1. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Scott C Pettigrew Practice Consultant Privacy & Security Tools Overview

2. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services The Approach 2 PrepareIdentifyPrioritizeMitigate

3. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 3 PrepareIdentifyPrioritizeMitigate Prepare: Gather the knowledge, organizational information, and expertise to successfully perform a Privacy & Security audit.

4. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Gather Knowledge Research How do the Privacy & Security rules affect your organization? What are the possible implications if a breach occurs? Perform Site Inventory What technology is used in your practice? Do these items transmit, process, or store EPHI? Do you have a set of relevant policies and procedures? Where are they located? When were they last updated? When did you last review with your staff? 4 PrepareIdentifyPrioritizeMitigate

5. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Assemble Your Team Internal Resources Who in your organization has the most knowledge about technology and how it’s used? Provider involvement is critical! External Resources IT Vendor Parent or Affiliate Organization IT Security Staff EHR Vendor Regional Extension Center Security Organizations 5 PrepareIdentifyPrioritizeMitigate

6. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Preparation HIT Security Risk Assessment Questionnaire: Inventory Assets (Preparation) 6 PrepareIdentifyPrioritizeMitigate

7. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 7 PrepareIdentifyPrioritizeMitigate Identify: Assess each functional area and technology resource where EPHI is processed, stored, or transmitted to find areas of vulnerability.

8. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Facility Walkthrough Tools: Identification 8 PrepareIdentifyPrioritizeMitigate

9. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Identification Risk Assessment Questionnaire: Screening Questions (Step 1) 9 PrepareIdentifyPrioritizeMitigate

10. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 10 PrepareIdentifyPrioritizeMitigate Prioritize: Examine each possible vulnerability, honestly rating the current systems’ effectiveness, likelihood of breaches, and the impact a breach would have.

11. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Prioritization Risk Assessment Questionnaire: People & Processes (Step 2a) 11 PrepareIdentifyPrioritizeMitigate

12. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Prioritization Risk Assessment Questionnaire: Technology (Step 2b) 12 PrepareIdentifyPrioritizeMitigate

13. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services 13 PrepareIdentifyPrioritizeMitigate Mitigate: For each identified area of vulnerability, maximize the effectiveness of existing controls, and minimize both the possibility of breach and the extent of damage should an unavoidable breach take place.

14. REC support is. provided under cooperative agreement 90RC0025/01 from the Office of the National Coordinator for HIT, US Dept. of Health and Human Services Tools: Mitigation Risk Assessment Questionnaire: Findings – Remediation (Step 3) 14 PrepareIdentifyPrioritizeMitigate