticated portal presents a substantially different risk from an anonymous visit to a general information page.

Regulatory and litigation risks extend beyond HIPAA

In July 2023, OCR and the Federal Trade Commission sent joint warning letters to approximately 130 hospital systems and telehealth providers. The letters drew attention to technologies such as Meta Pixel and Google Analytics and warned that they could disclose sensitive health information to third parties.

The FTC can take action when an organization makes misleading privacy promises or uses and discloses consumer health information in ways that are unfair or deceptive. State consumer protection, privacy, and wiretapping laws may also apply.

This means an organization should not conclude that a tracking activity is low risk merely because the information does not meet the HIPAA definition of PHI.

The enforcement record illustrates the wider exposure:

– The New York Attorney General reached a $300,000 settlement with NewYork-Presbyterian Hospital after alleging that advertising tools collected and disclosed information when website visitors searched for doctors or booked appointments. The settlement required policy changes, deletion requests, and enhanced privacy safeguards.
– The FTC alleged that GoodRx disclosed health information to Facebook, Google, and other companies contrary to its privacy promises. GoodRx agreed to a $1.5 million civil penalty and restrictions on sharing health information for advertising.
– BetterHelp agreed to pay $7.8 million to resolve FTC allegations involving the disclosure of email addresses, IP addresses, and health questionnaire information for advertising purposes.

Private litigation has created additional risk. Plaintiffs have pursued claims under federal and state wiretapping, privacy, consumer protection, and contract laws. Not every claim has succeeded, and the outcomes frequently depend on the information involved, the wording of the relevant statute, the consent process, and how the technology operated.

The absence of a successful HIPAA enforcement action does not therefore mean that an organization has no exposure.

A cookie banner is not a complete solution

Consent management is important, particularly under state privacy laws, but a banner cannot compensate for a lack of technical visibility.

An organization needs to establish:

– Which technologies operate before a visitor makes a choice
– Whether rejected technologies are actually prevented from loading
– Whether the consent mechanism covers every relevant website and subdomain
– Whether a visitor’s preferences are passed to connected systems
– Whether the policy accurately identifies the information collected and its recipients
– Whether HIPAA authorization or another legal permission is required

A banner may tell visitors that cookies are used, but it does not answer whether a particular script is receiving an appointment event, a patient identifier, or information entered into a form.

A one-time website audit provides only a snapshot

Large healthcare websites change continually. New pages are published, campaigns launch, vendors update code, plugins change, and acquired organizations introduce additional domains.

A review conducted today may not reflect the organization’s website next month.

Effective oversight therefore requires both an initial inventory and continuing monitoring. The organization should be able to identify:

– New scripts and external domains
– Changes to cookies and tracking behavior
– New pages handling potentially sensitive information
– Differences between locations, brands, or subdomains
– Technologies that reappear after they were removed
– Changes that create conflicts with the privacy policy
– Unapproved additions made through a tag manager or plugin

Historical records can also help an organization determine when a technology first appeared, which pages were affected, and whether remedial or breach assessment work may be necessary.

Establishing effective website privacy governance

A health system should treat its public website environment as part of its wider privacy and security program.

A practical governance process should include:

1. **Identify the complete web estate.** Document websites, subdomains, microsites, mobile applications, landing pages, portals, and inherited digital properties.

2. **Inventory third-party technologies.** Identify scripts, cookies, pixels, plugins, embedded content, and the external domains with which each property communicates.

3. **Prioritize higher-risk pages.** Focus on scheduling, registration, provider search, symptom, portal, payment, and form pages.

4. **Document purpose and ownership.** Every technology should have a defined business purpose and an internal owner.

5. **Assess the information involved.** Determine what data is collected, when it is transmitted, and whether it may include PHI or other sensitive information.

6. **Review vendors and agreements.** Establish whether the recipient is a business associate, whether a BAA is required, and whether the proposed use is permitted.

7. **Compare behavior with published promises.** Website activity, consent choices, privacy policies, and notices should be consistent.

