United States: ONC’s Security Risk Assessment Tool Is Useful But Could Be Improved

The Office of the National Coordinator for Health Information Technology (ONC) released a Security Risk Assessment Tool (SRA Tool) on March 28. According to the User Guide for the SRA Tool (available here), the Tool is designed to help small and medium-sized healthcare practices "evaluate risks, vulnerabilities, and adherence to the HIPAA Security Rule." User Guide, 1. ONC defines small and medium-sized practices as those including 1-10 healthcare providers. Id. The SRA Tool can be downloaded from the HealthIT.gov website here. ONC asks that users submit comments here by June 2 to help improve the Tool.

The SRA Tool is impressive in many ways. It downloads quickly, includes information about each Security Rule requirement it evaluates, provides useful definitions of key words and phrases, stores and retrieves information quickly, and produces reports that can be exported in.pdf and Excel formats. The challenges of developing well-working software should not be minimized. (Consider the initial rollout of the healthcare.gov website). ONC should be recognized for building a well-functioning tool.

The User Guide for the Tool notes that a provision of the HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A), requires covered entities and business associates to conduct risk assessments of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. User Guide, 2. The Guide states that the purpose of the SRA Tool is to support the risk assessment process. Id.

The Guide cautions, however, that using the Tool does not guarantee compliance with the Security Rule and that "[s]tatements of compliance are the responsibility of the covered entity and the HIPAA Security Rule regulatory and enforcement authority." Id.

The HHS Office for Civil Rights' recent HIPAA enforcement actions show that it intends to enforce the risk assessment requirement: OCR's settlements in several recent matters include references to covered entities' failure to conduct risk assessments and the settlement amounts imposed by OCR presumably take into account potential fines that the agency could have imposed for the entities' failure to perform risk assessments. See, e.g., Adult and Pediatric Dermatology (Dec. 24, 2013); Affinity Health Plan (Aug. 7, 2013); Idaho State University (May 13, 2013); Hospice of Northern Idaho (Dec. 31, 2012); and Massachusetts Eye and Ear Infirmary (Sept. 17, 2012). If small and midsized healthcare practices use the Tool in good faith and document their use of the Tool, they should be able to demonstrate they complied with the risk assessment requirement.

The ONC suggests that covered entities will need to do more to meet all their responsibilities under the Security Rule than simply to complete reports using the Tool. For example, if the Tool shows that a healthcare practice has not complied with a Security Rule requirement, the practice must take steps to correct that non-compliance. If the healthcare practice fails to do so and OCR has reason to investigate the healthcare practice, perhaps in response to a patient complaint following a data breach, reports generated by the Tool could be used to show the practice knowingly failed to address noncompliance with a Security Rule requirement. Although the Tool cannot help a covered entity comply with all HIPAA Security (or Privacy) Rule requirements, it provides a user-friendly mechanism to conduct a form of a HIPAA Security Rule risk assessment.

The risk-rating features of the SRA Tool, however, need to be improved. The Tool allows users to rate as "Low," "Medium", or "High" the "Likelihood of harm" and the "Impact of harm" related to each Security Rule requirement the Tool evaluates. Yet the Tool offers incomplete guidance regarding why the risks associated with each requirement should fall into the "Low" category as opposed to the "Medium" or "High" category. Users are left to guess whether failing to comply with a requirement would have a low, medium, or high likelihood of affecting the confidentiality, integrity, or availability ePHI, and whether the impact of such an effect would be "Low," "Medium," or "High."

For example, SRA Tool question T34 asks:

§164.312(d) – Required

Does your practice have policies and procedures for verification of a person or entity seeking access to ePHI is the one claimed?

Yes □ No □ Flag □

The "Threats and Vulnerabilities" information included for this question states:

Some potential impacts include:

" Human threats, such as an unauthorized user, can vandalize or compromise the confidentiality, availability, and integrity of ePHI.

" Unauthorized disclosure (including disclosure through theft and loss) of ePHI can lead to identity theft.

This information does not identify recognized threats, such as "An employee or contractor without authorization to access ePHI may access and copy confidential information, such as patients' insurance or payment information, and use the information to commit insurance fraud or to make fraudulent charges on patients' accounts."

Threat-based risk assessments, such as those described in NIST SP 800-30, include a step that requires users to determine which threats are most likely to impact the business and which threats would be most harmful to the business. Such threat-based assessments help users prioritize remediation efforts. Resources to counter threats (and risks) to ePHI are limited, of course, especially for small and medium-sized healthcare entities such as those that ONC intends to use the Tool. If the SRA Tool gave more guidance about how to rate the likelihood and impacts of harm, e.g., by explaining the threats and impacts each Security Rule provision is intended to address, the risk ratings would better serve their purpose. Although the Tool currently allows users to generate colorful charts showing the number and relative amounts of "Low," "Medium," and "High" risks, the lack of guidance in the Tool regarding how to apply the ratings will cause the charts to have little meaning.

The SRA Tool does not enable a threat-based approach and instead suggests that an entity must focus equally on all of the Security Rule requirements identified in the Tool. The text reports generated by the Tool, which are stated in the sequence of Security Rule requirements, reinforce this suggestion by listing whether the entity is in compliance with the listed Security Rule requirements rather than showing which real-world threats to ePHI are most likely to cause harm to the entity and its patients.

In short, the current version of the SRA Tool will provide an efficient way for small and medium-sized healthcare practices to gauge their compliance with the Security Rule requirements included in the Tool. The risk-rating features of the Tool should be improved by identifying threats to ePHI to help entities prioritize their remediation efforts.

Healthcare entities and other businesses that plan to conduct information security risk assessments should consult their information technology managers, information security officers, and the heads of the business units that process and store sensitive data. These individuals should know where confidential data is stored and where it is most vulnerable. The company's general counsel should also be included in planning the assessment. A lawyer who is a Certified Information System Security Professional (CISSP) can be a valuable member of the team to guide the assessment, to retain technical consultants to perform penetration tests and vulnerability scans, to provide confidential legal advice regarding potential liability related to assessment findings, and to help plan security improvements needed to address any gaps identified in an assessment.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Similar Articles
Relevancy Powered by MondaqAI
In association with
Related Topics
Similar Articles
Relevancy Powered by MondaqAI
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
Email Address
Company Name
Confirm Password
Mondaq Topics -- Select your Interests
 Law Performance
 Law Practice
 Media & IT
 Real Estate
 Wealth Mgt
Asia Pacific
European Union
Latin America
Middle East
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions