Clinical and Translational Science Institute Security Risk Assessment Guide

What does a security risk assessment cover at a clinical and translational science institute?

A security risk assessment helps you identify what information and systems need protection, how they could be exposed to threats, and whether existing safeguards reduce those risks appropriately. For a clinical and translational science institute (CTSI), the scope may include clinical research operations, laboratories, data coordinating centers, shared research services, administrative systems, and institutional technology used by study teams.

If your organization is a HIPAA covered entity or business associate, its HIPAA Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (ePHI) it creates, receives, maintains, or transmits. HIPAA does not apply to every institute or every research dataset in the same way, so determine the organization’s role and the data involved before defining regulatory scope.

Beyond ePHI, institutional information security controls and research policies may require you to assess other sensitive information, such as identifiable research data, proprietary methods, credentials, and systems essential to study operations. Document which requirements apply and distinguish regulatory obligations from institutional or sponsor expectations.

How should research systems and sensitive data be inventoried?

Build an inventory that connects information to the systems, people, and services that handle it. Include systems that create, receive, store, use, transmit, or back up sensitive information—not only centrally managed applications, but also approved departmental tools, devices, and research workflows.

For each system or dataset, record its owner, purpose, location, users, data flows, storage and backup arrangements, connected services, and applicable security or contractual requirements. Include relevant lifecycle stages, such as collection, analysis, sharing, retention, archival, and deletion.

Use a consistent research data classification scheme to describe sensitivity and impact. For example, distinguish public data from internal data, confidential or proprietary research, identifiable participant information, and ePHI. Classification should guide handling, access, sharing, and retention decisions; it does not by itself establish whether HIPAA applies.

HHS explains that a risk analysis may include taking inventory of systems and applications used to access and house ePHI and classifying them by risk. Its risk analysis guidance also calls for identifying ePHI and external sources, including vendors or consultants that handle it.

How can teams identify and prioritize security risks?

For each system and data flow, identify plausible threats, vulnerabilities, existing safeguards, and the potential effects of a security event. Consider accidental disclosure, inappropriate access, compromised accounts, malicious software, device loss, service outages, misconfiguration, and failures in backup or recovery. Include risks to data confidentiality, integrity, and availability.

Assess how likely a scenario is and how serious its consequences could be for research participants, study integrity, institutional operations, and applicable obligations. A consistent rating method—such as likelihood and impact levels—can help teams compare risks, but HIPAA does not prescribe a specific scoring formula. NIST SP 800-30 provides guidance on conducting risk assessments; organizations can adapt its approach to their needs.

Prioritize risks that could cause severe harm, disrupt critical research, expose sensitive information, or affect many systems or participants. Record the rationale for each rating, the controls already in place, any uncertainty, and the owner responsible for deciding whether to mitigate, accept, transfer, or avoid the risk. For HIPAA-regulated ePHI, the organization must implement security measures sufficient to reduce identified risks and vulnerabilities to a reasonable and appropriate level, as described in HHS guidance.

What safeguards protect clinical and research data?

Select safeguards based on the data, systems, threats, and operational needs identified in the assessment. Administrative measures may include security policies, workforce training, assigned responsibilities, contingency procedures, and incident response planning. Physical protections may include controlled facility access and secure handling of devices and media.

Technical safeguards can include unique user accounts, strong authentication, role-based access, encryption where appropriate, secure transmission, logging, monitoring, patching, and tested backups. An access control review can confirm that permissions match current roles and study responsibilities, and that access is removed or changed when people transfer, leave, or no longer need it.

For ePHI, HIPAA requires covered entities and business associates to use appropriate administrative, physical, and technical safeguards. The requirements are risk-based; do not assume that a particular technology alone establishes compliance. For example, HHS notes that encryption does not by itself address all confidentiality, integrity, and availability risks in its HIPAA and cloud computing guidance.

Align incident response planning with institutional procedures and applicable requirements. Define how teams report, assess, contain, and recover from incidents, and how they preserve relevant records and escalate matters to the appropriate privacy, security, research, and institutional officials.

