A Clinic Guide to Security Risk Assessment for Spontaneous Coronary Artery Dissection Care

SCAD care can involve sensitive patient records moving among clinicians, administrative staff, electronic health record (EHR) systems, imaging platforms, referral partners, and outside service providers. A security risk assessment helps your clinic identify where electronic protected health information (ePHI) is handled, what could put it at risk, and which safeguards need attention.

This guide focuses on the HIPAA Security Rule as currently in effect. It is designed to help SCAD clinics organize an assessment—not to replace legal advice or an assessment tailored to your organization.

What HIPAA security risk assessment requires for SCAD clinics

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of potential risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI. The requirement applies to ePHI your organization creates, receives, maintains, or transmits—not only information stored in the EHR. See the HHS Office for Civil Rights guidance on risk analysis.

A clinic is generally a HIPAA covered entity if it is a health care provider that transmits health information electronically in connection with a standard transaction under HIPAA. A business associate may also have its own Security Rule obligations. Determine your organization’s status rather than assuming that every clinic has the same obligations; HHS explains who is covered in its Summary of the HIPAA Security Rule.

Risk analysis is the process of identifying risks and vulnerabilities and assessing their likelihood and potential impact. Risk management is the follow-through: choosing and implementing measures that reduce identified risks to a reasonable and appropriate level. The HHS explanation of risk analysis and risk management distinguishes these related responsibilities.

The Security Rule is flexible and technology-neutral. Your clinic should consider its size, operations, systems, resources, and risks when deciding which safeguards are reasonable and appropriate. HHS issued a proposal to modify the Security Rule in December 2024; the proposal is not itself a current requirement. Check HHS’s Security Rule proposal fact sheet for its status and distinguish proposed measures from the rule currently in effect.

Which electronic health information and clinic assets should be assessed

Start by mapping how ePHI enters, moves through, and leaves your clinic. Include information on systems and devices your organization uses, regardless of whether they are owned by the clinic or operated by a service provider. HHS’s risk analysis guidance calls for considering all ePHI and its locations, forms, and transmission paths.

Depending on your clinic’s services and workflows, the inventory may include:

• Patient demographics, clinical notes, referrals, appointment details, and billing records.
• SCAD-related records, such as diagnostic reports, imaging or test results, care plans, and follow-up communications, when they contain identifiable health information.
• EHRs, patient portals, secure messaging, email, telehealth platforms, and systems used for scheduling, billing, or document storage.
• Workstations, laptops, phones, tablets, printers, removable media, servers, network equipment, and backup systems that create, store, access, or transmit ePHI.
• Paper-to-digital workflows, including scanning, uploading, sending, and disposing of documents that result in ePHI being stored or transmitted electronically.
• Cloud services and external organizations that create, receive, maintain, or transmit ePHI for your clinic.

For each asset, record its purpose, location, owner or responsible role, users, data handled, connections to other systems, and any relevant service provider. Note where information is stored, who can access it, how it is transmitted, and how it is backed up or recovered. A complete inventory helps prevent the assessment from overlooking less visible devices, shared systems, or vendor-held information.

How to identify threats and vulnerabilities across physical personnel and technology risks

Consider reasonably anticipated threats across your clinic’s people, premises, and technology. A threat is a potential cause of harm; a vulnerability is a weakness that a threat could exploit. HHS recommends documenting threats and vulnerabilities and evaluating how they could affect ePHI.

For a SCAD clinic, examples to consider may include:

• Personnel and process risks: misdirected referrals or messages, inappropriate access, weak account practices, insufficient training, delayed removal of access when roles change, or unclear incident-reporting procedures.
• Physical risks: unattended devices, patient or visitor access to work areas, lost or stolen equipment, visible screens, unsecured records, or environmental events that disrupt the facility or damage equipment.
• Technology risks: phishing, malicious software, unpatched systems, compromised accounts, misconfigured cloud services, insecure remote access, failed backups, or system outages.
• Vendor and connection risks: a service provider’s access to ePHI, unclear incident-notification expectations, weak account controls, or a dependency on an external service that could interrupt access to records.

For each threat-and-vulnerability combination, assess the likelihood of occurrence and the possible impact on confidentiality, integrity, and availability. Consider consequences such as unauthorized disclosure, alteration or loss of records, disruption of clinic operations, and reduced access to information needed for care. HHS describes risk as involving both the likelihood of an event and its potential impact in its risk analysis guidance.

Review the safeguards already in place, too. A policy or technical control may exist on paper but be inconsistently followed, incorrectly configured, or unsuitable for a particular workflow. Record what you verified, what remains uncertain, and what evidence supports the assessment.

What physical administrative and technical safeguards can reduce risk

The Security Rule uses administrative safeguards, physical safeguards, and technical safeguards to protect ePHI. It does not prescribe a single set of technologies for every clinic. Use your assessment results to select and maintain measures that are reasonable and appropriate to your environment. HHS summarizes the safeguard categories in its HIPAA Security Rule overview.

