Security & Privacy Program Procedures

Steps (NIST SP 800-30 / 800-66):

1. Characterize systems / scope. Identify where ePHI is created, received, maintained, or transmitted, and delineate system and data boundaries. List in-scope assets: documents (paper or electronic), applications, databases, infrastructure, endpoints, and external/outsourced services.
2. Assign asset and risk owners. For each asset record an owner. For each risk identify a risk owner (who may be the asset owner).
3. Identify threats. Enumerate reasonably anticipated threat sources (e.g., malicious actors, workforce error, system failure, environmental events) drawing on historical incidents and threat intelligence.
4. Identify vulnerabilities. Develop the list of technical and non-technical weaknesses that a threat source could exploit (from gaps in policy through software, hardware, configuration, or facility deficiencies). Each asset may map to multiple threats, and each threat to multiple vulnerabilities.
5. Analyze existing controls. Document the controls already in place or planned and assess their effectiveness in reducing likelihood or impact.
6. Rate likelihood and impact. For each threat/vulnerability pair, the risk owner assigns a likelihood and an impact score using the scale below.
7. Determine risk level. Combine the scores into a composite risk level and classify it as acceptable or requiring treatment per the criteria below.
8. Recommend controls / document results. Identify controls that would reduce each risk to an acceptable level. Record every risk, score, owner, and planned response in the risk register (§2) and summarize the engagement in a risk-analysis report provided to leadership.

Likelihood and impact scale (1–3):

Risk-level criteria (likelihood + impact):

• Low (2): may be accepted, or addressed at the owner's discretion.
• Moderate (3–4): must be addressed.
• High (5–6): must be addressed urgently.

A consistent scoring scale is what matters; an organization may adopt a finer (e.g., 1–5) or multiplicative scale provided it is documented and applied uniformly. (164.308(a)(1)(ii)(A))

2. Risk treatment & register maintenance (164.308(a)(1)(ii)(B))

1. Populate the register. Copy every risk from the analysis into the risk register, the continuously updated living document of record. Each entry carries: risk ID, description, owner, likelihood, impact, composite score, treatment disposition, residual scores, remediation status, target remediation date, and notes.
2. Prioritize. Sort treatment-required risks by composite score, highest first, to allocate attention and resources.
3. Select a disposition for each risk requiring treatment, recording the rationale:
   • Mitigate: select, expand, or develop administrative, physical, and/or technical controls;
   • Transfer: e.g., insurance or contractual terms with a third party;
   • Avoid: discontinue the activity that creates the risk;
   • Accept: permitted only when the cost of other treatment would exceed the potential impact.
4. Plan the safeguard. For mitigations, record the chosen control(s), the responsible owner, required resources, start date, target completion date, and any ongoing maintenance.
5. Estimate residual risk. After planned controls are applied, re-score likelihood and impact. If residual risk remains above tolerance, return to step 3.
6. Implement and monitor. Execute treatments; production changes follow testing and independent approval per the Configuration Management Policy. Verify controls perform as intended; if reduction targets are not met, repeat the relevant steps.
7. Track to closure. The [Security Official] reviews open register items on a regular cadence ([monthly] recommended) to update status and scores as controls land.
8. Retain. All risk-management decisions, including documented decisions not to implement a control, are retained for 6 years in the [compliance tracking system]. (164.308(a)(1)(ii)(B))

3. Annual evaluation checklist (164.308(a)(8))

The [Security Official] opens an evaluation record at least annually (and after significant environmental/operational change). Before starting, review the current HIPAA Privacy, Security, and Breach Notification Rules for changes that may shift obligations. Work through the checklist, capturing reviewer and date for each line, and route findings into the risk register (§2).

• [ ] Policies reviewed: every policy in the library reviewed for currency; updates dated and versioned.
• [ ] Procedures reviewed: every procedure reviewed and aligned with current practice and tools.
• [ ] Standards / baselines reviewed: configuration and security baselines confirmed current.
• [ ] Risk analysis current: most recent analysis (§1) is within the annual window and reflects the current environment.
• [ ] Risk register status: open treatments progressing against target dates; overdue items escalated.
• [ ] Control assessment: control self-assessments (and any independent/external assessments) completed; results recorded. (Technical testing (vulnerability scans, penetration tests, detailed control assessments) is performed under the Audit Controls & Activity Review Policy and its results are pulled in here.)
• [ ] Privacy review: inventory of applications/systems holding PHI confirmed up to date.
• [ ] Access reviews: access to PHI systems reviewed per the Access Control Policy; results linked here.
• [ ] Physical site review: sites where PHI is stored/processed and their controls confirmed.
• [ ] Incidents & breaches: incidents since the last evaluation reviewed; remediation and lessons learned captured.
• [ ] Training: workforce security/privacy training completion confirmed per the Workforce Security, Training & Sanctions Policy.
• [ ] Business associates: BAAs current for all applicable third parties.
• [ ] Sign-off: evaluation summary approved by the [Security Official] (and [Privacy Officer]), findings entered into the register, and the record retained for 6 years. (164.308(a)(8))

4. Safeguard owner matrix (164.530(c))

Maintain the matrix below as the single map of who owns each administrative, technical, and physical safeguard and which policy governs it. Review it during the annual evaluation (§3) and whenever roles or systems change. Replace owners with named roles; a small team may concentrate ownership in the [Security Official] / [Privacy Officer].

(164.530(c))

Records produced (evidence)

Risk-analysis reports · the risk register (with treatment dispositions and residual scores) · risk-management decision records (including decisions not to act) · annual evaluation records and sign-offs · control self-assessment results · the safeguard owner matrix · designation records for the [Security Official] and [Privacy Officer]. These are the artifacts an auditor will request to confirm the program operates. Retain for 6 years.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Security Official]. v1.0.