Myeloproliferative Neoplasm Clinic Security Risk Assessment Checklist

Use this checklist to assess how your myeloproliferative neoplasm (MPN) clinic protects electronic protected health information (ePHI)—from clinical systems and staff workflows to vendors, facilities, and recovery plans. The HIPAA Security Rule calls for an accurate and thorough assessment of risks to ePHI’s confidentiality, integrity, and availability; the steps below help organize that work around your clinic’s operations. See 45 CFR § 164.308 and HHS guidance on risk analysis.

Which systems, devices, locations, vendors, and workflows handle electronic protected health information?

Start by mapping where ePHI is created, received, maintained, or transmitted—not just where it is stored. HHS explains that the assessment should account for ePHI across electronic media, systems, and locations. See HHS’s risk analysis guidance.

• Clinical systems: Inventory the electronic health record (EHR), laboratory and pathology interfaces, imaging systems, e-prescribing, patient portals, scheduling, billing, and referral platforms. For an MPN clinic, consider records and workflows involving blood counts, molecular or genetic test results, treatment plans, medication monitoring, and specialist referrals.
• Devices and media: Identify desktops, laptops, tablets, phones, printers, scanners, removable drives, network equipment, servers, and backup media that store, access, or transmit ePHI. Include personally owned devices only if clinic policy permits their use for clinic work.
• Locations: Include exam rooms, reception and check-in areas, nurses’ stations, clinician offices, medication or infusion areas if applicable, records rooms, network closets, and remote-work settings. Consider whether screens, printed materials, or conversations could expose information to unauthorized people.
• Vendors and connections: List cloud hosting, EHR support, billing, laboratory, imaging, telehealth, IT support, data backup, and secure messaging providers that handle ePHI. Identify relevant interfaces and connections, and confirm written business associate arrangements where HIPAA requires them.
• Workflows: Trace how staff collect, enter, review, send, print, export, correct, and dispose of information. Include patient communications, result routing, prescription processing, care coordination, remote access, and downtime procedures.

For each item, record the ePHI involved, who uses it, how it moves, where it is stored, and who is responsible for its protection. Keep the inventory broad enough to capture less obvious systems, such as shared workstations or a vendor’s support connection.

How should threats and vulnerabilities be identified and prioritized?

For every system and workflow in scope, identify potential threats, weaknesses that could be exploited, and the likely effects on confidentiality, integrity, and availability. HHS describes risk as involving the likelihood of a threat exploiting a vulnerability and the resulting impact; it does not prescribe one scoring method for every organization. See HHS guidance on identifying and assessing risk.

• Consider relevant threats: Review phishing, stolen or misplaced devices, ransomware, unauthorized access, accidental misdirection of results, system outages, vendor incidents, power loss, fire, water damage, and other hazards relevant to the clinic.
• Look for vulnerabilities: Check for outdated or unsupported software, weak account practices, excessive permissions, missing security updates, unprotected backups, exposed screens, shared accounts, poorly controlled vendor access, and gaps in staff procedures.
• Assess consequences: Consider whether a threat could expose patient information, alter or corrupt a record or result, delay access to clinically important information, or disrupt essential operations.
• Prioritize consistently: Use a documented method—such as qualitative likelihood and impact ratings—to assign risk levels. Give prompt attention to risks with a plausible path to widespread exposure, loss of records, or interruption of critical patient-care workflows.
• Set a response: For each risk, name an owner, describe the planned safeguard or other response, set a target date, and explain how the clinic will verify that the change worked.

Use clinic-specific examples rather than generic ratings alone. For instance, assess whether a delay in receiving or reviewing laboratory results during an EHR outage could affect the clinic’s ability to carry out its established care processes.

Which administrative, physical, and technical safeguards should be reviewed?

Review safeguards across the three HIPAA categories, then determine whether they address the risks you identified. The Security Rule’s standards and implementation specifications are set out in 45 CFR § 164.308, 45 CFR § 164.310, and 45 CFR § 164.312.

• Administrative safeguards: Review assigned security responsibility, workforce authorization and supervision, account approval and termination processes, security awareness training, incident procedures, contingency planning, vendor arrangements, and periodic evaluation of security policies and procedures.
• Physical safeguards: Check facility access, visitor controls, workstation placement and security, screen privacy, device inventory, handling of equipment and media, and secure disposal or reuse procedures.
• Technical safeguards: Review access controls, unique user identification, authentication, audit controls, integrity protections, and the security of ePHI transmission. Assess encryption and other measures in light of the clinic’s risks and applicable requirements.
• Addressable specifications: Do not treat “addressable” as automatically optional. Assess whether each specification is reasonable and appropriate in your environment. If you do not implement it, document the decision and implement an equivalent alternative when reasonable and appropriate, or document how the applicable standard is otherwise met. See HHS’s explanation of required and addressable specifications.

Use the risk analysis to determine which safeguards fit the clinic’s systems, workforce, facilities, and workflows. Record existing controls as well as gaps; having a written policy is not by itself proof that the related safeguard is operating effectively.

How can the clinic verify access controls and audit monitoring?

Compare actual access with each person’s job responsibilities and check whether the systems create useful records of activity. HIPAA’s technical safeguards include access control, unique user identification, and audit controls; the Security Rule also calls for regular review of information-system activity. See 45 CFR § 164.312 and 45 CFR § 164.308.

