The risk assessment process requires management to select security measures designed to reduce risks to an acceptable level and protect ePHI, in accordance with the HIPAA Security Rule. No specific measures are prescribed by HHS or the OCR. Rather, it is up to the entity to define the measures that meet those objectives. Successful identification and implementation of security controls requires entities to consider the following:
Based on risk tolerance, determine the level of risk reduction required.
Based on the risk level, identify new, or ...