8. **Control future changes.** New tracking technologies should require appropriate marketing, privacy, security, and legal approval before deployment.

9. **Monitor continuously.** Repeat scans and investigate material changes instead of relying solely on periodic manual audits.

10. **Document decisions and remediation.** Maintain evidence of findings, approvals, risk assessments, corrective actions, and ongoing oversight.

## Visibility is the foundation of control

Healthcare organizations do not have to abandon digital analytics, advertising, or website personalization. These technologies can help patients find services and allow organizations to understand whether their communications are effective.

The essential requirement is visibility.

A health system cannot assess a technology it does not know is present, enforce a policy it cannot test, or control a disclosure it cannot see. Understanding what operates across the organization’s websites, where information is sent, and whether those activities match the organization’s obligations is the first step toward using digital marketing technology responsibly.

Patient Journey Risk

Healthcare websites have become an important part of the patient journey. Visitors use them to research symptoms, compare services, find doctors, schedule appointments, complete forms, access patient portals, watch educational videos, use chat tools, and locate nearby facilities.

These functions often depend on third-party technologies, including:

• Analytics platforms
• Advertising and conversion pixels
• Tag management systems
• Appointment scheduling applications
• Embedded forms
• Chat and chatbot services
• Session replay technologies
• Heatmaps
• Maps and location services
• Embedded videos
• A/B testing and personalization tools
• Social media integrations

Many of these tools provide genuine operational or marketing value. The risk arises when an organization does not fully understand what information a technology collects, when it activates, where the information is sent, or what the receiving company is permitted to do with it.

A technology added to measure conversions on one campaign page may later be deployed across an entire website. A script introduced by a plugin may communicate with additional companies that were not part of the original approval. A tool removed from the visible marketing stack may continue operating through a tag manager or legacy page template.

On a large and frequently updated web estate, these changes can be difficult to identify through manual reviews alone.

What information can website technologies collect?

The information disclosed to a third party will depend on the technology, its configuration, and the page on which it operates. It can potentially include:

– The URL and title of the page visited
– The visitor’s IP address and approximate location
– Device and browser information
– Cookie identifiers
– Advertising identifiers
– Buttons, links, or menu options selected
– Search terms
– Form field activity
– Appointment-related events
– Information used to identify or recognize returning visitors

The presence of a third-party script does not automatically mean that Protected Health Information has been disclosed or that a law has been violated. The organization must examine the information involved, the context in which it was collected, the purpose of the disclosure, the recipient, and the applicable legal authority.

However, it is impossible to perform that assessment if the organization does not know the technology is present.

*Web Scan report provided using Ours Privacy technology

The post Website Tracking Privacy Risks: Do You Know What Your Websites Are Sharing? appeared first on The HIPAA Journal.

A HIPAA security risk assessment assesses threats to the privacy and security of PHI, the likelihood of a threat occurring, and the potential impact of each threat so it is possible to determine whether existing policies, procedures, and security mechanisms are adequate to reduce risks and vulnerabilities to a reasonable and appropriate level.    

The requirements for covered entities and business associates to conduct a HIPAA security risk assessment appear twice in the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act. However, it may be necessary for organizations to conduct risk assessments beyond these requirements.

The first requirement to conduct a HIPAA security risk assessment appears in the HIPAA Security Rule (45 CFR § 164.308 – Security Management Process). This standard requires covered entities and business associates to conduct an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI”.

The second requirement appears in the HIPAA Breach Notification Rule (45 CFR § 164.402). This standard only applies when there has been an impermissible acquisition, access, use, or disclosure of unsecured PHI (in any format), and a HIPAA risk assessment is necessary to determine whether the event is notifiable to HHS and the affected individual(s).

However, beyond the HIPAA security risk assessment requirements of the HIPAA Security and Breach Notification Rules, risks exist to the confidentiality, integrity, and availability of PHI when it is not in electronic format – for example, when unauthorized disclosures are made verbally or when a printed medical report is left unattended in an area of public access.