• Administrative safeguards: assign responsibility for security, define access and workforce procedures, train staff on your clinic’s policies, address security incidents, maintain contingency plans, and periodically evaluate whether your measures remain effective.
• Physical safeguards: manage facility access, protect workstations from unauthorized use or viewing, and establish procedures for devices and media, including their handling, reuse, and disposal.
• Technical safeguards: use appropriate access controls and authentication, review system activity, protect information from improper alteration or destruction, and secure electronic transmissions.

Match each safeguard to a documented risk. For example, if unattended workstations create a risk of unauthorized access, consider appropriate screen protections, workstation practices, and access controls. If a backup gap threatens availability, define how important data will be backed up and how the clinic will restore it. If encryption is considered, assess whether it is reasonable and appropriate for the relevant systems and transmissions; HHS explains that encryption is an addressable implementation specification in its encryption FAQ.

Safeguards should work together. A technical control cannot replace clear staff procedures, and written policies alone do not establish that systems are configured and used effectively. Record the actions you choose, who is responsible, and how you will verify that each action reduces the identified risk.

How assessment tools support vendor reviews and report generation

An assessment tool can help your team organize an asset inventory, document threats and vulnerabilities, track risks, and prepare reports. The federal Security Risk Assessment Tool from the Office of the National Coordinator for Health Information Technology is intended to assist health care providers, particularly small and medium-sized practices. Its features and suitability may not fit every organization, so choose a tool and process that match your clinic’s size and complexity.

A tool supports the assessment; it does not perform the clinic’s judgment for you. The federal tool is not required by HIPAA and does not guarantee compliance. Your team still needs to validate its responses, account for local workflows, follow up on identified issues, and keep the assessment current.

Include vendor relationships in your review when a service provider creates, receives, maintains, or transmits ePHI for the clinic. Identify what information the vendor handles, how the service connects to your systems, what access it has, and what would happen if the service were unavailable or compromised. If the vendor is a business associate, the clinic generally needs an appropriate written business associate agreement before allowing it to handle ePHI. HHS describes these requirements in its HIPAA Security Rule overview.

As part of business associate risk management, consider requesting relevant information about safeguards and incident procedures and documenting your review. HIPAA does not expressly require every business associate to provide security documentation or permit a customer audit; HHS explains that customers may seek additional assurances through contracts or other documentation in its FAQ about cloud service provider documentation and audits.

How to document risks planned improvements and assessment reviews

Keep a clear record of how the assessment was conducted and what it found. HHS requires documentation of the risk analysis but does not prescribe one specific format. A useful record can include:

• The assessment date, scope, participants, and method.
• An inventory of ePHI, systems, devices, locations, workflows, and relevant vendors.
• Identified threats, vulnerabilities, existing safeguards, and evidence reviewed.
• The likelihood and potential impact assigned to each risk, with the reason for the rating.
• Planned improvements, accountable roles, priorities, target dates, and progress or completion evidence.
• Risk decisions, including why a measure was selected, deferred, or replaced by an alternative.
• Review dates and changes to the environment that prompted reassessment.

Retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later, and make required documentation available to the people responsible for implementing it. See the HHS summary of documentation requirements.

Risk analysis is an ongoing process, not a one-time exercise. The Security Rule does not specify a universal interval for conducting a new risk analysis. Review risks and safeguards as part of ongoing security management and revisit the assessment when important changes occur—for example, when introducing a new system, changing workflows, experiencing an incident, or identifying a new vulnerability. HHS explains that review frequency depends on the organization’s circumstances in its risk analysis guidance.

In short, an effective SCAD clinic assessment connects ePHI and asset inventories to specific risks, selects safeguards suited to those risks, assigns and tracks improvements, and updates the record as the clinic’s environment changes.

FAQs

Which clinics must conduct a HIPAA security risk assessment?

HIPAA covered entities and business associates must conduct a risk analysis under the Security Rule. A health care provider is generally a covered entity if it transmits health information electronically in connection with a HIPAA-standard transaction. Check your organization’s status and obligations using the HHS overview of the Security Rule.

What should a SCAD clinic include in its security assessment?

Include all ePHI the clinic creates, receives, maintains, or transmits, along with the systems, devices, workflows, locations, people, and vendors involved. Document relevant threats and vulnerabilities, existing safeguards, likelihood and impact, and planned improvements.

How often should a clinic review its security risks?

The Security Rule does not set a universal schedule for risk analysis. The process should be ongoing, with reviews when changes or new risks make an update appropriate. An annual review may suit some clinics, but it is not a universal federal requirement. HHS discusses this flexibility in its risk analysis guidance.

What documentation should clinics retain after an assessment?

Retain the assessment scope and method, ePHI and asset inventory, identified risks, existing safeguards, risk decisions, improvement plans, assigned responsibilities, and evidence of follow-up. Required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later, as explained in the HHS documentation requirements overview.