Lung Cancer Screening Program Security Risk Assessment Checklist

What does a security risk assessment cover in a lung cancer screening program?

A security risk assessment identifies where electronic protected health information (ePHI) is created, received, maintained, or transmitted, then evaluates potential risks to its confidentiality, integrity, and availability. The HIPAA Security Rule risk analysis is required for covered entities and business associates that handle ePHI; the program’s assessment should fit its actual systems, workflows, and operating environment. See HHS guidance on risk analysis.

For a lung cancer screening program, define the scope to include the people, locations, technology, and third parties involved in the screening pathway. Depending on your workflows, that may include scheduling and eligibility records, smoking history, low-dose CT orders and images, radiology reports, follow-up recommendations, referrals, patient communications, billing, and related systems.

• List the systems, applications, devices, and storage locations that hold or access screening-related ePHI.
• Map how information moves among the screening team, radiology, referring clinicians, health records, patient portals, and vendors.
• Include paper records, workstations, mobile devices, removable media, remote access, backups, and cloud services where relevant.
• Identify the workforce roles and external parties that can access or handle the information.

The assessment should also consider existing safeguards and reasonably anticipated threats and vulnerabilities, such as misdirected reports, inappropriate access, lost devices, system outages, ransomware, or failures in backup and recovery. HHS describes the required risk analysis and its key components.

How to identify and document program security risks

Gather information from system inventories, data-flow diagrams, policies, access lists, vendor agreements, incident records, staff interviews, and technical reviews. Validate the information with the people who perform screening, imaging, follow-up, and IT work; outdated diagrams or assumptions can leave important data flows out of scope.

For each risk, document the information or system involved, the relevant threat and vulnerability, existing safeguards, and how an incident could affect screening operations or ePHI. For example, a delayed recovery of imaging records could interrupt follow-up, while an incorrect access assignment could expose records to a person without a work-related need.

• Asset or workflow: Name the record type, application, device, or process.
• Threat and vulnerability: Describe what could happen and the weakness that could make it possible.
• Current safeguards: Record the controls in place and whether they are used and working as intended.
• Potential consequence: Note possible effects on confidentiality, integrity, availability, and screening continuity.
• Evidence and date: Identify the source reviewed, who validated it, and when.

HHS states that the risk analysis must be documented, but HIPAA does not prescribe a particular format. A risk register or checklist can work if it captures the assessment and supports follow-up. See HHS risk analysis guidance and 45 CFR § 164.316.

How to assess likelihood and impact

Estimate how likely each threat-and-vulnerability combination is to occur and how serious its effects could be. Consider the sensitivity and volume of affected records, existing safeguards, known incidents, exposure to external systems, and the program’s ability to continue screening and follow-up if a system is unavailable. HHS guidance describes considering both the probability of occurrence and the magnitude of potential harm.

You may use a simple scale—such as low, moderate, and high, or numeric scores—to help compare risks and set priorities. HIPAA does not require a particular scoring formula, so define your scale, apply it consistently, and record the reasoning behind each rating.

• Likelihood: How plausible is the event given the threat, vulnerability, exposure, and safeguards?
• Impact: What could happen to patient information, image or report integrity, system availability, and timely follow-up?
• Priority: Which risks need prompt mitigation, additional review, or a documented decision?

After selecting or improving safeguards, reassess the remaining risk. Keep the rationale for risk ratings and decisions in the record so the program can explain how it prioritized security risk management. See HHS’s explanation of risk analysis and risk management.

Security controls for screening data and systems

Choose safeguards based on the identified risks and the program’s circumstances; no single checklist of technologies is a substitute for that assessment. Review administrative, physical, and technical controls, including whether responsibilities and procedures are clear and whether controls are configured and operating effectively.

• Access control safeguards: Limit access to authorized workforce members and systems according to job responsibilities; review access when roles change and remove it when no longer needed.
• Audit controls: Use appropriate mechanisms to record and examine activity in systems containing or using ePHI, and define how relevant activity is reviewed.
• Authentication and transmission: Assess how users and systems are verified and how ePHI is protected when transmitted electronically.
• Integrity and device protections: Consider safeguards against improper alteration or destruction, as well as physical security for workstations, imaging devices, and portable media.
• Contingency planning: Address data backup, recovery, emergency operations, and testing of plans so critical screening and follow-up processes can continue or be restored.
• Vendor and cloud services: Identify vendors that create, receive, maintain, or transmit ePHI, review relevant arrangements, and include their services in the risk analysis.

HIPAA technical safeguards address access control, audit controls, integrity, authentication, and transmission security. The rule also requires contingency planning. See 45 CFR § 164.312 and 45 CFR § 164.308. Encryption is an addressable implementation specification under the current Security Rule; assess whether it is reasonable and appropriate for the program and document the decision. See HHS guidance on encryption.

How to record corrective actions and owners

For each risk requiring treatment, record the planned action, the person accountable for completing it, the target date, and how completion will be verified. An accountable owner might be a program leader, privacy or security officer, IT lead, radiology manager, or vendor contact, depending on the system and workflow.

• Describe the corrective action and the risk it addresses.
• Assign one accountable owner and identify supporting teams or vendors.
• Set a priority, due date, and any interim safeguards needed while work is pending.
• Track status, evidence of implementation, and any remaining risk after completion.
• Escalate overdue or blocked actions and record who approved any risk acceptance.

Use a central log so leaders can review open items, overdue work, and unresolved high-priority risks. HIPAA requires documentation of specified policies, procedures, and activities, with applicable documentation retained for six years from creation or the date it was last in effect, whichever is later; it does not mandate a particular corrective-action tracker. See 45 CFR § 164.316.

How often should the assessment be reviewed?

Keep the risk analysis ongoing and revisit it when changes may affect ePHI or the safeguards protecting it. Review triggers can include adding or replacing screening or imaging technology, changing data flows or vendors, expanding remote access, reorganizing responsibilities, or responding to an incident or newly identified vulnerability.

HHS does not specify a universal fixed interval for a comprehensive risk analysis; frequency depends on the organization and its environment. A program may set a regular review schedule, such as an annual review, as an internal practice, while also reassessing when significant changes or new risks arise. Do not treat an annual schedule as a universal federal requirement. See HHS guidance on periodic review and updates.

In short, define the screening data and systems in scope, document and prioritize risks, select safeguards suited to those risks, and track corrective actions through completion. Revisit the assessment as the program’s environment changes.

FAQs

What should a lung cancer screening program security risk assessment include?

It should identify where screening-related ePHI is created, received, maintained, or transmitted; the systems, people, and vendors involved; relevant threats and vulnerabilities; existing safeguards; and potential likelihood and impact. It should also document risk priorities and planned actions.

How should a program assess risks to screening records and systems?

Map data flows and inventory systems, then review relevant workflows, access, safeguards, incidents, and vendor services. For each identified risk, document the threat, vulnerability, likelihood, potential impact, current controls, and rationale for the selected priority. A scoring method can help, but HIPAA does not prescribe a specific formula.

How often should a security risk assessment be updated?

Update it as needed when environmental or organizational changes may affect ePHI, and review it on a schedule appropriate to the program. HHS does not set one universal fixed interval for the comprehensive risk analysis; annual review may be an organizational practice, not a universal federal requirement.

Who should be responsible for tracking corrective actions?

Assign an accountable owner for each action based on the risk and affected workflow, and have a designated program or organizational lead maintain oversight of the overall tracker. Involve appropriate clinical, radiology, IT, privacy, security, and vendor contacts as needed.