Medical Cyber Specialties

🛡️ Developing a Policy for Periodicity of Security Risk Assessments (SRAs) Under HIPAA

Why It Matters

Under the HIPAA Security Rule, specifically 45 CFR § 164.308(a)(1)(ii)(A), covered entities and business associates are required to:

“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by the covered entity or business associate.”

However, HIPAA does not prescribe how often this assessment must occur. That’s where organizational policy comes into play—your policy must define a reasonable and appropriate periodicity based on your size, complexity, environment, and risk profile.

 

🔧 Key Considerations for Policy Development

  1. Regulatory Guidance
    • OCR expects SRA to be ongoing, not a one-time event.
    • The SRA must be updated “as needed”, which includes environmental changes, system updates, or security incidents.
  2. Industry Best Practice
    • Annual reviews are a common baseline.
    • More frequent updates (quarterly or semi-annually) may be appropriate for dynamic or high-risk environments.
  3. Trigger-Based vs. Calendar-Based SRAs

    Combine scheduled reviews with event-driven assessments:

    • New system implementation
    • Major changes to infrastructure or applications
    • Significant personnel changes
    • After a security incident or breach
  4. Risk Appetite and Resources

    Balance compliance, cost, and risk. Document why your chosen periodicity is “reasonable and appropriate.”

 

 

Note: For Covered Entities (CEs): HIPAA mandates that CEs perform a security risk assessment on an ongoing basis, and it is expected to be done at least annually. This assessment is part of a larger effort to identify and address potential vulnerabilities to PHI.

 

For Business Associates (BAs): While the regulations don’t specify an exact frequency for risk assessments for BAs, they are required to adhere to the HIPAA Security Rule and ensure that they are safeguarding PHI. The BAs must conduct assessments to identify and mitigate risks to PHI under their control. Annual assessments are generally considered best practice to stay compliant with HIPAA requirements, though a BA may conduct them more frequently if there are significant changes in technology, operations, or security threats.