Now comes the step in the process in which all the risks (there’s that word again) have to be measured in terms of how each could impact all the ePHI identified earlier in the analysis. This is a thoughtful process that can, and should, take some time. It is also not a task that should be completed entirely by one person but, rather, should have input from others in the organization. This input can come when documenting and analyzing the risks or when reviewing the list, once complete. The desired outcome of this phase is knowledge of all the risks ...
© Eric C. Thompson 2017
Eric C. Thompson, Building a HIPAA-Compliant Cybersecurity Program, https://doi.org/10.1007/978-1-4842-3060-2_7
7. Is It Really This Bad?
Eric C. Thompson1
(1)Lisle, Illinois, USA
Get Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health Information now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
