A Security Risk Assessment Guide for Adolescent and Young Adult Oncology Programs

A security risk assessment helps an adolescent and young adult (AYA) oncology program identify threats to patient safety, privacy, and the availability of care. It should consider both the program’s physical environment and the systems that create, receive, maintain, or transmit protected health information (PHI).

The HIPAA Security Rule requires covered entities and business associates to assess risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), then implement reasonable and appropriate safeguards. Use the assessment to guide decisions—not as a one-time checklist or a guarantee of compliance. See HHS guidance on risk analysis.

Which security risks are unique to adolescent and young adult oncology programs?

AYA oncology programs serve patients whose care may involve parents or other caregivers, while also supporting patients’ growing independence and, for adults, their authority over their own health information. The applicable privacy and personal-representative rules depend on the patient’s age, state law, and circumstances. HHS explains these considerations in its guidance on parents and minors under the HIPAA Privacy Rule.

Assess how those changing relationships affect access to records and communications. For example, a caregiver may need information to support treatment, but a patient may also expect some communications or records to remain confidential where applicable law permits. Review proxy portal access, appointment reminders, voicemail, bedside conversations, printed materials, and how staff verify a person’s authority before sharing information.

Consider whether the assessment covers the information and workflows common in oncology care, such as diagnoses, treatment plans, infusion schedules, clinical-trial participation, genetic information, and behavioral or reproductive health details that may arise during care. These are not automatically subject to different HIPAA protections because a patient is young; they are areas where a privacy lapse may be especially harmful.

Also account for the care environment: frequent visits, infusion and procedure areas, shared workstations, medication handling, and coordination among oncology teams and outside providers. Include risks to continuity of treatment if a system outage, facility disruption, or security incident interferes with care.

How should a program assess physical safety and access controls?

Map the spaces where patients, visitors, staff, records, and devices move through the program. Depending on the setting, this may include reception and waiting areas, exam rooms, infusion spaces, medication storage, staff work areas, records storage, and rooms that house information systems.

Review physical access control systems such as badges, keys, visitor procedures, door alarms, and access logs. Check whether access is limited to authorized people, whether badges and keys are promptly recovered when access is no longer needed, and whether staff have a clear way to report lost credentials or suspicious activity. HHS describes the Security Rule’s facility-access standard in its guidance on facility access controls.

Walk through the program during normal operations and, where relevant, after hours. Look for unsecured workstations, unattended paper records, visible patient information, opportunities for tailgating through controlled doors, and visitor movement into restricted areas. Consider how staff can summon help, manage a disruptive or threatening situation, and maintain patient care during an evacuation or other emergency.

Check that physical safeguards protect systems and devices as well as people. Consider equipment in public or shared areas, laptops and portable media, backup storage, and the rooms or cabinets where network and clinical systems are kept. Document what safeguards exist, how they work in practice, and any gaps that need follow-up.

What patient privacy and confidentiality risks should be evaluated?

Identify where PHI is discussed, displayed, recorded, stored, and shared. Include conversations at reception or in hallways; printed schedules and labels; phone calls and messages; patient portals; email and other electronic communications; and disclosures to family members, caregivers, or other providers.

Review how staff confirm a patient’s identity and determine whether a person may receive information or access a record. For minors, do not assume that a parent’s access is always the same across all services or circumstances. HHS explains that the Privacy Rule generally treats a parent as a minor’s personal representative, subject to exceptions and applicable state or other law; see HHS guidance on disclosures to parents of teens.

Assess portal proxies and other role-based access control arrangements for patients, parents, caregivers, and staff. Check how permissions are granted, reviewed, changed, and removed as a patient’s circumstances change, including when a patient reaches the age of majority or changes who is involved in their care. Confirm that workflows prevent staff from relying on outdated access approvals.

Evaluate whether staff understand privacy procedures for shared spaces and sensitive conversations. Practical checks include screen positioning, automatic session locking, identity verification before discussing care by phone, secure handling of printed documents, and safeguards against sending information to an outdated or incorrect contact.

How can staff assess cybersecurity and health information system vulnerabilities?

Start with an inventory of systems and devices that create, receive, maintain, or transmit ePHI. Include the electronic health record (EHR), patient portals, scheduling and billing systems, email, mobile devices, networked clinical equipment, backups, and relevant vendor services. HHS risk-analysis guidance emphasizes identifying where ePHI is stored, received, maintained, or transmitted and assessing potential threats and vulnerabilities.

Review user accounts and permissions, including how accounts are created, changed, and disabled. Role-based access control can help align a user’s access with job responsibilities, but it should be checked against actual workflows so that users do not retain unnecessary access. Assess authentication, remote access, device protections, data transmission, backup practices, and the processes used to patch and update systems.

Review electronic health record audit logs and other system activity records. Determine whether the program can identify unusual access, such as repeated failed logins, access by former staff, or record activity that does not fit a user’s responsibilities. Confirm who reviews alerts, how concerns are escalated, and how the team documents its response.

Assess vulnerability management processes: how the organization identifies, evaluates, prioritizes, tests, and addresses software and configuration weaknesses. Coordinate testing with information technology, security, and clinical engineering teams so scans or changes do not disrupt treatment or connected clinical equipment. Review vendor and cloud-service arrangements, including whether relevant agreements and safeguards address the vendor’s handling of PHI.

