Description should include
- the nature and extent of the protected/PHI involved in the use or disclosure, including the types of identifiers and the likelihood that the PHI could be re-identified
- the unauthorized person who used the PHI or to whom the disclosure was made (e.g., a sibling, a journalist)
- the likelihood that any PHI was actually acquired or viewed (e.g., an audit trail would provide insights)
- the extent to which the risk to the PHI has been mitigated (e.g., promptly changed encryption key).
Teacher Resource: Security Risk Assessment (SRA) Tool (https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool), Office of the National Coordinator for Health Information Technology
Process/Skill Questions:
- What are three ways to ensure PHI is kept safe?
- What are the various types of data protection? How do they work?
- What agencies have developed a risk assessment tool?
- How can HealthIT.gov’s SRA Tool assist with a case scenario? Is the tool user-friendly?
- Does HealthIT.gov’s SRA Tool provide assessment at all levels of the organization? Did it assess potential solutions for now and in the future to decrease threats?