MetaStar Security Risk Assessments: HIPAA and Meaningful Use.

• Vulnerability identification—Identify system’s weaknesses. • Control analysis—Analyze controls in place to prevent vulnerabilities from being exploited. • Likelihood determination—Determine probability of a vulnerability being exploited. • Impact analysis—Analyze impact on organization should a vulnerability be exploited. • Risk determination—Develop prioritized listing of risks (ie, gaps in compliance), achieved by multiplying likelihood determination by impact analysis. • Control recommendations—Suggest controls for addressing identified risks. • Results documentation—Develop SRA report showing prioritized risks and recommended controls. Any robust assessment of a practice’s compliance with the requirements of the Security Rule should follow this process or something similar.