Gap analysis improves risk analysis, but isn't enough for HIPAA compliance, OCR says

The Office of Civil Rights is reminding healthcare organizations that while gap analysis is an effective tool to find existing vulnerabilities within a network, it can't substitute the risk analysis required by the HIPAA security rule.

Under HIPAA, providers are required to establish reasonable security measures to protect electronic patient data, including the use of risk analysis. While HIPAA doesn't enforce the specific method an organization uses to conduct a risk analysis, it should include an evaluation of all potential risks.

[Also: OCR revamps HIPAA guidance in wake of opioid crisis, 21st Century Cures rules]

This includes a full evaluation of all potential risks to PHI, including business associates. The risk analysis helps organizations to make modifications to its system to shore up vulnerabilities.

On the other hand, gap analysis can help determine the extent of which a health system and its business associates are compliant with HIPAA. It can also provide an overview of security controls in place without the need for a high-level evaluation that comes with risk analysis.

But OCR stressed that while gap analysis can enhance a risk assessment, it can't replace it.

"An entity's gap analysis generally does not satisfy the risk analysis obligations because it typically does not demonstrate an accurate and thorough assessment of the risks to all of the ePHI an entity creates, receives, maintains, or transmits," according to the notice.

Providers need to consider all potential risks to patient data, regardless of where the data is created, stored, maintained or transmitted. Further, when collecting patient data, organizations need to identify all of the locations of patient data, which then should be inventoried.

And as for potential threats to patient data, organizations need to routinely assess both tech-related and outside vulnerabilities. Given the number of breaches caused by insider error, this should also include the configuration of databases connected to the internet and access controls.

As is with all HIPAA requirements, all of these elements should be clearly documented with sufficient detail to provide OCR with documentation that the risk analysis was accurate and thorough.

As seen with several OCR settlements over breaches, a lack of documentation can be costly.

In February, Fresenius Medical Care North America settled with OCR for $3.5 million after a string of breaches. An investigation found that several of the health system's cover entities failed to conduct a thorough and accurate risk analysis. And a few of its entities lacked policies to safeguard its facilities from unauthorized access.

Twitter: @JessieFDavis
Email the writer: jessica.davis@himssmedia.com