Security Risk Analysis

Why execute Security Risk Assessments (SRA)?

Regulatory Compliance:

• HIPAA/HiTech, PCI, Gramm Leach Bliley Act, Sarbanes Oxley, CobiT etc.
• Required by Business Associate Agreements if you work with Healthcare or PHI (Protected Health Information) by HIPAA
• Required for Meaningful Use Attestation for both Stage 1 and Stage 2
• Required by the General Services Administration (GSA) if you do any government work
• Required if you take or store credit card information (Payment Card Industry/ PCI)
• Required by the Safeguards Rule of the Gramm Leach Bliley Act to protect clients’ financial information
• For publicly traded companies, required to be in the MD&A per the SEC

A Security Risk Assessment can help you develop a roadmap for security for your organization

• To avoid the public relations nightmare and loss of business and credibility that comes with a breach such as the Target breach
• To protect Intellectual property- proprietary business information and trade secrets – yours and your clients
• To avoid the costs of a breech- notification requirements, lost data, organizational downtime, attorney fees, fines and penalties
• To develop on-going training and auditing for your organization

SECURITY AREAS to CONSIDER:

Myths and Facts

The following table addresses common myths about conducting a risk analysis, and provides facts and tips that can help you structure your risk analysis process.

For more information go to: http://www.cms.gov/Regulations-and-Guidance/Legislation/EHRIncentivePrograms

SECURITY RISK ANALYSIS for HEALTHCARE
MYTHS & FACTS: