Building a HIPAA-Compliant Cybersecurity Program: Using NIST 800-30 and CSF to Secure Protected Health Information

© Eric C. Thompson 2017

Eric C. Thompson, Building a HIPAA-Compliant Cybersecurity Program, https://doi.org/10.1007/978-1-4842-3060-2_9

9. Targeted Nontechnical Testing

Eric C. Thompson¹ 

(1)Lisle, Illinois, USA

To this point, the risk analysis was executed by conducting through inquiry and the examination documents such as policies, previous assessment results, and audit reports. A limited amount of current, tangible information derived through direct testing was incorporated into the analysis thus far. This is not atypical for the initial phase of the analysis and assessment. Establishing baseline risks, as shown in Figure 9-1, through documenting and correlating current information and known capabilities into a list of risks needing treatment, ...