Use an incident response plan that explains how to identify, contain, report, investigate, and recover from suspected incidents while preserving evidence and supporting clinical operations. The NIST Cybersecurity Framework 2.0 offers a voluntary structure for organizing cybersecurity risk-management activities; it does not replace HIPAA requirements.

What practical steps help prioritize and mitigate identified risks?

Record each risk in a format staff can act on. Include the affected location, workflow, system, or information; the relevant threat and vulnerability; existing safeguards; potential impact; likelihood; and the person responsible for follow-up. HHS describes risk as involving both the likelihood of a threat exploiting a vulnerability and the impact that could result.

Prioritize risks that could seriously affect patient safety, interrupt time-sensitive treatment, expose sensitive information, or compromise systems used across the program. Consider how many patients and services could be affected, whether a risk could spread to connected systems, and whether current safeguards are reliable.

Choose mitigations that address the cause of the risk. Depending on the findings, actions might include correcting access permissions, securing a door or workstation, updating software, changing a communication workflow, improving backup arrangements, or clarifying staff procedures. Assign an owner and target date to each action, and document any decision to accept or defer a risk with the rationale and approval.

If a critical risk is identified, promptly notify the designated security and clinical leaders and take proportionate steps to limit exposure or disruption. Coordinate technical containment with the people responsible for patient care so that safeguards do not inadvertently interrupt treatment. Follow the incident response plan when the finding involves a suspected or known security incident; document actions and outcomes. HHS describes security-incident procedures and contingency planning in its summary of the HIPAA Security Rule.

How should programs document findings and review security controls?

Keep an assessment record that explains its scope, methods, participants, systems and locations considered, identified risks, existing controls, prioritization decisions, and mitigation plans. Make the record clear enough that a new reviewer can understand what was assessed, what remains unresolved, and why particular decisions were made.

Track mitigation work to completion and verify whether the change reduced the identified risk. Record evidence of follow-up, such as a permission review, a facility walkthrough, a restored backup test, or confirmation that a vulnerability was addressed. Protect assessment documents themselves because they may describe system weaknesses or sensitive operational details.

Review the assessment when circumstances change—for example, after a security incident, a major system or workflow change, a new vendor arrangement, or a change to the care environment. HHS states that the Security Rule does not set one fixed frequency for risk analysis; organizations should review risks on an ongoing basis and update their safeguards as needed. See HHS guidance on periodic review and updates.

For documentation required by the Security Rule, HHS states that records generally must be retained for six years from their creation or the date they were last in effect, whichever is later. Confirm whether other legal, organizational, or contractual requirements call for a longer period using the HHS Security Rule summary.

What limitations should programs consider when conducting an assessment?

An assessment reflects the information, systems, and conditions reviewed at a particular time. Incomplete inventories, undocumented workflows, staff turnover, new technology, and changing vendor services can leave gaps. Interviews and written policies alone may not show whether a safeguard works as intended in day-to-day care.

Technical testing also has limits. A vulnerability scan may miss weaknesses or flag issues that need investigation, and testing can affect clinical systems if it is not properly planned. Coordinate testing with responsible technical and clinical teams, and use authorized methods that account for patient-care needs.

A risk assessment supports security planning but does not guarantee that an incident will not occur or establish compliance by itself. It should inform continuing risk management, control testing, staff procedures, and incident preparedness. Because privacy obligations can depend on the patient’s circumstances and applicable law, consult the organization’s privacy or legal team when interpreting disclosure and access requirements.

In practice, a useful assessment connects AYA-specific care workflows with physical safeguards, privacy procedures, cybersecurity controls, and clear follow-up responsibilities. Keep it current, address the highest-impact risks first, and check that mitigations protect both patient information and continuity of care.

FAQs

Who should participate in a security risk assessment for an adolescent and young adult oncology program?

Include the program’s clinical and administrative leaders, the privacy officer, the security official, information technology and cybersecurity staff, and people responsible for facilities and clinical engineering. Involve staff who understand patient registration, portal access, infusion and treatment workflows, records management, and emergency response. Include relevant vendors or business associates when their services affect the systems or PHI being assessed.

How often should the program review and update its security risk assessment?

HIPAA does not specify one fixed schedule for conducting risk analysis. Review risks on an ongoing basis, periodically evaluate controls, and reassess when incidents, technology, vendors, staffing, or operations change. HHS discusses this flexible approach in its risk-analysis guidance.

Which patient information requires protection during oncology care?

Protect PHI handled by the program, including identifying and contact information, diagnoses, treatment and medication details, appointment and infusion schedules, laboratory and imaging results, and billing information. Protect sensitive details that may arise in care, such as genetic, behavioral, or reproductive health information, as applicable. The HIPAA Security Rule specifically requires safeguards for ePHI; other HIPAA Privacy Rule requirements and applicable laws may also govern PHI in other forms.

What should the program do after identifying a critical security risk?

Promptly notify the designated security, privacy, and clinical leaders. Take appropriate steps to reduce immediate risk while maintaining safe patient care, and use the incident response plan if the finding involves a suspected or known incident. Assign an accountable owner, document decisions and actions, and verify that the mitigation worked.