When Was The Last Time You Had Your HIPAA Risks Assessed?

Written by Marcel Manning on March 6, 2020 Under Who can you trust with your business technology?

HIPAA Risk Assessment

When it comes to security and compliance, a lot of smaller healthcare practices think they can get away with little to no effort.

Why?

Because they think they’re flying under the radar. Because they don’t think they have the resources to spend on better cybersecurity. Because they have a small staff that’s focused on what they believe to be more pressing matters.

Not only is this all untrue – it’s dangerous.

Is your small or specialty medical practice risking a data breach and HIPAA noncompliance fines?

Are You Really “Flying Under The Radar”?

Maybe you think cybercriminals don’t care about medical practices as small as yours.

You’re wrong – nearly half of all reported data breaches in 2019 affected small organizations, mainly because they’re incredibly easy targets. The fact is that most cybercriminals aren’t spending all that much time or effort in any attack – they’re just sending phishing emails, setting up malware traps, and other largely passive and automated tactics.

For example, a Wyoming community health system, with no more than 90-beds, was hit by ransomware late last year. In the aftermath, they had to cancel appointments and suspend services, severely affecting their patients, and their ability to operate.

Are you facing the same risks?

How Can You Double-Check Your HIPAA Compliance And Potential Risks?

You are required by HIPAA to regularly revisit your HIPAA compliance policies and procedures in order to make sure they keep in line with changes to regulations, and changes within your organization.

While you could do so on your own, it’s smarter to have your IT company assess your HIPAA risk potential. This assessment should involve the following considerations:

• It should consider any and all risks to any and all PHI, in terms of its privacy, availability, and integrity. It’s important to determine and document where the data is being stored, received, maintained or transmitted.
• Potential threats need to be identified and documented, as well as their probability of occurring, and the result of their occurrence. Using this information, a theoretical level of risk needs to be determined.
• Your cybersecurity needs to be assessed and confirmed to be in line with HIPAA standards (if not stronger and more extensive).
• All information involved in and resulting from the assessment needs to be documented, and formed in an Action Plan, to address any potential noncompliance and mitigate risks.

Nexgentec Will Help You Double-check Your HIPAA Compliance

Our team understands how complicated HIPAA compliance is, and that organizations of your size need to focus their available personnel on treating patients. That’s why we’ll handle your HIPAA compliance for you.

On your behalf, we’ll conduct a risk assessment to identify gaps between your existing security measures and compliance requirements. Our HIPAA compliance consultants will make sure that best practice IT protocols are followed.

Like this article? Check out the following blogs to learn more:

Microsoft Accounts Targeted For Months, Hackers Serve A Security Reminder

Essential List of Cybersecurity Terms to Know in 2019

Microsoft Data Breach Highlights Need for MSP Collaboration and Security