HIPAA security risk analysis for health-tech teams.
The HIPAA Security Rule (45 CFR 164.308(a)(1)(ii)(A)) requires covered entities and business associates to conduct an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of the electronic protected health information (ePHI) they hold. Cognivus delivers that documented risk analysis and helps you reduce the risks it finds.
Why it matters
The risk analysis is the foundation of the Security Rule: your safeguards, policies and vendor agreements should all trace back to it. A missing or outdated risk analysis is among the most commonly cited issues in HHS Office for Civil Rights enforcement.
What we cover
- Every system that creates, receives, maintains or transmits ePHI: app backend, portals, cloud accounts, laptops, email, backups
- Vendors with ePHI access and the status of their business associate agreements (BAAs)
- Administrative, physical and technical safeguards
- Likelihood, impact and risk level for each threat, with rationale and evidence
- Mapping of each finding to the Security Rule standard it relates to
Method
NIST SP 800-30 Rev. 1 for the assessment process, applied with NIST SP 800-66 Rev. 2, NIST's guide to implementing the HIPAA Security Rule. See exactly what you receive in our sample report for a fictional digital-health company.
Frequently asked questions
Will a risk analysis make us HIPAA compliant?
No assessment can certify compliance; there is no official HIPAA certification. We provide the documented risk analysis the Security Rule requires and help you reduce the risks it finds.
We are a business associate, not a provider. Does this apply?
Yes. Business associates that handle ePHI are directly subject to the Security Rule, including the risk analysis requirement.
How often should it be updated?
The rule requires the analysis to be kept current. Most organisations review it at least annually and after significant changes to systems, vendors or data flows.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.