Federal regulators keep citing the same failure
HHS's Office for Civil Rights has a program called the Risk Analysis Initiative. After breach after breach, it finds the same thing: no accurate and thorough risk analysis. That has reached a small surgical practice, a small neurology practice and an ambulance service.
A risk analysis is a written record of where your patients' electronic information lives, what could realistically go wrong with it, how likely and how bad that would be, and what you're doing about it. A small practice can do it in plain language, with free tools.
What's law, and what's only proposed
HHS proposed a major rewrite of the Security Rule in January 2025. As of this guide's check date it hasn't been finalized.
| Topic | The law today | If the proposal is finalized as written |
|---|---|---|
| Risk analysis | Required | Still required, with more detail about its contents |
| "Addressable" items | Assess each, then implement it or document why not | The distinction goes away |
| Asset list and network map | Not named, but needed in practice | Written inventory and map, reviewed yearly |
| Restoring systems | Contingency plan required | Restore critical systems within 72 hours |
Start with these three
- ///List every place ePHI lives
EHR, email, imaging, billing, laptops, phones, copiers, backups, patient portal and any AI scribe. The cases OCR settles often started somewhere a narrow analysis skipped.
- ///Keep one backup an attacker can't reach
Offline or immutable, with a separate login. Then practice a restore and time it.
- ///Turn on MFA for email, the EHR and remote access
Stolen passwords are a common starting point. Include vendors' remote support tools.
A practice is attractive because it can't stop seeing patients. We need one phished password, one remote access tool with no MFA, or one unpatched server. Then we go for the backups first.
What's in the full PDF
- ///Worksheet 1: where your ePHI lives, plus a business associate list
- ///Worksheet 2: a likelihood and harm scoring grid with common threats filled in
- ///Worksheet 3: controls for your top risks, and Worksheet 4: your risk management plan
- ///The breach notification clock and a first-hour phone list