How should third-party and cloud service risks be assessed?

Maintain an inventory of vendors and other external parties that can access, store, process, or transmit sensitive research or clinical information. A vendor security assessment should consider the service’s data access, hosting and support arrangements, security practices, incident notification, backup and recovery, subcontractors, data retention, and secure return or deletion at the end of the relationship.

Review contracts and responsibilities alongside technical safeguards. If a cloud service provider creates, receives, maintains, or transmits ePHI on behalf of a HIPAA covered entity or business associate, the provider may be a business associate and a HIPAA-compliant business associate agreement may be required. HHS explains that this can apply even when the provider maintains only encrypted ePHI and does not hold the decryption key. See HHS guidance on HIPAA and cloud computing.

Confirm how the institution and provider divide security responsibilities, including identity and access management, logging, encryption, vulnerability management, incident response, and recovery. A contract or vendor assurance document does not replace the institution’s assessment of its own risks and controls.

What evidence and documentation should an assessment produce?

Keep a record of the assessment’s scope, methodology, date, participants, systems and data reviewed, information sources, assumptions, and limitations. Include the identified threats and vulnerabilities, existing safeguards, likelihood and impact rationale, risk ratings, and decisions about how each risk will be handled.

Maintain an actionable risk register with a responsible owner, planned actions, target dates, status, and any accepted residual risk. Link findings to supporting evidence where appropriate, such as system inventories, access control review results, policies, vendor agreements, incident response plans, test results, and remediation records.

For HIPAA-regulated organizations, HHS states that the risk analysis must be documented but does not require a specific format. The documentation should support risk management and show how the organization addresses identified risks. The HHS OCR audit protocol identifies evidence reviewers may examine, including assessment scope, threats and vulnerabilities, existing measures, impact and likelihood, and risk ratings.

When should the assessment be reviewed or updated?

Review the assessment when material changes could affect risk, such as a new study or technology, a change in data use or sharing, a new vendor, a system migration, a significant security incident, or changes to research operations or responsibilities. Also reassess when monitoring, audits, or newly identified vulnerabilities show that existing safeguards may no longer be adequate.

For HIPAA-regulated organizations, the Security Rule requires ongoing attention to risk and review of documentation, but it does not specify one fixed interval for a comprehensive risk analysis. HHS advises that the process should be ongoing and that organizations should update security measures as needed. See HHS guidance on periodic review and updates.

Set a review cadence that fits your institute’s environment and risk, while triggering additional reviews when significant changes occur. In summary, an effective assessment connects classified data and inventoried systems to prioritized risks, documented safeguards, accountable remediation, and continuing review.

FAQs.

Who should participate in a clinical and translational science institute security risk assessment?

Include the people who understand the data, systems, and operational risks: information security and IT staff, privacy and compliance personnel, research administrators, principal investigators or study teams, data stewards, and relevant clinical, laboratory, and institutional system owners. Involve procurement, legal, or vendor-management staff when contracts and external services are in scope. The exact group depends on the assessment’s scope and the institute’s responsibilities.

How often should the assessment be updated?

There is no single fixed HIPAA interval for a comprehensive risk analysis. Review it on a cadence suited to your environment and update it when meaningful changes, incidents, or newly identified risks could affect protection. HHS describes risk analysis as an ongoing process and expects security measures to be reviewed and updated as needed.

Which research systems and data should be included?

Include systems and workflows that create, receive, store, use, transmit, or back up the sensitive information covered by your assessment. This may include research applications, clinical systems, laboratory platforms, data repositories, collaboration tools, endpoints, backups, and vendor or cloud services. Identify ePHI wherever it is handled if the HIPAA Security Rule applies, and include other sensitive information required by institutional policy or contractual obligations.

How should identified security risks be prioritized?

Use a consistent, documented approach to assess likelihood and impact, taking account of participant privacy, data integrity, research continuity, institutional operations, and applicable obligations. Address high-impact risks and risks to critical systems promptly, assign owners and actions, and document the rationale for decisions, including any accepted residual risk.