• Confirm each person has a distinct account wherever the system supports individual user access. HHS explains that shared log-on IDs do not meet the Security Rule’s unique user identification requirement. See HHS guidance on unique user IDs.
• Review role-based permissions for clinicians, nurses, laboratory and administrative staff, billing personnel, and vendor users. Check for access that is no longer needed after a role change or departure.
• Verify that the clinic can review audit logs, access reports, and security incident records for relevant systems. Confirm who reviews them, how often, what events are reviewed, and how suspicious activity is escalated.
• Check whether logs can help investigate unusual access to patient charts, repeated failed logins, unexpected exports, or access by former staff. Confirm that vendor-hosted systems provide the audit information the clinic needs.
• Review remote access, emergency access procedures, automatic logoff settings, and authentication measures against clinic policy and identified risks.

Test the review process by tracing a sample event from system log to documented follow-up. The goal is to establish that monitoring is both available and acted upon—not merely that a system produces log files.

What should the incident response and contingency plans cover?

Document how the clinic will identify, report, respond to, and recover from suspected or known security incidents. The Security Rule requires procedures to respond to incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. It also requires contingency planning that includes data backup, disaster recovery, and emergency-mode operations; testing and revision procedures are an addressable specification. See 45 CFR § 164.308.

• Response roles: Name the people responsible for receiving reports, containing an incident, contacting IT and relevant vendors, preserving evidence, communicating with leadership, and coordinating any required follow-up.
• Incident steps: Set out how staff report suspected phishing, lost devices, inappropriate access, mistaken disclosures, malware, and service disruptions. Explain how the clinic will contain the problem, protect affected systems, and document decisions and outcomes.
• Downtime operations: Identify how staff will continue essential workflows during an EHR, network, power, or vendor outage, including how they will access necessary information and later reconcile downtime records.
• Backup and recovery: Specify what ePHI is backed up, where protected copies are kept, who can access them, and how the clinic will restore data and critical systems after loss or damage.
• Contingency plan testing: Periodically test relevant procedures, such as restoring a backup, accessing information during downtime, and contacting response personnel. Record the test scenario, results, problems found, and corrective actions.

A recovery test should go beyond confirming that a backup job completed. Where feasible, restore a representative copy in a controlled environment, verify that the data can be accessed and are usable, and document any gaps. HHS guidance describes testing and revision as part of contingency planning; see HHS’s administrative safeguards guidance.

How should findings, corrective actions, and reassessments be documented?

Keep a written record that connects each identified risk to its impact, priority, response, and follow-up. HIPAA requires documentation of the risk analysis, but it does not prescribe a single format. HHS also describes risk analysis as an ongoing process, with reassessment frequency dependent on the organization’s environment and circumstances. See HHS risk analysis guidance and 45 CFR § 164.316.

• Record the assessment date, scope, participants, systems and workflows reviewed, methodology, assumptions, and evidence considered.
• For each finding, describe the affected ePHI or system, threat and vulnerability, potential consequences, assigned risk level, existing safeguards, and any remaining exposure.
• Track corrective actions with an accountable owner, due date, completion status, evidence of implementation, and a way to verify effectiveness.
• Document decisions about addressable specifications, including the factors considered and any alternative safeguard used.
• Retain security incident documentation and outcomes, contingency plan test results, relevant policy versions, and reassessment records under the clinic’s applicable documentation procedures.
• Reassess when changes or events may affect security—for example, a new system or vendor, changes to remote access, a significant workflow change, an incident, or new information about a vulnerability.

The Security Rule does not set one universal interval for reassessing risks. Establish a review cadence suited to your environment, and update the assessment when meaningful changes or incidents arise rather than relying only on a calendar reminder. See HHS’s explanation of periodic review and updates.

FAQs

What electronic protected health information should a clinic include in its assessment?

Include all ePHI the clinic creates, receives, maintains, or transmits, regardless of the system, electronic medium, or location involved. For an MPN clinic, this may include EHR records, blood test and pathology results, molecular testing, medication and treatment information, referrals, billing records, portal messages, and information handled through connected systems or vendors. See HHS risk analysis guidance.

How often should a clinic reassess security risks?

HIPAA does not specify a universal reassessment interval. HHS says the frequency varies by organization and circumstances; reassess periodically and when changes—such as a new technology, operational change, or security incident—could affect ePHI protection. An annual review may be a useful clinic practice, but it is not a universal federal annual requirement. See HHS guidance on periodic review.

What should the clinic document after identifying a security risk?

Document the affected systems and ePHI, the threat and vulnerability, likely impact, risk rating, existing safeguards, and planned response. Assign an owner and target date, then record implementation evidence and follow-up results. Also document decisions about addressable specifications and security incident outcomes, as applicable. See 45 CFR § 164.316 and 45 CFR § 164.308.

How should a clinic test its data recovery procedures?

Use a planned test to restore a representative backup in a controlled setting, verify that the information is accessible and usable, and confirm that staff understand the steps for recovering critical systems. Record the test date, scenario, participants, results, issues, and corrective actions. Periodically test and revise contingency plans based on the clinic’s risks and operations.

In short, a useful clinic security risk assessment connects every relevant ePHI system and workflow to its risks, safeguards, response plans, and documented follow-up—and revisits those decisions as the clinic changes.