Specialty-Specific HIPAA Risk Analysis: OB-GYN, Pediatrics and Pain Management

Briefing

HIPAA requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)). HHS guidance does not prescribe a template, and it expects the analysis to reflect the practice's actual systems.

Specialty practices differ in ways that matter. OB-GYN offices store imaging and sensitive reproductive health records. Pediatric offices manage proxy access for parents and guardians that changes as patients age. Pain management practices prescribe controlled substances, and DEA rules in 21 CFR Part 1311 require two-factor authentication to sign electronic prescriptions for them.

A risk analysis that does not name these systems and access patterns cannot show that the related risks were assessed.

What to do

1. Start from an asset inventory: EHR, imaging devices, patient portal, e-prescribing, billing, email, file shares and backups.
2. OB-GYN: assess imaging workstations, image export paths and who can view sensitive records.
3. Pediatrics: document how proxy access is granted, reviewed and changed as patients age.
4. Pain management: assess the EPCS two-factor process, token custody and prescriber offboarding.
5. Rate each risk by likelihood and impact, assign an owner and a remediation date.
6. Repeat the analysis annually and whenever you add a system or change workflows.

How to verify

• Compare the inventory to what your IT provider's monitoring actually sees on the network.
• Sample the portal proxy accounts and confirm each has a documented basis.
• Confirm EPCS access was removed for every prescriber who left in the last year.
• Check that each risk item has an owner and a status.

Sources

• eCFR, 45 CFR 164.308, Administrative safeguards
• HHS, Guidance on Risk Analysis
• eCFR, 21 CFR Part 1311, Requirements for Electronic Orders and Prescriptions
• HHS FAQ, Are we required to certify our organization's compliance with the Security Rule?

Want help putting this in place? Contact Computer Plus.