Because of these risks, it may be necessary to conduct a HIPAA privacy risk assessment which not only takes into account risks to the confidentiality, integrity, and availability of non-electronic PHI, but which also covers individuals’ access rights (to their PHI), Business Associate Agreements, and other Organizational Requirements of HIPAA.

HIPAA Security Risk Assessment

The objective of a HIPAA security risk assessment is outlined in the General Rules (CFR 45 § 164.306) that precede the Administrative, Physical, and Technical Safeguards of the HIPAA Security Rule. These are to:

• Ensure the confidentiality, integrity, and availability of all electronic PHI the covered entity or business associate creates, receives, maintains, or transmits.
• Protect against any reasonably anticipated threats or hazards to the security or integrity of such information.
• Protect against any reasonably anticipated uses or disclosures of such information that are not permitted or required under subpart E of this part (the HIPAA Privacy Rule).
• Ensure compliance with this subpart (the HIPAA Security Rule) by its workforce. Note: This is achieved via security awareness training and the enforcement of a sanctions policy.

With regards to the Administrative, Physical, and Technical Safeguards of the HIPAA Security Rule, the General Rules allow a “flexibility of approach” in how the standards are implemented. Despite the flexibility of approach clause, it is important that all standards are implemented unless an implementation specification is not “reasonable and appropriate” and an equivalent alternate measure is implemented in its place. The full list of Administrative, Physical, and Technical implementation specifications is:

The final section of the HIPAA Security Rule covers Business Associate Agreements and other Organizational Requirements. This section requires covered entities to ensure their Business Associate Agreements require business associate to comply with the HIPAA Security Rule and report any security incidents (not just data breaches) to the covered entity. With regards to the Organization Requirements, the standard in 45 CFR § 164.314 applies to group health plans; but all covered entities in hybrid, affiliated, or OHCA arrangements should review the content of this standard as well.

HIPAA Breach Risk Assessment

The second “required” HIPAA security risk assessment is actually optional inasmuch as the HIPAA Breach Notification Rule states any that impermissible acquisition, access, use, or disclosure of PHI is presumed to be a breach unless a low probability of compromise can be demonstrated via a risk assessment that takes at least the following factors into account:

• The nature and extent of breached PHI including the types of identifiers and the likelihood of reidentification,
• The unauthorized person (if known) who acquired, accessed, or used the breached PHI or to whom an impermissible disclosure was made,
• Whether PHI was actually acquired or viewed (read HHS’ guidance on ransomware to establish what constitutes “acquired or viewed” in cyberattacks),
• The extent to which the risk to PHI has been mitigated.

The reason for the HIPAA breach risk assessment being described as optional is that covered entities and business associates could – if they wish – skip this HIPAA assessment and notify every impermissible acquisition, access, use, or disclosure of PHI. The drawback to this approach is that it may result in business disruption if HHS’ Office for Civil Rights feels your organization is experiencing an above-average number of data breaches and decides to conduct a compliance review.

It can also cause a loss of trust from individuals served by the organization if patients and plan members are receiving frequent breach notifications – especially if they are advised to take measures to protect themselves against fraud, theft, and loss unnecessarily because “breached” PHI has not actually been acquired or viewed. Although “optional”, it can be a good idea to conduct a HIPAA breach risk assessment to prevent unavoidable notifications.

HIPAA Privacy Risk Assessment

Due to the requirement to conduct risk assessments being in the HIPAA Security Rule, many covered entities and business associates overlook the necessity to conduct a HIPAA privacy risk assessment. A HIPAA privacy risk assessment is equally as important as a security risk assessment but can be a much larger undertaking depending on the size of the organization and the nature of its business.

In order to complete a HIPAA privacy risk assessment, an organization should appoint a Privacy Officer, whose first task it is to identify organizational workflows and get a “big picture” view of how the requirements of HIPAA Privacy Rule impact the organization´s operations. Thereafter the Privacy Officer needs to map the flow of PHI both internally and externally in order to conduct a gap analysis to identify where breaches may occur.

