Fetal Alcohol Spectrum Disorder Clinic Security Risk Assessment Guide

A security risk assessment helps a fetal alcohol spectrum disorder (FASD) clinic identify how electronic protected health information (ePHI) could be exposed, changed, lost, or made unavailable—and decide what to do about it. If your clinic is subject to the HIPAA Security Rule, its risk analysis must be accurate, thorough, and appropriate to its environment; it is the starting point for selecting safeguards, not a one-time checklist. See the HHS guidance on HIPAA Security Rule risk analysis.

How to assess security risks in a fetal alcohol spectrum disorder clinic

Start by defining the assessment’s scope. Identify the clinic locations, services, workforce members, vendors, devices, systems, and workflows that create, receive, maintain, or transmit ePHI. For an FASD clinic, that may include intake and developmental history, evaluations, care plans, referrals, billing, appointment reminders, telehealth, and communications with caregivers or other providers.

Map where information moves: from a patient or caregiver to intake staff, clinicians, scheduling and billing systems, external laboratories or service providers, and the medical record. Include paper-to-digital processes and remote access, not only the clinic’s main electronic health record. HHS recommends identifying relevant systems and applications and assessing threats, vulnerabilities, and existing safeguards.

For each workflow, consider reasonably anticipated human, natural, and environmental threats. Examples include a misdirected message, inappropriate staff access, stolen devices, phishing, system failure, fire, flood, or a power outage. Estimate the likelihood and potential impact on ePHI confidentiality, integrity, and availability, then record existing protections and gaps. HHS describes these elements in its risk analysis guidance and examples of threats to consider.

Review the assessment when meaningful changes occur, such as adopting a new clinical system, changing vendors, moving locations, experiencing an incident, or changing how staff work. HHS says risk analysis should be ongoing; the Security Rule does not set one universal schedule for repeating it.

Which patient information and clinic assets require protection

Inventory the ePHI your clinic creates, receives, maintains, or transmits. Depending on your services, this may include identifying and contact information, developmental and medical histories, assessment results, diagnoses, treatment and support plans, referral details, billing records, and communications with families or care partners. Include information stored in email, messaging tools, mobile devices, backups, and vendor systems—not just the main patient record.

Also identify the assets that store, process, transmit, or protect that information:

• Electronic health records, practice-management and billing systems, and clinical assessment applications.
• Workstations, laptops, tablets, phones, printers, removable media, and network equipment.
• Clinic and remote-work networks, email, telehealth platforms, cloud services, and backup systems.
• Paper files, printed schedules, intake forms, storage areas, and rooms where confidential conversations take place.
• Accounts, credentials, encryption keys, system configurations, and vendor services that enable access or recovery.

Record the information’s location, who needs access, how it is shared, and how it is retained or disposed of. The HIPAA Security Rule covers ePHI held by a regulated organization, including information maintained by service providers on its behalf. Confirm whether your clinic is a covered entity or business associate rather than assuming every clinic has the same HIPAA status.

How to document security risks and recommended solutions

Use a consistent risk register or similar record. HIPAA does not require a specific risk-analysis format, but HHS says the analysis must be documented. A useful entry connects a threat and vulnerability to the ePHI or system at risk, explains the likely impact, and identifies how the clinic will respond. See HHS guidance on documenting and conducting risk analysis.

For each risk, record:

• The affected information, system, device, location, or workflow.
• The threat, vulnerability, and existing safeguards.
• The likelihood and potential impact, including effects on confidentiality, integrity, and availability.
• The proposed mitigation, responsible owner, target date, and resources needed.
• The decision to mitigate, accept, transfer, or otherwise manage the risk, with its rationale.
• How the clinic will check whether the solution is implemented and working.

Prioritize risks based on plausible harm and operational importance, not just on how easy a fix is. Track unresolved items and revisit decisions when systems, workflows, threats, or clinic circumstances change. Risk analysis identifies risks; risk management is the process of implementing measures to reduce them.

Administrative safeguards for protecting electronic health information

Administrative safeguards establish how people and the organization manage security. Identify who is responsible for security, define workforce roles, and set access approval, modification, and removal procedures. Review whether staff access matches their job duties, especially when responsibilities change or someone leaves.

Document policies and procedures for security incidents, workforce security, security awareness, information access management, and vendor arrangements. Train workforce members on the clinic’s own policies and the secure handling of ePHI in their roles. A training record can document completion, but it does not by itself establish that the clinic is HIPAA-compliant.

