A Security Risk Assessment Guide for Conservative Kidney Management Clinics

A conservative kidney management clinic relies on connected systems and coordinated teams to support patients who choose kidney care without dialysis. A security risk assessment helps you identify where electronic protected health information (ePHI) is created, received, maintained, or transmitted; what could put it at risk; and what safeguards can reduce that risk.

If your clinic is a HIPAA covered entity or business associate, the HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. The process should reflect your clinic’s actual care, technology, staffing, and vendor relationships—not just a checklist. HHS Office for Civil Rights guidance on risk analysis explains the scope and ongoing nature of this requirement.

Which systems, devices, staff, and services are in scope?

Start by defining the boundaries of the assessment. Include every location and system that creates, receives, maintains, or transmits the clinic’s ePHI, regardless of whether the information is stored on-site, in a cloud service, on a mobile device, or with a third party. HHS guidance states that the analysis should account for all ePHI, across electronic media and locations.

For a conservative kidney management clinic, the inventory may include:

• Clinical and administrative systems: electronic health records (EHRs), scheduling, patient portals, telehealth, secure messaging, billing, claims, document storage, and identity or access-management tools.
• Interfaces and data exchange: electronic health record interfaces connecting labs, pharmacies, hospitals, health information exchanges, referral partners, and billing services.
• Devices and endpoints: workstations, laptops, phones, tablets, printers, scanners, network equipment, removable media, and any medical or monitoring devices that connect to clinic systems or send patient data to the clinic.
• People and work arrangements: clinicians, care coordinators, billing staff, IT support, temporary staff, contractors, volunteers, and authorized remote workers. Include how accounts are created, changed, and removed.
• External services: cloud hosting, EHR vendors, billing companies, telehealth platforms, managed IT providers, data-storage services, and other third-party service providers that may handle ePHI.
• Physical spaces and records: clinic rooms, reception areas, offices, equipment storage, paper records, and devices used outside the clinic. Paper and verbal information are not ePHI under the Security Rule, but their handling can still create privacy and security risks that a broader clinic assessment should consider.

Confirm the inventory with staff interviews, system and device lists, vendor contracts, network diagrams, and a review of workflows. Mark which systems hold ePHI, who can access it, and which systems depend on each other. If a service provider creates, receives, maintains, or transmits ePHI on the clinic’s behalf, assess the relationship and applicable business associate agreement obligations. HHS guidance on covered entities and business associates explains when a written business associate contract or other arrangement is required.

How do patient information flows across care coordination and billing?

Map information from the moment it enters the clinic through its use, disclosure, storage, and disposal. A data-flow map can show where a weakness in one system, handoff, or vendor relationship could expose information or interrupt care.

Trace representative workflows such as appointment scheduling, referral intake, clinical assessments, medication and symptom documentation, lab-result review, care coordination, patient or caregiver communications, and billing. For each step, record the information involved, the person or system sending it, the recipient, the transmission method, and where a copy is stored.

Pay particular attention to handoffs among clinicians, care coordinators, patients, caregivers, outside specialists, laboratories, pharmacies, insurers, and billing vendors. For example, a clinic may document information in its EHR, send a referral through an interface, discuss follow-up through a patient portal, and submit a claim through a separate service. Confirm that each route is authorized, access is appropriately limited, and transmission and storage safeguards are considered.

Also map exceptions: staff using email or text for work, remote access, downtime procedures, patient-submitted information, shared devices, and data exports. Identify where manual re-entry can introduce errors, where messages could go to the wrong recipient, and what happens if an interface or vendor service is unavailable. A cloud service provider that handles ePHI may be a business associate; the clinic should assess the arrangement and its own responsibilities rather than assuming the provider manages every security risk. HHS guidance on HIPAA and cloud computing describes the role of business associate agreements and shared responsibilities.

Which kidney-clinic assets, threats, and vulnerabilities should be assessed?

For each asset, identify what must be protected and what could go wrong. Consider confidentiality, integrity, and availability: unauthorized disclosure, improper alteration or loss of information, and inability to access information when needed. HHS describes risk analysis as an assessment of risks and vulnerabilities that may affect these three security goals. HHS guidance on risk analysis and risk management provides the distinction between identifying risk and implementing measures to reduce it.

