Security Risk Analysis


Conducting or reviewing a security risk analysis (SRA) to meet the standards of Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule is included in the meaningful use requirements of the Medicaid PIP/EHR Incentive Program every year.

The Security Risk Analysis must be conducted or reviewed for each Program Year an Eligible Provider applies for a PIP/EHR Incentive Program payment. It is acceptable for the SRA to be conducted or reviewed outside the 90-Day PIP/EHR reporting period; however, the SRA or review:

  • Must be unique for each PIP/EHR reporting period;
  • The scope must include the full PIP/EHR reporting period, and;
  • Must be conducted within the calendar year of the PIP/EHR reporting period: January 1st – December 31st

The HHS Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) updated the popular Security Risk Assessment Tool in September 2020 to make it easier to use and apply more broadly to the risks to health information. The tool is designed for use by small to medium sized health care practices – those with one to 10 health care providers – covered entities, and business associates to help them identify risks and vulnerabilities to ePHI. The updated tool provides enhanced functionality to document how such organizations can implement or plan to implement appropriate security measures to protect ePHI. Here is a link to the updated tool:

https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool

SRA references, definitions, Myths and Facts, and more information are contained in the CMS SRA Tip Sheet.


Asset Inventory 

The SRA identifies where all electronic protected health information (e-PHI) is stored, received, maintained or transmitted. The asset inventory is used to determine the scope of the security risk analysis. It should include:

  • Computer hardware and software;
  • Laptops, tablets, and smart phones;
  • Flash drives, thumb drives, external hard drives, and magnetic media;
  • Printers, copiers, fax machines.
     

The SRA Tool

The Security Rule requires providers to put into place reasonable and appropriate administrative, physical and technical safeguards to protect patients’ ePHI.

A paper-based version of the 2.0 version of the ONC/OCR Security Risk Assessment Tool can be utilized to generate the Security Risk Analysis document. The links below are to Word documents that can be downloaded and printed:

Administrative Safeguards (.docx, 290 KB)

Physical Safeguards (.docx, 240 KB)

Technical Safeguards (.docx, 255 KB)

Tips on How to Address the SRA Toolkit Questions (.docx, 13 KB)

Disclaimer: The Security Risk Assessment Tool at HealthIT.gov is provided for informational purposes only. Use of this tool is neither required by nor guarantees compliance with federal, state or local laws. Please note that the information presented may not be applicable or appropriate for all health care providers and organizations. The Security Risk Assessment Tool is not intended to be an exhaustive or definitive source on safeguarding health information from privacy and security risks. For more information about the HIPAA Privacy and Security Rules, please visit the HHS Office for Civil Rights Health Information Privacy website.


The CMS Security Risk Analysis Tip Sheet

SRA references, definitions, Myths and Facts, and more information are contained in the CMS SRA Tip Sheet:

https://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms/Downloads/SecurityRiskAnalysis_Tipsheet-.pdf


For questions, contact the Vermont PIP/EHRIP Team at ahs.dvhaEHRIP@vermont.gov

Back to the Vermont Medicaid PIP/EHRIP Home Page

(Page last updated 10/9/2020)