OCR; ONC Release Updated Security Risk Assessment Tool
The HHS’ Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC) have released an updated version of their Security Risk Assessment (SRA) Tool.
The risk analysis is one of the most important requirements of the HIPAA Security Rule. HIPAA-regulated entities are required to conduct a risk analysis to identify and assess all potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). If a thorough and accurate organization-wide risk analysis is not conducted, risks and vulnerabilities are likely to remain unaddressed and can be exploited by malicious actors to gain access to ePHI. Despite its importance, many HIPAA-regulated entities fail to comply with this requirement and the HIPAA Security Rule. Risk analysis failures are one of the most common HIPAA violations uncovered by OCR in its data breach investigations and HIPAA compliance reviews.
The SRA tool is a downloadable desktop application that was developed by ONC in collaboration with OCR to guide small- to medium-sized providers through the security risk assessment process. The tool uses multiple choice questions, threat and vulnerability assessments, and asset and vendor management, provides guidance and references throughout the process, and generates reports to save and print when the assessment is completed.
The tool was first released in 2014 and has received several updates over the years. The latest version of the tool – version 3.4 – includes several new features, including a remediation report to help track responses within the tool, a glossary and “Tool Tips” help feature, updated references to Health Industry Cybersecurity Practices (HICP) for 2023 Edition, and several bug fixes and stability enhancements.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The tool is available as a Windows Desktop application or an Excel Workbook on the HHS website.
