The Definitive Guide to Complying with the HIPAA/HITECH Privacy and Security Rules

Chapter 12

Security Rule: Risk Assessments

Objectives

The objectives of this chapter are as follows:

• ■  Understand what is involved in conducting a risk assessment.
• ■  Determine the characteristics of an information system.
• ■  Determine the threats related to a specific information system.
• ■  Determine the vulnerabilities of an information system.
• ■  Understand how to conduct a control analysis.
• ■  Understand the likelihood of an event occurring.
• ■  Understand the impact of an event occurring.
• ■  Determine risks.
• ■  Determine risk mitigation solutions.
• ■  Understand the risk management process.
• ■  Understand the elements of a risk assessment report.

12.1  Risk Assessment Overview

The National Institute of Standards and Technology (NIST) ...