Functional Neurological Disorder Clinic Security Risk Assessment Checklist

A security risk assessment helps an FND clinic identify where electronic protected health information (ePHI) is handled, what could put it at risk, and what safeguards or corrective actions are needed. If your clinic is a HIPAA covered entity or business associate, its HIPAA Security Rule risk analysis must be accurate and thorough and address risks to ePHI’s confidentiality, integrity, and availability.

What systems, locations, and workflows are within the assessment scope?

Define the assessment boundary before reviewing safeguards. Include every location, system, device, process, and outside service that creates, receives, maintains, or transmits ePHI—not only the electronic health record. HHS guidance says the analysis should consider ePHI regardless of its medium, source, or location. See the HHS guidance on risk analysis and management.

• Clinical workflows: intake, scheduling, assessments, progress notes, care coordination, referrals, patient messaging, telehealth, and release of records.
• Systems and devices: electronic health records, billing and scheduling software, email, patient portals, phones, tablets, workstations, printers, removable media, and backup systems.
• Locations: reception and treatment areas, records or equipment storage, staff workspaces, remote-work settings, and any other place where staff access ePHI.
• People and services: clinicians, administrative staff, contractors, IT support, cloud services, and other vendors that may handle ePHI.
• Dependencies: internet, power, communications, and services needed to access records or continue essential clinic operations.

Record what is included, what is excluded, and why. Revisit the scope if a new service, location, system, or workflow changes how the clinic handles ePHI.

How should the clinic inventory ePHI assets and map data flows?

Build an inventory that shows what ePHI the clinic holds, where it resides, who uses it, and how it moves. HHS identifies inventorying systems and applications and documenting where ePHI is stored, received, maintained, or transmitted as useful parts of a risk analysis. See the HHS risk analysis guidance.

• List each application, device, database, storage location, backup, and paper-to-electronic process that involves ePHI.
• For each asset, record its owner, purpose, location, users, data types, and importance to clinical and administrative operations.
• Map how information moves—for example, from patient intake to the clinical record, billing, a referral, or a telehealth service.
• Identify external services and vendors that create, receive, maintain, or transmit ePHI for the clinic.
• Note whether the inventory is confirmed by system records, staff interviews, vendor information, or another source, and flag information that still needs verification.

For each outside service, check whether the relationship requires a business associate agreement. HHS explains that business associate agreements are required for covered business associate relationships involving PHI, subject to applicable exceptions. Consult the HHS guidance on business associates.

Which threats and vulnerabilities should the clinic assess?

Assess reasonably anticipated threats alongside vulnerabilities that could allow a threat to affect ePHI. Consider accidental, intentional, environmental, and natural events, and tailor the assessment to the clinic’s actual systems, locations, and workflows. HHS describes threats such as human actions, natural events, and environmental conditions in its guidance on examples of threats.

• People and process: misdirected messages, mistakes in data entry, inappropriate access, weak staff offboarding, lost devices, and inadequate training or procedures.
• Cybersecurity: phishing, stolen credentials, malware, exploitation of unpatched systems, insecure remote access, and inappropriate disclosure through messaging or file sharing.
• Physical security: theft or loss of devices, unauthorized entry to work areas, exposed screens or printouts, and improper disposal or reuse of media.
• Service and infrastructure disruptions: outages, failed backups, unavailable vendors, power loss, fire, flooding, or other events that interrupt access to ePHI.
• System weaknesses: shared accounts, excessive permissions, unsupported software, missing audit records, insecure configurations, and untested recovery procedures.

Document the affected asset, the relevant threat and vulnerability, existing safeguards, and the possible effect on ePHI’s confidentiality, integrity, or availability. Avoid relying on a generic threat list without checking whether each item applies to the clinic.

How can administrative, physical, and technical safeguards be evaluated?

Compare safeguards already in place with the risks and vulnerabilities identified. The Security Rule requires appropriate safeguards, while allowing organizations to consider factors such as their size, capabilities, infrastructure, costs, and the probability and criticality of risks. Review the current HIPAA Security Rule requirements and document how each safeguard is implemented or addressed.

• Administrative safeguards: check assigned security responsibility, workforce authorization and training, incident procedures, vendor oversight, contingency planning, and documented policies.
• Physical safeguards: check facility access, visitor handling, workstation placement, device security, media handling, and secure disposal.
• Technical safeguards: check unique user identification, access permissions, emergency access, audit controls, authentication, integrity protections, and transmission security.
• Contingency planning: check whether the clinic can retrieve backed-up ePHI, restore lost data, and continue critical operations during an emergency.

