ONC Rolls Out HIPAA Security Risk Assessment Tool Updates
By Alisa Pierce

To help physician practices comply with federal requirements and identify areas where electronic protected health information (ePHI) could be at risk, federal officials have updated the HIPAA Security Risk Assessment (SRA) Tool.

The desktop-compatible tool is designed to help health care professionals conduct a security risk assessment as required by the HIPAA Security Rule. Users can save and print references, supplementary guidance, and risk-assessment reports after completing the assessment. 

Version 3.7 of the SRA, released in September by the Office of the National Coordinator for Health Information Technology (ONC) and the U.S. Department of Health and Human Services Office for Civil Rights, can be downloaded at no cost. It contains several key updates based on user feedback that ONC says make the application and its workbook versions easier to use and more relevant in the face of evolving cybersecurity threats.

Those updates include content improvements in questions, responses, and education, with the following areas of emphasis:

• Transparency about the tool’s scope, as the SRA tool survey alone may not identify all risks present in an organization;
• Questions that help assess situations when ePHI is stored, created, received, maintained, or transmitted across multiple device locations;
• Risks related to remote access and telework;
• Modernized asset inventory;
• Modernized system-activity logging; and
• Potential review triggers for when to update security assessments.

Version 3.7 also features minor updates to reports and references and includes updated software libraries.

ONC asks physicians to leave any questions, comments, or feedback about the SRA tool through its Health IT Feedback Form. Physicians may also leave a message with ONC’s Help Desk by phone at 734-302-4717 or by email.