Adult Day Health Care Program Security Risk Assessment Guide: Step-by-Step Checklist for HIPAA Compliance, Cybersecurity, and Physical Safety

Define Scope and Inventory of ePHI

Start by defining the boundaries of your adult day health care program’s environment and where electronic Protected Health Information (ePHI) is created, received, maintained, or transmitted. Clear scope keeps your assessment focused and defensible for HIPAA compliance.

Inventory checklist

• People and roles: nurses, program aides, therapists, drivers, volunteers, contractors, and any third parties handling ePHI.
• Systems and apps: EHR/EMR, scheduling, billing, pharmacy interfaces, telehealth platforms, email, file shares, cloud storage, texting solutions, and kiosks.
• Devices and media: desktops, laptops, tablets in transportation vans, smartphones, badge printers, scanners, removable media, and medical equipment that stores data.
• Network components: Wi‑Fi, firewalls, switches, routers, VPNs, and internet service providers.
• Facilities and spaces: reception, activity rooms, nurse stations, medication rooms, server/network closets, and off‑site storage.
• Data flows: how ePHI moves between staff, systems, business associates, and payers; include inbound/outbound interfaces and remote access.
• Data lifecycle: creation, access, transmission, storage, archival, and disposal/shredding or secure wipe.

Identify Threats and Vulnerabilities

List credible cybersecurity threats and physical hazards that could affect confidentiality, integrity, and availability of ePHI. Examine both intentional attacks and accidental failures.

Common threats

• Cybersecurity threats: phishing, ransomware, credential theft, data exfiltration, insecure remote access, and exploitation of unpatched software.
• Human factors: improper sharing, weak passwords, lost devices, unauthorized snooping, and inadequate training.
• Environmental and physical events: theft, tailgating, fire, water damage, power loss, and facility emergencies.
• Third‑party risk: vendor outages, misconfigurations, or breaches affecting your data.

Typical vulnerabilities

• Outdated operating systems, end‑of‑life devices, and missing security patches.
• Shared or generic logins; lack of multifactor authentication; over‑privileged accounts.
• Unencrypted laptops or backups; unsecured Wi‑Fi; weak firewall rules.
• Gaps in policies, procedures, workforce training, and incident response readiness.
• Insufficient physical security measures such as unlocked network closets or unmonitored visitor areas.

Assess Current Security Controls

Document what you already have in place and how well those controls reduce risk. Group them into administrative, technical, and physical categories to align with HIPAA’s Security Rule.

Administrative safeguards

• Policies and procedures for access authorization, workforce onboarding/offboarding, device/media handling, and sanctions.
• Business associate agreements, annual training, phishing awareness, and role‑based workforce education.
• Contingency planning: backup, disaster recovery, emergency operations, and periodic testing.

Technical safeguards

• Unique user IDs, least‑privilege, and multifactor authentication on EHR, VPN, and email.
• Encryption in transit and at rest; mobile device management with remote wipe.
• Patch/vulnerability management, EDR/antivirus, email security, and web filtering.
• Audit logging, centralized log review, and integrity controls for critical data.
• Network segmentation, secure Wi‑Fi (e.g., WPA3), and restricted admin privileges.

Physical security measures

• Badges, visitor logs, camera coverage of entrances and network closets, and door alarms.
• Locked server/network rooms, privacy screens, secure print release, and clean‑desk practices.
• Environmental controls: surge protection, UPS/generators, and water/smoke detection.

Rate control effectiveness by coverage, configuration quality, recent test results, and alignment with policy.

Evaluate Likelihood and Impact

Estimate how probable each threat is and how severe the consequences would be if it occurred. Use a simple 1–5 scale for both likelihood and impact, then calculate a risk score (likelihood × impact) to prioritize action.

Factors for likelihood

• Exposure: number of users, external connections, and internet‑facing services.
• Control strength: presence and maturity of relevant safeguards.
• Threat activity: recent phishing attempts, scans, alerts, or regional hazards.

Factors for impact

• Patient care disruption: inability to access records, medication errors, or delayed services.
• Regulatory and financial: investigation, penalties, breach notification, and remediation costs.
• Reputation and trust: stakeholder confidence, referrals, and payer relationships.

Document assumptions and rationale for each rating to make results repeatable and auditable.

Develop Risk Management Plan

Convert prioritized risks into a concrete, time‑bound risk management plan with accountable owners and measurable outcomes.

Treatment options

• Mitigate: add or strengthen administrative safeguards, technical safeguards, or physical controls.
• Transfer: shift residual risk via contracts, cyber insurance, or improved vendor SLAs.
• Avoid: change processes or discontinue a risky service/technology.
• Accept: formally acknowledge low residual risk with leadership approval.

Action plan elements

• Risk description, current controls, target state, and chosen treatment.
• Control tasks with owners, start/end dates, budget, and dependencies.
• Success metrics: phishing fail rate, patching SLAs, MFA coverage, backup restore times, and log review cadence.
• Communication plan for staff, leadership, and business associates.

Implement and Monitor Safeguards

Roll out controls in phases, starting with quick wins that materially cut risk. Use change management to test, approve, and document updates.

High‑value quick wins

• Enforce MFA on email, VPN, and EHR; eliminate shared accounts.
• Patch critical systems; disable unused services; harden endpoints via MDM.
• Encrypt all laptops and backups; verify restore procedures quarterly.
• Segment networks; secure guest Wi‑Fi; apply least‑privilege to admins.

Ongoing monitoring

• Continuous vulnerability scanning and prioritized remediation.
• Centralized log collection with alerting for suspicious activity.
• Regular phishing simulations and role‑based training refreshers.
• Physical rounds to test door locks, cameras, visitor management, and emergency gear.
• Incident response runbooks, tabletop exercises, and post‑incident lessons learned.

Document and Review Assessment

Maintain comprehensive documentation: scope, inventory, data flows, threats, vulnerabilities, control set, risk ratings, treatment decisions, and leadership sign‑off. Good records are essential for HIPAA compliance and operational continuity.

Documentation practices

• Keep a current risk register with version history and evidence (screenshots, configs, training logs).
• Retain required documentation for at least six years or per applicable policy.
• Schedule formal reviews at least annually and whenever technology, vendors, or services change.
• Track progress against the risk management plan and adjust based on monitoring results.

Conclusion

By scoping accurately, analyzing threats, rating risks, and executing a disciplined risk management plan, your adult day health care program can safeguard ePHI, meet HIPAA compliance expectations, and strengthen both cybersecurity and physical safety. Treat the assessment as a living cycle—implement, measure, improve, and repeat.

FAQs.

What is the purpose of a security risk assessment in adult day health care programs?

Its purpose is to identify how ePHI could be exposed or disrupted and to determine the administrative safeguards, technical safeguards, and physical security measures needed to reduce risk to a reasonable and appropriate level while supporting safe, reliable care.

How often should security risk assessments be conducted?

Perform a full assessment at least annually and any time you introduce new systems, vendors, or services, or experience significant changes or incidents. Interim reviews validate progress on the risk management plan and adjust to emerging threats.

What tools can assist with HIPAA security risk assessments?

Helpful tools include asset inventories, data‑flow diagrams, vulnerability scanners, EDR, SIEM/log management, configuration assessment utilities, phishing simulation platforms, backup/restore testing tools, and standardized risk registers or GRC platforms to track findings and remediation.

How do physical safety measures complement cybersecurity in these programs?

Physical controls prevent unauthorized access to systems and spaces, protect devices that store ePHI, and ensure operations continue during emergencies. When combined with technical and administrative safeguards, they create layered defense that reduces both breach likelihood and operational impact.