This policy is listed for reference only and should be reviewed with your lawyer before implementing them into daily practice. We are not lawyers and are not providing any legal advice. View our legal disclaimer.

Security Management Process: Risk Updates

Reference: 45 CFR 164.308(a)(1)
Last Updated: May 19, 2024


The purpose of the Risk Analysis Update Policy is:

  • To gather intelligence from agencies, the Office of the Inspector General (OIG), the Federal Computer Incident Response Center (FedCIRC), mass media, virus alerts, and/or vendors to update potential risks to the confidentiality, integrity and availability of electronic patient health information (EPHI).
  • To identify sources of information regarding potential risks to the organization.
  • To assist in the identification and implementation of risk management policies to reduce the risks uncovered by security inspections.


Procedure: In order to assess and prioritize tasks regarding this policy we will:

  • Perform and maintain an initial Internal Security Checklist to establish a baseline of security risks.
  • Variables to consider during the risk assessment should covered the following areas:
    • Asset inventory,
    • Data criticality analysis,
    • Threat assessments,
    • Determination of risk exposures, and
    • Development of a risk management plan or similar plan of action that addresses and documents actions taken.
  • Maintain a written record of the analysis/assessment for 6 years.
  • Submit the risk assessment findings and the risk management plan to the appropriate parties within 30 days of concluding their assessment.
Simplify Your Compliance with
Software and Guided Coaching
Let your patients and clients know that you take HIPAA seriously with the HIPAA Seal of Compliance for your website, storefront, and marketing materials.

Get instant access to HIPAA Compliance News and Updates

You'll get your first checklist as soon as you sign up!

overlapping hands

Our Mission

To safeguard medical data by providing secure, reliable, and fully HIPAA-compliant hosting solutions, enabling healthcare professionals to focus on their primary mission of providing care.
linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram