Low-Dose CT Screening Clinic Security Risk Assessment Guide

A security risk assessment helps a low-dose CT screening clinic identify how electronic protected health information (ePHI) could be exposed, altered, lost, or made unavailable—and what safeguards are needed to address those risks. If your clinic is subject to the HIPAA Security Rule, the assessment should reflect your actual equipment, workflows, vendors, and operating environment rather than rely on a generic checklist.

Use this guide to organize the work. It is not a certification or a guarantee of HIPAA compliance; document your findings and use them to guide ongoing risk management.

What does a security risk assessment cover in a low-dose CT clinic?

The assessment covers reasonably anticipated risks and vulnerabilities that could affect the confidentiality, integrity, or availability of ePHI your clinic creates, receives, maintains, or transmits. HHS describes risk analysis as a foundational step in selecting and implementing appropriate safeguards under the HIPAA Security Rule. See the HHS guidance on risk analysis and the Security Management Process regulation, 45 CFR § 164.308.

For a low-dose CT clinic, consider the full imaging and care process: patient scheduling and check-in, identity verification, image acquisition, interpretation, report delivery, billing, follow-up, retention, and eventual disposal of records and media. Identify where ePHI enters each step, which people and systems can access it, and how it moves between the clinic, radiologists, referring providers, and service vendors.

A documented assessment typically records assets and data flows, likely threats and vulnerabilities, safeguards already in place, and the likelihood and potential impact of identified risks. It should also state how the clinic will mitigate, monitor, or otherwise address each material risk. HHS explains the distinction between assessing risk and implementing risk management measures in its risk analysis and risk management FAQ.

Which locations, systems, and devices should be included?

Scope the assessment around every location and system that handles clinic ePHI, including systems hosted by service providers. Include the main clinic, any remote reading or administrative locations, equipment rooms, storage areas, and workflows used for remote support. Physical safeguards apply to systems and facilities that house them whether they are onsite or elsewhere, as explained in HHS guidance on physical safeguards.

Build a CT scanner asset inventory and extend it to associated systems, endpoints, and services. Depending on your setup, review:

• CT scanners, operator consoles, acquisition systems, reconstruction workstations, and local storage.
• PACS, radiology information systems (RIS), image viewers, DICOM routers or gateways, and reporting systems.
• Electronic health record, scheduling, billing, patient portal, and secure messaging systems that handle ePHI.
• Radiologists’ and staff members’ computers, laptops, mobile devices, printers, removable media, and shared workstations.
• Network equipment, wireless access, internet connections, remote-access tools, cloud services, backups, and disaster recovery systems.
• Vendor-managed equipment and connections, including remote maintenance or support pathways, where applicable.

For each asset, record its location, owner or responsible contact, purpose, data handled, network connections, support status, and dependencies. Track devices that are retired, replaced, loaned, or sent for repair as well: stored data and vendor access can remain relevant after a device leaves routine clinical use.

How should you assess CT equipment and electronic protected health information?

Start by mapping how patient information moves from registration through scanning, interpretation, reporting, and delivery. Note where identifiers, images, reports, and other ePHI are created, stored, transmitted, backed up, printed, or removed. Compare the map with system settings and staff workflows so the assessment reflects actual operations, not just written procedures.

Review CT equipment and connected systems for security-relevant configuration and support considerations. Work with qualified IT and imaging-service personnel to examine user accounts, remote access, software updates, logging, backup and restore arrangements, network connections, and how data is cleared from equipment or media before reuse or disposal. Avoid making changes to clinical equipment without appropriate technical and clinical coordination.

Assess potential events such as stolen credentials, unauthorized viewing, malware, improper changes to images or reports, accidental deletion, equipment failure, utility interruption, and loss of network or vendor services. For each scenario, consider the likelihood of occurrence, the scope and sensitivity of affected ePHI, and the effect on clinic operations and patient care. HHS risk analysis guidance calls for identifying where ePHI is stored, received, maintained, or transmitted, along with relevant threats, vulnerabilities, and existing security measures.

Include the clinic’s disaster recovery plan in the review. Check whether backups cover essential imaging and clinical systems, whether restoration responsibilities are assigned, and whether recovery steps are documented and tested in a way appropriate to the clinic. A backup that cannot be restored in practice may not address the availability risk the clinic identified.

What access, network, and physical safeguards should you evaluate?

Evaluate administrative safeguards such as assigned security responsibility, workforce access procedures, security awareness, incident handling, contingency planning, and business associate arrangements. Confirm that written policies match actual workflows and that staff know whom to contact when they suspect a security incident.

Review physical safeguards for rooms, equipment, workstations, and media. Consider access to CT control areas and equipment rooms, screen visibility in shared spaces, unattended workstations, visitor and vendor access, device storage, and secure disposal or reuse of media. HHS summarizes the Security Rule’s facility access, workstation, and device and media control standards in its HIPAA Security Rule overview.

Assess technical safeguards for systems that maintain or transmit ePHI. Check whether access is limited to authorized users and appropriate roles; accounts are removed or changed when workforce duties change; activity is recorded and reviewed; and systems can detect or prevent improper alteration or destruction. Also review authentication, secure transmission, remote access, and the protection of portable devices. The applicable standards are described in 45 CFR § 164.312.

Examine network pathways between the CT scanner, PACS, RIS, EHR, vendor services, and external destinations. Identify unnecessary connections, shared credentials, unsupported equipment, and access routes that are not monitored. Select reasonable and appropriate safeguards based on your organization’s circumstances and identified risks; HHS notes that the Security Rule’s flexibility of approach takes account of factors such as size, capabilities, infrastructure, and risk.

How do you prioritize risks and implement corrective actions?

Use a consistent method to rank each finding by likelihood and potential impact, including effects on patient privacy, image and report integrity, system availability, and clinic operations. Record existing safeguards and any uncertainties in the evidence. A numerical score can help compare findings, but it is a decision aid—not a substitute for documenting why a risk matters and how the clinic will address it.

Create a corrective-action plan that assigns an owner, target date, resources, and a way to verify completion for each action. For example, an action might address a stale account, an unreviewed remote-access pathway, incomplete backup testing, or a gap in staff procedures. Document risks the clinic has not yet resolved, the rationale for the chosen response, and any interim measures. The Security Rule requires risk management as part of the security management process; see 45 CFR § 164.308.

After changes are implemented, check that they work as intended and update relevant documentation, access lists, system records, and response procedures. Coordinate decisions involving CT equipment with clinical and technical stakeholders so security changes do not disrupt safe imaging operations.

When should a clinic reassess its security risks?

HIPAA does not set one universal interval for performing a risk analysis. HHS says the frequency varies with the organization’s circumstances and that the process should be ongoing; periodic reviews and updates should reflect relevant changes in the clinic’s environment and operations. See HHS risk analysis guidance.

Reassess when a change could affect ePHI or its safeguards, such as:

• Installing, replacing, upgrading, or retiring a CT scanner or connected imaging system.
• Changing PACS, RIS, EHR, cloud hosting, backup services, network design, or remote-access arrangements.
• Adding a site, changing ownership or operations, or substantially changing staff roles or responsibilities.
• Experiencing a security incident or identifying a new threat, vulnerability, or control failure.
• Changing a vendor relationship, service contract, or method for exchanging images and reports.

In short, maintain an accurate view of assets and data flows, assess risks across administrative, physical, and technical safeguards, and use documented corrective actions to reduce identified risks. Revisit the assessment periodically and when meaningful changes occur, rather than treating it as a one-time checklist.

FAQs.

How often should a low-dose CT screening clinic conduct a security risk assessment?

HIPAA does not prescribe a single fixed schedule for risk analyses. HHS guidance says frequency varies by organization and circumstances, while the Security Rule calls for periodic evaluation and review as needed. Set a review cadence appropriate to your clinic’s risk and operations, and reassess sooner when a significant change or newly recognized risk could affect ePHI.

What CT imaging systems and devices should be included in the assessment?

Include the CT scanner and console, acquisition and reconstruction workstations, PACS, RIS, image viewers, DICOM routing components, reporting tools, and any storage or backup systems that handle ePHI. Also consider connected staff endpoints, network equipment, removable media, vendor remote-access pathways, and other clinical or administrative systems involved in image or report workflows.

Do security risk assessment tools identify every clinic risk?

No. A tool can help organize questions and document findings, but it cannot automatically account for every local workflow, equipment configuration, vendor arrangement, or vulnerability. Validate its results with staff and technical personnel, review how systems are actually used, and document risks or gaps the tool does not cover.

What changes should trigger a new security risk assessment?

Consider a reassessment when the clinic adds or changes CT or imaging technology, moves or restructures a site, changes its network or remote access, adopts a new vendor or cloud service, or changes how it stores or shares ePHI. A security incident, newly identified vulnerability, or significant change in workforce responsibilities can also warrant a review.