New version of HIPAA security risk assessment tool released

November 1, 2019

Blog Post

On Oct. 30, 2019, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC) announced the release of a new downloadable version (3.1) of the HHS Security Risk Assessment (SRA) Tool to help HIPAA covered entities and business associates assess risks to the confidentiality, integrity and availability of electronic protected health information (ePHI).

Enterprise-wide risk assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI (also known as risk analysis) is essential for HIPAA covered entities and business associates. In fact, it was recently identified as one of the most prevalent HIPAA violations and should be conducted and updated regularly.

A wide range of health care organizations are likely to find the SRA Tool useful in navigating the challenges of conducting and regularly updating its risk assessment. OCR and ONC identify small and medium sized health care organizations as the target audience and tout functionality updates and new features in this version.

For more information, please contact the attorney listed below.

Over the past 24 months, the U.S. Department of Health and Human Services Office for Civil Rights has brought notable enforcement efforts against several non-profit covered entities and business associates, resulting in instances of six and seven-figure penalties against providers across the county for incidents involving breaches of protected health information.

A new amendment to New York state law, which would have required all healthcare providers to obtain separate consents from patients for treatment and payment is on hold until further guidance is released, according to the New York Department of Health.

On November 1, 2024, the Centers for Medicare & Medicaid Services issued the Medicare Physician Fee Schedule 2025 final rule, which establishes new advanced primary care management billing codes that will expand opportunities for physician practices, federally qualified health centers, rural health clinics and other health care providers to get paid for services provided by clinical staff under the direction of a physician, nurse practitioner or physician assistant beginning January 1, 2025.

New version of HIPAA security risk assessment tool released

Related Services

You may also be interested in