HIPAA Risk Assessments for Small Medical Practices

Small medical practices face unique challenges that larger practices don’t, but all covered entities share one requirement: following HIPAA. Therefore, small medical practices should conduct HIPAA risk assessments. Here is what small medical practices should consider to ensure HIPAA compliance.

What Is HIPAA and How Does It Apply to Small Medical Practices?

HIPAA sets national standards for protecting sensitive patient health information. It applies to covered entities. A covered entity is a healthcare provider, health plan, or healthcare clearinghouse covered by HIPAA. Healthcare providers generally include doctors, dentists, clinics, hospitals, pharmacies, and other providers that conduct certain healthcare transactions electronically

HIPAA includes several important rules that guide how organizations protect and manage patient information:

• Privacy Rule: Regulates how covered entities use and disclose protected health information (PHI). It also gives patients rights to access and obtain copies of their health information.
• Security Rule: Requires covered entities to protect electronic protected health information (ePHI) with appropriate administrative, physical, and technical safeguards.
• Breach Notification Rule: Requires covered entities and business associates to provide notice after certain breaches of unsecured PHI. Depending on the breach, organizations may need to notify affected individuals, the U.S. Department of Health and Human Services (HHS), and the media.

Small medical practices are subject to the same HIPAA requirements as larger healthcare organizations, including privacy, security, and breach notification requirements. While a practice’s size may affect how it implements safeguards, it does not exempt the practice from HIPAA compliance.

What Should a HIPAA Risk Assessment Include?

A HIPAA risk assessment identifies potential risks and vulnerabilities that could affect the confidentiality, integrity, or availability of PHI within a medical practice. It should give a medical practice a clear picture of how it creates, receives, maintains, and transmits ePHI. The assessment should identify potential risks, evaluate the likelihood and impact of those risks, and document the safeguards the practice uses to reduce them.

A small practice does not need a complicated process. The assessment should reflect the practice’s size, systems, workforce, and daily operations.

A risk assessment should generally include:

ePHI inventory: Identify where the practice stores and uses ePHI. This may include electronic health records, billing systems, email, servers, laptops, and mobile devices.

Potential threats: Identify events that could compromise ePHI. Examples include phishing attacks, malware, stolen devices, unauthorized access, and system failures.

Vulnerabilities: Look for weaknesses that could allow a threat to affect patient information. Examples include weak passwords, outdated software, missing security updates, or improper access controls.

Existing safeguards: Document the administrative, physical, and technical safeguards already in place. These may include encryption, access controls, employee training, backups, and security policies.

Frequently Asked Questions:

What happens if a small medical practice does not conduct a HIPAA risk assessment?

A risk assessment helps the practice see what needs attention and take practical steps to better protect patient information and reduce the chance of a data breach. If a small medical practice skips a HIPAA risk assessment, it may not realize where patient information is most vulnerable. This can make it harder to spot security gaps, protect sensitive information, and address potential problems before they become serious. It can also lead to HIPAA compliance issues. 

Can a HIPAA attorney help with a risk assessment?
Yes, a HIPAA attorney can help a small medical practice with its risk assessment. They can explain HIPAA requirements, help identify potential compliance problems, and review the practice’s policies and procedures for handling patient information. An attorney can also help the practice figure out what needs to be fixed and how to address any compliance concerns. While a technical expert may be needed to review certain security systems, a HIPAA attorney can provide helpful legal guidance and make the process easier to understand.

What HIPAA risk documentation should a medical practice keep?

The practice should evaluate each identified risk by considering both the likelihood of the risk occurring and the potential impact on ePHI if it occurs. For example, a practice may determine that employees using weak passwords create a high risk of unauthorized access to patient records. A practice should then prioritize risks based on their likelihood and potential impact and determine what specific steps it will take to address them.

Corrective actions should directly address the risks identified during the assessment. Depending on the findings, the practice may require multifactor authentication for EHR and email accounts, install security updates, encrypt laptops and other devices that store ePHI, limit employee access based on job responsibilities, strengthen password requirements, improve backup procedures, or provide additional HIPAA security training.

The practice should document each identified risk, its risk level, the safeguards already in place, and the corrective actions the practice plans to take. The documentation should also identify who is responsible for each corrective action and, when appropriate, include a target completion date. Keeping these records gives the practice a clear record of the risks it identified and the specific steps it took to reduce them.

How often should a small practice perform a HIPAA risk assessment?

HIPAA does not require every practice to follow a specific annual date for completing a risk assessment. Instead, practices should assess their risks based on their circumstances and whenever significant changes occur.

Practices should reassess their risks if there are:

• Major technology changes
• New vendors
• Different offices
• Significant workflow changes
• Security incident experiences
• Any other event that could affect ePHI

Contact a HIPAA Compliance Attorney Today 

For small medical practices, keeping up with HIPAA requirements can feel overwhelming, especially when it comes to protecting patient information and completing risk assessments. A HIPAA healthcare compliance attorney can help you understand what your practice needs to do and spot potential compliance issues. Getting legal guidance can also give you peace of mind and help you address problems before they become bigger concerns.