Potential threats include phishing, stolen credentials, ransomware, accidental disclosure, lost or stolen devices, unauthorized access, system outages, power or network failures, fire or water damage, and mistakes in data entry or transmission. Consider vulnerabilities such as shared accounts, excessive access, unsupported software, unpatched devices, weak remote-access controls, inadequate logging, unclear vendor responsibilities, and backups that have not been tested.

Assess medical device cybersecurity where connected devices or monitoring services interact with clinic systems or handle information for the clinic. Determine what data a device collects, where it sends that data, who can access it, how updates and support are managed, and what clinical or operational workarounds exist if the device or connection fails. The FDA’s medical device cybersecurity resources describe cybersecurity considerations for manufacturers and healthcare delivery organizations, including the importance of safeguards and mitigations.

Include third-party service provider risk in the assessment. Review the services and data involved, access methods, contract and business associate agreement terms where applicable, subcontractors, incident notification arrangements, data return or destruction processes, and the clinic’s ability to maintain operations if the service is disrupted. A vendor’s assurances or security documentation can inform your assessment, but they do not replace the clinic’s own review.

How should likelihood, impact, and existing safeguards be evaluated?

Use a consistent method to estimate how likely each threat is to exploit a vulnerability and how serious the resulting impact could be. HHS does not prescribe one scoring formula, so document the method you choose and apply it consistently. The HHS risk analysis guidance discusses considering both the likelihood of an event and its impact on ePHI.

A simple approach is to rate likelihood and impact as low, moderate, or high, then use a defined matrix to assign an overall risk level. Explain what each rating means in your clinic. For impact, consider potential effects on patient privacy, the accuracy and availability of records, care coordination, billing, clinic operations, and recovery effort. Avoid treating a numerical score as a substitute for judgment: a risk affecting a critical workflow may deserve attention even if its estimated likelihood is low.

Record safeguards that already exist and assess whether they work in practice. These may include administrative, physical, and technical safeguards such as workforce procedures, role-based access, unique user accounts, authentication, audit logging, secure device storage, facility access controls, and staff training. Note evidence rather than assuming a control is effective because it appears in a policy: review configurations, access lists, logs, training records, vendor documentation, and test results where appropriate.

Document residual risk—the risk that remains after current safeguards are considered—and decide whether additional action is needed. The HIPAA Security Rule requires reasonable and appropriate safeguards, taking account of the organization’s circumstances and identified risks; it does not mandate a single technology or scoring system for every clinic. HHS’s Summary of the HIPAA Security Rule describes this flexible, risk-based approach.

What security risks commonly affect conservative kidney management clinics?

Each clinic’s risk profile is different, but several scenarios are useful to test against your systems and workflows:

• Account compromise or phishing: A staff member’s credentials are stolen and used to access the EHR, email, patient portal, or billing service.
• Misrouted information: A referral, lab result, or billing document is sent to the wrong recipient or attached to the wrong patient record.
• Interface failure or data mismatch: An electronic health record interface stops transmitting information, duplicates a record, or transfers incomplete data without an alert that reaches the right staff.
• Remote access exposure: A lost device, weak authentication, insecure network, or poorly controlled remote connection exposes ePHI.
• Service-provider disruption: An EHR, cloud, telehealth, billing, or managed IT provider experiences an outage or security incident, limiting access to records or disrupting workflows.
• Medical device or monitoring risk: A connected device, mobile application, or data-transfer service has an unaddressed vulnerability, unclear update process, or failure that interrupts data availability.
• Ransomware or destructive malware: Systems or backups become inaccessible, disrupting record access and clinic operations. HHS notes that contingency planning and data backup are important parts of responding to ransomware and other emergencies. HHS’s Ransomware and HIPAA fact sheet summarizes relevant Security Rule considerations.
• Physical or environmental event: Theft, fire, water damage, or a power failure affects equipment, records, or access to essential systems.

These are assessment scenarios, not a claim that every clinic experiences them. Tailor them to your technology, location, staffing, patient communication methods, vendors, and actual incident history.

How should findings, remediation owners, and response plans be documented?

Maintain a risk register that links each finding to the relevant asset, workflow, threat, vulnerability, and existing safeguard. The HIPAA Security Rule requires risk-analysis documentation but does not require a specific format. HHS explains that the results should inform the clinic’s risk-management process. HHS guidance on risk analysis describes documenting risk levels and corrective actions.

For each entry, record:

• The system, device, location, workflow, or service involved, and whether it handles ePHI.
• The threat, vulnerability, and plausible effect on confidentiality, integrity, or availability.
• The likelihood, impact, overall risk rating, scoring method, and evidence supporting the assessment.
• Existing safeguards, gaps, and the residual risk after current safeguards are considered.
• The selected response—mitigate, transfer, avoid, or formally accept the risk—and the rationale.
• A specific corrective action, accountable owner, target date, status, and evidence needed to verify completion.
• The approval and review date, plus any event or change that should trigger reassessment.

Connect the register to incident response and backup testing. Define who receives an incident report, who can isolate affected systems, how the clinic will coordinate with vendors, and how staff will continue critical work during downtime. Test that backups can be restored and that procedures work for the systems and information the clinic depends on. HIPAA’s contingency-plan requirements include a data backup plan, disaster recovery plan, and emergency mode operation plan; the clinic should also review and test its arrangements as appropriate to its circumstances. HHS guidance on ransomware and contingency planning provides further detail.

Review the assessment when meaningful changes occur, such as a new EHR interface, monitoring service, location, vendor, remote-work arrangement, or security incident. HHS describes risk analysis as an ongoing process and notes that the Security Rule does not set one universal frequency for reassessment. HHS’s risk analysis guidance explains that reviews should reflect changing circumstances.

Can a healthcare security assessment tool establish compliance?

No. A healthcare security assessment tool can help organize questions, identify gaps, and document work, but completing one does not by itself establish HIPAA compliance. The HHS Security Risk Assessment Tool is designed to support risk analysis; its completion does not guarantee compliance with the HIPAA Security Rule or other laws. The official HealthIT.gov Security Risk Assessment Tool page states these limitations.

Use a tool as one part of a clinic-specific process. You still need to identify all relevant ePHI, evaluate actual threats and vulnerabilities, implement reasonable and appropriate safeguards, document decisions, and revisit the assessment as the environment changes. HHS also states that the Security Rule does not require organizations to obtain a private certification, and that a private certification does not remove an organization’s legal obligations. HHS guidance on Security Rule certification explains this distinction.

In short, a useful assessment is specific to your clinic, covers the full flow of ePHI, assigns owners to corrective actions, and is updated as systems and services change. A tool can support that work, but the clinic remains responsible for its risk-management decisions and safeguards.

FAQs

Which systems and devices should a conservative kidney management clinic include in its security risk assessment?

Include every system, device, service, and location that creates, receives, maintains, or transmits the clinic’s ePHI. This commonly includes the EHR and interfaces, scheduling, telehealth, patient communications, billing, workstations, mobile devices, connected monitoring devices, cloud services, vendor systems, and remote-access tools. Also identify the staff and contractors who use them and the workflows that connect them.

How should a clinic assess risks from remote monitoring and connected medical devices?

Map what information each device or service collects, where it is sent and stored, who can access it, and how the clinic or vendor manages accounts, updates, support, and security incidents. Assess vulnerabilities, data availability, interfaces, and the effect of a device or connection failure on clinic workflows. Include vendor responsibilities and any applicable business associate agreement, and consider FDA medical device cybersecurity resources where relevant.

What should a clinic document in its risk register?

Document the affected asset and workflow, the threat and vulnerability, potential impact, likelihood and risk rating, existing safeguards, residual risk, chosen response, corrective action, accountable owner, target date, status, and review or approval. Record the scoring method and supporting evidence, and update entries when remediation is completed or relevant systems and circumstances change.

Does using a healthcare security assessment tool establish HIPAA compliance?

No. A tool can guide and document part of a risk analysis, but using or completing it does not guarantee compliance or replace the clinic’s responsibility to assess its own environment, implement appropriate safeguards, and maintain required documentation. HHS does not require a private HIPAA compliance certification, and a certification does not absolve an organization of its obligations.