Software & hardware (“Assets”) used to create, store, and transmit ePHI.

‍

Security Rule policies & procedures to HIPAA’s Administrative, Physical, and Technical safeguards and complete a data flow map of where ePHI is generated, transmitted, and stored.

Natural, human and environmental threats to ePHI being held.

Technical & non-technical vulnerabilities that a threat may take advantage of to gain access to ePHI.

HIPAA Security Officer and select team members to assess how the organization’s Security Rule policies and procedures are operationalized.

Walk-through of the organization’s physical office to access physical security.

Findings of the assessment, a risk score for each Asset, and recommended remediation steps an organization could take to mitigate its risk exposure.