Risk analysis and risk management go together
The HIPAA Security Rule requires both a risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and risk management: implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(B)). An assessment that sits in a drawer covers only the first half.
Step 1: Review the findings with decision-makers
Go through the report with the practice owner, physicians or practice manager. Make sure everyone understands each finding, why it matters for patient data, and how it was ranked.
Step 2: Prioritize by risk
Start with the items rated highest for likelihood and impact. Some fixes are quick configuration changes; others need planning, budget or vendor involvement. A realistic order matters more than trying to fix everything at once.
Step 3: Assign owners and target dates
Each item should have a named person responsible and a date the practice chooses based on its own resources. This turns the findings into a working risk management plan.
Step 4: Fix, then confirm
Common remediation work in small practices includes:
- Turning on or confirming device encryption
- Testing that backups can actually be restored
- Removing unused or former-staff accounts and tightening access
- Enabling multi-factor authentication where available
- Signing missing Business Associate Agreements
- Separating guest Wi-Fi from systems that hold patient data
- Updating policies and delivering staff training
Step 5: Document what was done
Record each fix, the date and who completed it. If a risk is accepted rather than fixed, write down why. HIPAA requires Security Rule documentation to be kept for six years (45 CFR 164.316(b)(2)).
Step 6: Keep the analysis current
Review the risk analysis periodically and whenever the practice changes — a new EHR, a new location, new vendors or a security incident. Each review feeds the next round of remediation.