The final stage of a HIPAA privacy risk assessment should be the development and implementation of a HIPAA privacy compliance program. The program should include policies to address the risks to PHI identified in the HIPAA privacy assessment and should be reviewed as new work practices are implemented or new technology is deployed.

As required by 45 CFR § 164.530, it is essential employees are trained on any policies and procedures developed as a result of a HIPAA privacy risk assessment and when material changes to policies and procedures impact employees’ functions. Although covered entities and business associates may comply with this requirement “to tick the box”, better trained staff make fewer HIPAA errors, so training on HIPAA policies and procedures should be embraced as a risk mitigation strategy.

Not Identifying Risks Can be Costly

The severity of fines for non-compliance with HIPAA has historically depended on the number of patients affected by a breach of PHI and the level of negligence involved. Few fines are now issued in the lowest “Did Not Know” HIPAA violation category, because there is little excuse for not knowing a legal requirement exists to protect PHI.

More recently, the majority of fines have been under the “Willful Neglect” HIPAA violation category, where organizations knew – or should have known – they had a responsibility to safeguard PHI. Many of the largest fines – including the $5.5 million fine issued against the Advocate Health Care Network – are attributable to organizations failing to identify where risks to the integrity of PHI exist.

However, since the start of the second round of HIPAA audits, fines have also been issued for potential breaches of PHI. These are where flaws in an organization´s security have not been uncovered by a HIPAA risk assessment, or where no assessment has been conducted at all. In March 2016, North Memorial Health Care of Minnesota paid more than $1.5 million to settle related HIPAA violation charges.

It’s Not Just Large Organizations in the Firing Line

Although the majority of headlines relating to HIPAA violations concern large medical organizations and large fines for non-compliance, there are very many small medical practices also investigated by the Office for Civil Rights (OCR) or subject to HIPAA audits. Since 2003, OCR has received more than 300,000 reports of alleged HIPAA violations. Less than 2% of these relate to data breaches involving 500 individuals or more.

A significant problem for small and medium sized medical practices is that not all insurance carriers cover the cost of a HIPAA breach. The cost of a HIPAA breach not only includes the fine, but also the cost of hiring IT specialists to investigate the breach, the cost of repairing public confidence, and the cost of providing credit monitoring services for individuals. Insurers may also limit their coverage according to the nature of the HIPAA violation and the level of negligence.

Without insurance coverage, the cost of a HIPAA breach could potentially close a small medical practice. However, this scenario can be mitigated by conducting a HIPAA risk assessment and implementing measures to resolve any uncovered issues. An assessment can be complicated and time-consuming, but the alternative is potentially terminal to small medical practices and their business associates.

Business Associates Must Be Included

Every covered entity that creates, receives, maintains, or transmits PHI has to conduct an accurate and thorough HIPAA risk assessment in order to comply with the Security Management requirements of the HIPAA Security Rule. This condition of HIPAA compliance not only applies to medical facilities and health plans. Business associates, subcontractors, and vendors must also conduct a HIPAA security risk assessment. Similar to covered entities, fines for non-compliance can be issued by OCR against business associates for potential breaches of PHI.

OCR treats these risks seriously. In December 2014, the agency revealed that 40% of all HIPAA breaches involving an exposure of more than 500 patient records are attributable to the negligence of business associates. In June 2016, it issued its first fine against a business associate – the Catholic Health Care Services of the Archdiocese of Philadelphia agreeing to pay $650,000 following a breach of 450 records. The non-profit organization had failed to conduct a HIPAA risk assessment since 2013.

More recently, the proportion of data breaches attributable to a lack of compliance by business associates may appear to have reduced, but this is not necessarily the case. Under the HIPAA Breach Notification Rule (CFR § 164.410), a business associate is required to notify a covered entity when a breach of unsecured PHI occurs. It is then the covered entity’s responsibility to notify HHS and the affected individual(s) – so it may be the case many data breaches are recorded as being attributable to a covered entity when in fact a business associate is at fault.

