1. How does a HIPAA security risk analysis differ from a broader cybersecurity assessment?

A HIPAA security risk analysis focuses on potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information, or ePHI. Its scope must account for the ePHI the organization creates, receives, maintains, or transmits.

A broader cybersecurity assessment can examine additional information, systems, operational dependencies, and security-program capabilities. A framework such as the NIST Cybersecurity Framework can provide a structure for organizing that broader review.

The two activities can be coordinated, but a framework checklist or maturity assessment does not automatically satisfy the HIPAA risk-analysis requirement. The work must address the relevant ePHI, threats, vulnerabilities, existing safeguards, and resulting risks.

Altiri can scope an engagement to deliver both the HIPAA-focused analysis and a broader assessment, with clearly identified outputs and a coordinated action plan. The report should make clear what was examined, what remains uncertain, and what management needs to address.

Reference: HHS guidance on risk analysis.

2. How can we document security practices that have already been operating for years?

Start with evidence of actual operation. Organizations may already have effective safeguards but lack a consistent way to connect those safeguards to a recognized framework and demonstrate how long they have been in place.

Useful records may include access reviews, change tickets, training records, vulnerability-management reports, incident exercises, configuration histories, and dated management reviews. Map those records to the practices they support, identify their coverage and limitations, and distinguish established practices from recently implemented improvements.

For certain HIPAA Security Rule enforcement and audit activities, OCR must consider whether an organization adequately demonstrates that recognized security practices were in place for the previous 12 months. A newly prepared framework mapping can help organize historical evidence; it cannot establish an operating history that the evidence does not support.

Where gaps are remediated, retain the implementation date and subsequent evidence of operation. That establishes a defensible history for the improved practice.

This work can support a documented account of the organization’s efforts to safeguard ePHI. It does not, by itself, establish compliance or guarantee reduced penalties or a particular OCR outcome. The HITECH Act amendment enacted in 2021 gives healthcare organizations a practical incentive to maintain and document recognized security practices: demonstrated implementation may help mitigate fines, shorten audits, or reduce agreed remedies in applicable HIPAA enforcement matters.

References: HHS Security Rule guidance and 42 U.S.C. § 17941: Recognition of security practices.

3. When is an ongoing advisory arrangement more useful than a fixed project?

A fixed project is useful when the organization needs a defined deliverable, such as a risk analysis, an assessment, or a remediation plan. An ongoing arrangement is useful when leadership also needs help coordinating implementation, resolving dependencies, reviewing evidence, and keeping the security program current.

Healthcare organizations often need both. An initial assessment can establish the issues and priorities, followed by a continuing engagement to move the work forward with internal staff and service providers.

An ongoing scope should identify specific responsibilities and outputs. These may include maintaining the action plan, facilitating risk decisions, coordinating remediation, reviewing changes, and preparing management reporting. Meeting frequency alone is not a sufficient definition of the service.

Altiri can structure support as a project, an ongoing engagement, or a combination. The arrangement should match the work, the organization’s internal capacity, and the decisions that remain with its leadership.