Do not treat every addressable implementation specification as an automatic requirement to use one particular technology. Evaluate whether it is reasonable and appropriate in the clinic’s environment; document the decision and, where required, any reasonable and appropriate alternative measure. HHS explains this approach in its Security Rule guidance materials.

How should likelihood and impact guide risk prioritization?

Estimate how likely each threat is to exploit a vulnerability and how serious the resulting harm could be. Consider effects on confidentiality, integrity, and availability, including disruption to patient care, loss or corruption of records, and the time needed to recover. HHS describes risk analysis as considering risks, vulnerabilities, and likelihood, and notes that risk decisions depend on the probability and likely impact of threats. See the HHS explanation of risk analysis and risk management.

• Use a consistent scale, such as low, moderate, or high, and define what each level means for the clinic.
• Consider existing safeguards when estimating likelihood, but verify that the safeguards are actually operating.
• Give higher priority to risks that are both plausible and capable of significantly affecting ePHI or essential clinical operations.
• Record the reasoning behind ratings so staff can understand and update them as circumstances change.

The HIPAA Security Rule does not prescribe one universal scoring formula. Use a method that fits the clinic, apply it consistently, and document why a risk receives its priority.

How should access controls and remediation actions be documented?

Document who is authorized to access each system and why, and compare actual permissions with job responsibilities. Role-based access control can help organize permissions by function, but it is a method for implementing access decisions—not a phrase that replaces the Security Rule’s requirements. Review account approvals, changes, and removals, and use unique user identifiers where required.

Evaluate audit controls to confirm that system activity involving ePHI is recorded and examined. The rule requires mechanisms to record and examine activity in information systems that contain or use ePHI. Refer to the Security Rule’s technical safeguard provisions.

Maintain a risk treatment register that connects each finding to an action. For each item, record:

• The affected system, workflow, or location and a clear description of the risk.
• Likelihood, impact, priority, and the evidence supporting those ratings.
• The chosen response—such as reducing the risk, accepting it with documented rationale, or another appropriate treatment.
• Actions, responsible owner, target date, status, and any dependencies.
• Residual risk after action, supporting evidence, and the date the item was reviewed or closed.

Keep supporting records, including the scope, inventory, data-flow notes, assessment methods, decisions, approvals, and follow-up evidence. HIPAA documentation requirements and retention periods are addressed in the Security Rule.

When should the clinic review and update its risk assessment?

Review the assessment periodically and when environmental or operational changes may affect ePHI security. Examples include adopting a new electronic record or telehealth service, changing vendors, opening a location, changing remote-work practices, responding to an incident, or identifying a new vulnerability. The Security Rule calls for periodic technical and nontechnical evaluations and evaluations in response to relevant changes; it does not set one universal annual interval for every clinic. See the Security Rule evaluation requirement.

Set a review cadence that fits the clinic’s risks, and assign responsibility for monitoring changes between reviews. Recheck whether prior safeguards remain effective, whether remediation actions are complete, and whether any residual risks need a new decision.

In short, a useful clinic assessment connects ePHI assets and workflows to realistic risks, evaluates safeguards, prioritizes documented actions, and is revisited when the clinic’s environment changes.

FAQs.

What should an FND clinic include in its security risk assessment?

Include the clinic’s ePHI systems, devices, locations, data flows, workforce access, vendors, and critical workflows. Assess relevant threats and vulnerabilities, evaluate administrative, physical, and technical safeguards, and document risk ratings, decisions, owners, and remediation steps.

How often should the clinic review its risk register?

Review it periodically and whenever a significant change or new information could affect ePHI security. HIPAA requires periodic evaluation but does not prescribe a single review interval that applies to every clinic; choose and document a cadence suited to your environment.

How should the clinic prioritize identified security risks?

Rate each risk using a consistent method that considers likelihood and potential impact on the confidentiality, integrity, or availability of ePHI. Prioritize significant risks, document the reasoning, and assign actions, owners, and target dates.

When should the clinic reassess after a change to systems or workflows?

Reassess when a change could affect ePHI security—for example, adopting a new system, changing a vendor or data flow, adding a location, or changing how staff access records. Update the affected inventory, risk ratings, safeguards, and remediation actions.