Developing a Risk Management Plan and Implementing New Procedures

A HIPAA risk assessment should reveal any areas of an organization’s security that need attention. Organizations then need to compile a risk management plan in order to address the weaknesses and vulnerabilities uncovered by the assessment and implement new procedures and policies where necessary to close the vulnerabilities most likely to result in a breach of PHI.

The risk levels assigned to each vulnerability will give an organization direction on the priority that each vulnerability needs to be given. The organization can then create a remediation plan to tackle the most critical vulnerabilities first. The remediation plan should be complemented with new procedures and policies where necessary, and appropriate workforce training and awareness programs.

It has been noted by OCR that the most frequent reason why covered entities and business associates fail HIPAA audits is because of a lack of procedures and policies – or inadequate policies and procedures. It is important that the appropriate procedures and policies are implemented in order to enforce changes to the workflow that have been introduced as a result of the HIPAA risk assessment.

Tools to Assist with a HIPAA Security Risk Assessment

Conducting a HIPAA risk assessment on every aspect of an organization’s operations – not matter what its size – can be complex. This is particularly true for small medical practices with limited resources and no previous experience of complying with HIPAA regulations. To help reduce the complexity of conducting HIPAA risk assessments, in 2014, OCR released a downloadable Security Risk Assessment (SRA) tool that helps small and medium sized medical practices with the compilation of a HIPAA risk assessment.

The SRA tool is very helpful in helping organizations identify some locations where weaknesses and vulnerabilities may exist – but not all. In the User Guide accompanying the software, it is stated at the beginning of the document “the SRA tool is not a guarantee of HIPAA compliance”. This is because, although the tool consists of 156 questions relating to the confidentiality, availability, and integrity of all PHI, there are no suggestions on how assign risk levels or what policies and procedures to introduce.

Much the same applies to other third-party tools that can be found on the Internet. They may also help organizations identify some weaknesses and vulnerabilities, but not provide a fully compliant HIPAA risk assessment. Indeed, many third-party vendors publish disclaimers in the small print of their terms and conditions similar to that at the beginning of the SRA tool User Guide. The conclusion is that tools to assist with a HIPAA risk assessment can be helpful for identifying issues but are not suitable for providing solutions to all issues.

HIPAA Risk Assessment FAQ

Where are risks most commonly identified?

Where risks are most commonly identified vary according to each organization and the nature of its activities. For example, a small medical practice may be at greater risk of impermissible disclosures through personal interactions, while a large healthcare group may be at greater risk of a data breach due to the misconfiguration of cloud servers.

What is a “reasonably anticipated threat”?

A reasonably anticipated threat is any threat to the privacy of individually identifiable health information or to the confidentiality, integrity, or availability of PHI that is foreseeable. These not only include threats from external bad actors, but also threats originating from human error or a lack of knowledge due to a lack of training. This is why a “big picture” view of organizational workflows is essential to identify reasonably anticipated threats.

What is the difference between a risk assessment and a risk analysis?

The difference between a risk assessment and a risk analysis is that a risk assessment identifies the risks to HIPAA compliance, whereas a risk analysis assigns risk levels for vulnerability and impact combinations. The objective of assigning risk levels to each risk is so that risks with the potential to be most damaging can be addressed as priorities. Most HIPAA risk analyses are conducted using a qualitative risk matrix.

Who is responsible for conducting a HIPAA security risk assessment?

The responsibility for conducting a HIPAA security risk assessment usually lies with a HIPAA Compliance Officer; or, if the responsibility for HIPAA compliance is shared between a HIPAA Privacy Officer and a HIPAA Security Officer, the risk assessment and analysis should be conducted by the HIPAA Security Officer with assistance from his or her colleague depending on the nature of risks identified.

Are there different types of risk assessment for covered entities and business associates?