Include contingency planning so the clinic can respond to emergencies that affect systems containing ePHI. Address data backup, disaster recovery, and how essential operations can continue in emergency mode. HHS describes these administrative requirements in its Security Rule administrative safeguards guidance.

Physical safeguards for clinic spaces and records

Assess how people enter the clinic and reach work areas, records, and equipment. facility access controls should account for staff, patients, caregivers, visitors, maintenance personnel, and vendors. Depending on the risks and setting, measures may include staff identification, visitor procedures, restricted areas, locked storage, or staff escorts.

Look for everyday exposure points: screens visible from waiting areas, printers that leave documents unattended, conversations that can be overheard, unlocked rooms, and paper records left in shared spaces. Include device and media controls, such as secure storage and procedures for disposal or reuse. HHS explains the relevant standards—facility access controls, workstation use and security, and device and media controls—in its physical safeguards guidance.

Match safeguards to the clinic layout and workflow. For example, reception staff may need access to scheduling information but not unrestricted access to clinical work areas or records. Review physical access arrangements when the clinic relocates, renovates, changes operating hours, or introduces new equipment.

Technical safeguards against improper access or disclosure

Review the systems and settings that control access to ePHI. Access control policies should define who can sign in, what information each role can access, and how accounts are disabled or changed. Use person-or-entity authentication and consider safeguards such as unique user accounts, secure authentication methods, and automatic logoff where appropriate to the clinic’s environment.

Audit controls should enable the clinic to record and examine activity in systems that contain or use ePHI. Decide who reviews relevant logs, what kinds of activity warrant attention, and how the clinic follows up on unusual access. Also assess measures that protect information from improper alteration or destruction.

Evaluate transmission security for ePHI sent through email, telehealth, portals, or other networks. HHS does not categorically prohibit sending ePHI by email, but the clinic must assess its use and implement appropriate protections against unauthorized access. Encryption is an addressable implementation specification under the Security Rule: addressable does not mean optional without assessment; document whether it is reasonable and appropriate in your circumstances and, if not, what alternative measure is used. See the HHS guidance on email and ePHI and its summary of the HIPAA Security Rule.

How to weigh implementation costs and operational impact

Choose safeguards based on the clinic’s risks, size, capabilities, systems, and operational needs. Compare the expected risk reduction with the cost of purchase, setup, maintenance, staff time, and training. Consider as well whether a safeguard could delay care, complicate approved access, or create a new workaround that increases risk.

Where feasible, start with practical measures that address high-priority gaps—for example, removing unnecessary access, improving account management, securing unattended devices, clarifying visitor procedures, or testing backups. For more complex changes, pilot the workflow, gather feedback from affected staff, and verify that authorized users can still perform their work securely.

Document the reason for each decision, including any chosen alternative to a proposed safeguard. Review the decision after incidents or significant changes and confirm that the selected measures continue to reduce risk. HHS explains that safeguards should be reasonable and appropriate to the organization’s circumstances in its risk analysis guidance.

In summary, an effective FASD clinic assessment connects patient information and clinic assets to real threats, documents risks and mitigation decisions, and uses administrative, physical, and technical safeguards that fit the clinic’s work. Keep the assessment current as systems and operations change, and balance protection with reliable access to care.

FAQs

What should a security risk assessment cover in a fetal alcohol spectrum disorder clinic?

It should cover the ePHI the clinic creates, receives, maintains, or transmits; the systems, devices, locations, workflows, and service providers involved; reasonably anticipated threats and vulnerabilities; existing safeguards; and the likelihood and impact of risks to confidentiality, integrity, and availability. It should also identify and document how the clinic will manage those risks.

How can a clinic document security risks and mitigation plans?

Use a risk register or other consistent format to record the affected information or asset, the threat and vulnerability, existing safeguards, likelihood and impact, proposed mitigation, responsible owner, target date, and follow-up method. Document decisions and revisit them when the clinic’s environment or operations change. HHS does not require a specific format for the risk analysis.

Which safeguards help prevent improper access to electronic protected health information?

Safeguards may include role-based access policies, reliable authentication, account review and removal procedures, audit controls, secure transmission practices, workforce training, physical access controls, and incident-response procedures. The appropriate combination depends on the clinic’s documented risks and circumstances.

How should clinics balance security improvements with cost and operational impact?

Prioritize improvements by the likelihood and potential impact of risks, then consider implementation and ongoing costs, staff workload, and effects on patient care. Document why a safeguard or alternative is appropriate, test significant workflow changes, and reassess the decision when risks or operations change.