Title: Describe the risk assessment process for breaches.
Course: Health Informatics (14157-I) > Section: Exploring Laws and Requirements Regarding Data Breaches

Description should include

- the nature and extent of the protected/PHI involved in the use or disclosure, including the types of identifiers and the likelihood that the PHI could be re-identified
- the unauthorized person who used the PHI or to whom the disclosure was made (e.g., a sibling, a journalist)
- the likelihood that any PHI was actually acquired or viewed (e.g., an audit trail would provide insights)
- the extent to which the risk to the PHI has been mitigated (e.g., promptly changed encryption key).

Teacher Resource: Security Risk Assessment (SRA) Tool (https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool), Office of the National Coordinator for Health Information Technology

Process/Skill Questions:

- What are three ways to ensure PHI is kept safe?
- What are the various types of data protection? How do they work?
- What agencies have developed a risk assessment tool?
- How can HealthIT.gov’s SRA Tool assist with a case scenario? Is the tool user-friendly?
- Does HealthIT.gov’s SRA Tool provide assessment at all levels of the organization? Did it assess potential solutions for now and in the future to decrease threats?