There are not different types of risk assessment for covered entities and business associates. Both covered entities and business associates need to conduct “A-to-Z” risk assessments for any Protected Health Information created, used, or stored. While business associates may experience a lower volume of PHI than a covered entity, the risk assessment has to be just as thorough and just as well documented.

What is a HIPAA risk assessment?

A HIPAA risk assessment is a risk assessment that organizations subject to the Administrative Simplification provisions of the Health Insurance Portability and Accountability Act have to complete in order to be compliant with the “Security Management Process” requirements. Non-compliant organizations have been filed for failing to comply with this requirement of HIPAA.

What is the difference between a HIPAA risk assessment and a HIPAA compliance assessment?

The difference between a HIPAA risk assessment and a HIPAA compliance assessment is that a HIPAA risk assessment identifies potential threats and vulnerabilities so measures can be implemented to mitigate their likelihood. A HIPAA compliance assessment is usually an assessment performed by a third party to assess an organization´s compliance with the HIPAA Privacy, Security, and Breach Notification Rules.

Why can I not find a HIPAA risk assessment template on the Internet?

You will not find a HIPAA risk assessment template on the Internet because covered entities and business associates vary significantly in size, complexity, and capabilities, and there is no “one-size-fits-all” HIPAA risk assessment. Due to the number of variables, there is no such thing as a HIPAA risk assessment template; and, if you do source a template from the Internet, you should treat it with caution as it may not include every potential risk to PHI maintained by your organization.

When is a HIPAA risk assessment necessary?

A HIPAA risk assessment is necessary in two instances. The first instance appears in the HIPAA Security Rule (45 CFR § 164.308 – Security Management Process). The second instance occurs under the HIPAA Breach Notification Rule (45 CFR § 164.402), which applies when there has been an impermissible acquisition, access, use, or disclosure of unsecured PHI. However, organizations should conduct risk assessments more often than these requirements, particularly related to non-electronic PHI and organizational requirements.

What is the objective of a HIPAA security risk assessment?

The objective of a HIPAA security risk assessment is to identify risks to the confidentiality, integrity, and availability of all electronic PHI the covered entity or business associate creates, receives, maintains, or transmits. The risk assessment should not only focus on external threats, but also those within the organization attributable to malicious insiders or a lack of security awareness training.

What factors are considered in a HIPAA breach risk assessment?

The factors considered in a HIPAA breach risk assessment include the nature and extent of breached PHI, the types of identifiers and the likelihood of re-identification, the unauthorized person who accessed or used the breached PHI, whether PHI was actually acquired or viewed, and the extent to which the risk to PHI has been mitigated.

What could be the consequence of not identifying risks to PHI in a risk assessment?

The consequences of not identifying risks to PHI in a risk assessment are an increased likelihood of a data breach or impermissible disclosure, and – following on from such an event – a sanction issued by HHS’ Office for Civil Rights for failing to conduct a thorough risk assessment. It is important to be aware there are no excuses for failing to conduct a thorough risk assessment as covered entities and business associates “know or should know” they have a responsibility to safeguard PHI.

Do the HIPAA risk assessment requirements apply to Business Associates?

The HIPAA risk assessment requirements apply to business associates as business associates are required to comply with the HIPAA Security and Breach Notification Rules and the two HIPAA standards relating to HIPAA risk assessments appear in these Rules. Business associates are also advised to conduct HIPAA Privacy Rule risk assessments if the nature of their activities for a covered entity could violate the privacy of individually identifiable health information.

What tools can assist organizations with a HIPAA risk assessment?

The tools that can assist organizations with a HIPAA risk assessment include a downloadable Security Risk Assessment (SRA) tool released by HHS’ Office for Civil Rights in 2014 to help small and medium-sized medical practices with the compilation of a HIPAA risk assessment. There are also many tools available from third party compliance experts that are best used for identifying issues in situations not covered by the Security Risk Assessment Tool (i.e., HIPAA Privacy Rule compliance).

The post Free HIPAA Security Risk Assessment appeared first on The HIPAA Journal.