The direct answer
HIPAA does not require an outside or independent assessor. The Security Rule requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)).
The rule does not say who must perform the analysis, and HHS's Guidance on Risk Analysis does not prescribe a single method. A practice's own staff, its IT provider or an outside firm can do the work. What matters is that the analysis is accurate, thorough and documented.
What the risk analysis must cover
HHS's Guidance on Risk Analysis describes the elements a risk analysis should address:
- Scope: all electronic patient information the practice creates, receives, maintains or transmits, in every location and system
- Data collection: where that information is stored, received and sent
- Threats and vulnerabilities that could reasonably be anticipated
- Current security measures and whether they are used and configured properly
- Likelihood of each threat occurring
- Potential impact if it does
- A risk level for each threat and vulnerability combination
- Documentation of the analysis
- Periodic review and updates as the practice changes
Risk analysis is not the whole job
The Security Rule also requires risk management: implementing security measures that reduce risks to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(B)). It also requires periodic technical and nontechnical evaluation of how well the practice's safeguards meet the rule (45 CFR 164.308(a)(8)).
So the useful output of an assessment is not only a list of risks, but a documented risk management plan the practice can act on and revisit.
The practical trade-off
An IT provider usually knows the practice's network, devices and software better than anyone. That knowledge makes data collection faster and more complete on the technical side.
The trade-off is that the provider is assessing systems it configured and maintains, which means checking its own work. That is not a reason to rule a provider out, and many do this work carefully. It is a reason to be clear about how findings about the provider's own setup will be reported and handled.
IT providers also tend to focus on technology. The Security Rule covers administrative and physical safeguards as well, such as workforce training, access procedures, sanctions, facility access and device handling.
Questions to ask any assessor
Whether the assessor is your IT provider, an internal staff member or an outside firm, these questions help confirm the work will hold up:
- Does it cover administrative and physical safeguards, not just a technical scan?
- Will the analysis be written down and kept on file as documentation?
- Does it produce a risk management plan with priorities, owners and follow-up?
- If the assessor can access electronic patient information, is a Business Associate Agreement in place (45 CFR 164.308(b) and 164.502(e))?
- How will findings about systems the assessor manages be reported?
How the two can work together
A common arrangement is for the IT provider to fix issues while a separate assessor evaluates risk and checks that the fixes are in place. The provider keeps doing what it does best, and the practice gets a second set of eyes on the setup.
For small practices that want to do the analysis themselves, HHS and ONC offer a free Security Risk Assessment Tool on HealthIT.gov. HHS notes that using the tool does not by itself guarantee compliance.
Start with the free HIPAA readiness self-check to see where your gaps are, or read how an Atascocita IT audit works.