RM-03—Risk Assessment: HIPAA Criteria

>Control Description

Organization's periodic risk assessment for systems that process, transmit or store Protected Health Information (PHI) includes the following: • identify and classify assets • identify threats • identify vulnerabilities • identify controls • perform threat likelihood analysis • perform threat impact analysis • identify residual risk • identify appropriate safeguards

Theme

Process

Type

Detective

Policy/Standard

Risk Management Standard

>Implementation Guidance

1. Ensure risk assessment for systems that process, transmit or store Protected Health Information (PHI) shall be in place and includes the information listed below: • identify and classify assets • identify threats • identify vulnerabilities • identify controls • perform threat likelihood analysis • perform threat impact analysis • identify residual risk • identify appropriate safeguards

>Testing Procedure

1. Review Risk Assessment for a sample system that process, transmit or store Protected Health Information (PHI) and validate whether it includes the following: • identify and classify assets • identify threats • identify vulnerabilities • identify controls • perform threat likelihood analysis • perform threat impact analysis • identify residual risk • identify appropriate safeguards