New version of HIPAA security risk assessment tool released

November 1, 2019

Blog Post

On Oct. 30, 2019, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC) announced the release of a new downloadable version (3.1) of the HHS Security Risk Assessment (SRA) Tool to help HIPAA covered entities and business associates assess risks to the confidentiality, integrity and availability of electronic protected health information (ePHI).

Enterprise-wide risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (also known as risk analysis) is essential for HIPAA covered entities and business associates. In fact, it was recently identified as one of the most prevalent HIPAA violations and should be conducted and updated regularly.

A wide range of health care organizations are likely to find the SRA Tool useful in navigating the challenges of conducting and regularly updating its risk assessment. OCR and ONC identify small and medium sized health care organizations as the target audience and tout functionality updates and new features in this version.

For more information, please contact the attorney listed below.

Skilled nursing facilities will soon be required to significantly expand their reporting of ownership and control information on newly updated CMS-855A forms. Private equity companies and other organizations like real estate investment trusts have been named as one of the reasons that the expanded reporting for SNFs has been implemented. As such, these organizations should be aware that they may be a part of this reporting through a number of routes.

Over the past 24 months, the U.S. Department of Health and Human Services Office for Civil Rights has brought notable enforcement efforts against several non-profit covered entities and business associates, resulting in instances of six and seven-figure penalties against providers across the county for incidents involving breaches of protected health information.

A new amendment to New York state law, which would have required all healthcare providers to obtain separate consents from patients for treatment and payment is on hold until further guidance is released, according to the New York Department of Health.

New version of HIPAA security risk assessment tool released

Related Services

You may also be interested in