Initializing secure session…Initializing secure session…Years of enforcement actions share a common finding: the organisation never performed an accurate, thorough, enterprise-wide risk analysis. Understanding what that phrase means is the difference between a defensible program and a settlement.
If you read the resolution agreements published by the HHS Office for Civil Rights, one finding recurs so often it is almost a template: the covered entity "failed to conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to the protected health information it holds. It appears in cases involving large health systems and small practices, hospitals and business associates. It is the most common HIPAA failure there is.
Most healthcare organisations have something they call a risk assessment. Often it is a questionnaire, a vendor's checklist or a gap analysis against a framework. These are useful, but they are not what the Security Rule requires. The regulation asks for an analysis of risks to all electronic PHI, wherever it is — not a review of a particular system or a list of controls that are present or absent.
A gap analysis asks "which controls do we have?" A risk analysis asks "what could happen to our patient data, how likely is it, how bad would it be, and what are we doing about it?" OCR has stated repeatedly that the first does not satisfy the requirement for the second.
The analysis must cover every place PHI lives: the EHR, of course, but also billing systems, email, imaging devices, telehealth platforms, cloud storage, backup media, mobile devices, and the third parties who process data on your behalf. Organisations consistently underestimate this inventory. The analysis is only as complete as the inventory beneath it.
You cannot assess the risk to data you do not know you have. The inventory is the analysis.
HHS has proposed significant updates to the Security Rule that would make many currently "addressable" safeguards mandatory and tighten expectations around asset inventories, network mapping and risk analysis specificity. Whatever the final form of those changes, the direction is clear: regulators want documented, specific, current analysis — and they want to see it updated when the environment changes.
At the same time, healthcare remains the costliest sector for breaches. IBM's annual Cost of a Data Breach research has ranked healthcare as the costliest sector for breaches for many years running. The risk analysis is not a compliance artefact. It is the document that tells leadership where that money is most likely to be lost.
This is foundational work in our healthcare compliance engagements, and it is also where Compliance-as-a-Service earns its value: the analysis stays current instead of being rediscovered under investigation. If your last risk analysis is older than your newest system, it is time for a conversation.
This article is general information for business readers, not legal, regulatory, medical or professional advice. Regulations change; confirm requirements for your situation with qualified counsel or your regulator. Imagery is original AI-generated artwork created with Canva. Frameworks and standards named are trademarks of their respective owners.
If your team dreads the month before the audit, the problem is not the audit. It is that compliance is treated as an event instead of an operating state.
Read the article →
The Department of Defense's cybersecurity certification is no longer a future requirement. For suppliers handling controlled information, the decision is not whether to certify but how fast — and how to do it without stopping the plant.
Read the article →
The difference between an AI program that scales and one that gets shut down after its first incident is rarely the model. It's whether anyone's name is on it.
Read the article →Start with a free security or AI readiness call — no obligation, and you leave with a clear next step.