Neurogenic Bowel and Bladder Clinic Security Risk Assessment Checklist

Use this checklist to assess how your neurogenic bowel and bladder clinic protects electronic protected health information (ePHI) and supports safe, dependable care. The HIPAA Security Rule requires an accurate and thorough risk analysis and appropriate administrative, physical, and technical safeguards; this checklist helps organize that work but does not guarantee compliance. HHS guidance on risk analysis

Which ePHI, systems, devices, locations, and workflows are in scope?

Start by identifying where the clinic creates, receives, maintains, or transmits ePHI. Include information in the electronic health record (EHR), billing and scheduling systems, messaging platforms, backups, removable media, and systems maintained by service providers. The assessment should cover ePHI wherever it is handled—not only the main clinic server. HHS guidance on scope and data collection

• Patient information: Identify records, test results, diagnoses, treatment plans, medication lists, referrals, and communications associated with bowel and bladder care. Consider information entered through patient portals, intake forms, remote monitoring, or patient-submitted logs.
• Clinical workflows: Map how staff document assessments, bowel programs, catheterization plans, continence care, equipment needs, follow-up, and care coordination. Include telehealth and communications with caregivers or other providers where the clinic handles ePHI.
• Systems and devices: List EHRs, practice management and billing tools, email, phones, tablets, workstations, printers, network equipment, cloud storage, backup services, and any clinical or connected devices that store or transmit ePHI.
• People and locations: Include clinicians, administrative staff, contractors, remote workers, and temporary staff, along with clinic rooms, reception areas, records or equipment storage, home workspaces, and other locations where ePHI may be accessed.
• Information flows: Trace ePHI sent to labs, pharmacies, suppliers, referral partners, payers, billing services, and other vendors. Note what information is shared, how it moves, and who can access it.

Record the systems, data, workflows, locations, and responsible owners you identify. A documented inventory makes it easier to notice overlooked connections, such as a scheduling tool that exports appointment details to an external service.

How should threats and vulnerabilities be identified and evaluated?

Identify reasonably anticipated threats and vulnerabilities affecting the confidentiality, integrity, or availability of ePHI. A threat might be a phishing attempt, a lost tablet, an employee mistake, a power outage, or a flood. A vulnerability might be weak access practices, an unpatched system, an exposed screen, or an untested backup. HHS calls for considering threats, vulnerabilities, existing safeguards, likelihood, and potential impact. HHS risk-analysis guidance

• Review past security incidents, reported near misses, audit records, complaints, and system changes.
• Ask staff how they access, share, correct, and protect patient information during routine care and urgent situations.
• Consider both deliberate and accidental events, including inappropriate access, misdirected messages, data alteration or deletion, device loss, malware, and service outages.
• Assess risks specific to clinic operations, such as interruptions to access to care plans or medication information, or exposure of patient details in shared or public areas.
• Evaluate how likely each threat-and-vulnerability combination is and how serious its potential effect would be on patient information and clinic operations.

Use a consistent method—such as defined likelihood and impact levels—to rank risks, and explain the reasoning behind each rating. HIPAA does not prescribe one particular risk-analysis method; the assessment should fit the clinic’s size, systems, and circumstances. HHS guidance on risk-analysis methods

Which administrative safeguards should the clinic assess?

Administrative safeguards include the clinic’s policies, assigned responsibilities, staff practices, and processes for managing security. Check whether these controls exist, are understood by the people who use them, and are reviewed when the clinic or its systems change. The Security Rule identifies risk analysis, risk management, workforce security, information access management, security awareness and training, incident procedures, contingency planning, and evaluation among its administrative safeguard requirements. 45 C.F.R. § 164.308

• Confirm that a security official is responsible for developing and implementing security policies and procedures.
• Review how user access is approved, changed when job duties change, and ended when a workforce member leaves.
• Check that the workforce receives security awareness and training relevant to clinic policies, including how to report suspected incidents. Do not treat a generic training certificate as proof that the organization is compliant.
• Verify that procedures address detection, reporting, response, mitigation, and documentation of security incidents.
• Review contingency plans for retrievable backups, restoration of lost data, and continued critical operations during emergencies. Consider whether plans are tested and updated.
• Check that the clinic periodically reviews system activity, such as audit logs and access reports, and evaluates its security measures.

When considering an implementation specification marked “addressable,” do not assume it is optional. The clinic must assess whether it is reasonable and appropriate for its circumstances; if not, document the decision and consider an appropriate equivalent measure. HHS explanation of addressable specifications

How can physical access to records and devices be protected?

Assess how the clinic limits physical access to facilities, workstations, equipment, and electronic media while allowing authorized staff to do their jobs. Physical safeguards apply to workstations that access ePHI as well as devices and media that store it. 45 C.F.R. § 164.310

• Check whether reception areas, exam rooms, offices, records storage, and rooms containing network or server equipment are protected against unauthorized entry.
• Review visitor procedures, key or badge controls, and how the clinic validates access to restricted areas.
• Consider whether computer screens, printed schedules, labels, and documents could be viewed by visitors or other patients.
• Check that staff secure portable devices and media when not in use, including during travel or remote work.
• Review how the clinic tracks, moves, reuses, and disposes of equipment or media that may contain ePHI.
• Consider emergency access and facility procedures needed to restore services after an incident or disruption.

For each identified weakness, record the existing safeguard and any change needed—for example, relocating a workstation, improving visitor procedures, or defining how devices are secured and returned.

Which technical safeguards support ePHI confidentiality, integrity, and availability?

Review how systems restrict access, record activity, protect information from improper alteration or destruction, verify identity, and secure transmissions. HIPAA specifies standards for technical safeguards, but does not name one required product or technology for every clinic. 45 C.F.R. § 164.312

• Access control: Check whether each person has a unique account and access appropriate to their job. Review account approval, changes, removal, and emergency access procedures.
• Authentication: Assess how users and systems verify identity, including account and password practices and any additional safeguards the clinic has selected.
• Audit controls: Confirm that the clinic can review system activity relevant to ePHI and has a process for responding to concerning access or activity.
• Integrity: Review how the clinic guards against improper changes or destruction of ePHI and detects errors or unauthorized changes.
• Transmission security: Assess how ePHI is protected when sent between systems, devices, staff, patients, or service providers.
• Availability: Check whether backups can be retrieved and whether restoration and emergency access procedures support essential clinical workflows.

Encryption is an addressable implementation specification under the current Security Rule, not a universal requirement in every circumstance. The clinic must evaluate it against its risks; if it determines encryption is not reasonable and appropriate, it must document that determination and consider an appropriate alternative measure. HHS guidance on encryption

How should third-party vendors and service providers be assessed?

Include vendors and service providers that create, receive, maintain, or transmit ePHI for the clinic. Potential examples include EHR and cloud providers, billing services, hosted email, data backup, IT support, and vendors involved in patient communications. The risk analysis should account for external sources of ePHI, not just systems managed directly by clinic staff. HHS guidance on external ePHI sources

• Document what ePHI the vendor handles, for what purpose, and which services or subcontractors may access it.
• Review relevant safeguards, incident-notification procedures, access practices, and support for data return or secure disposal when the relationship ends.
• Determine whether the relationship requires a written business associate agreement (BAA), and confirm that the agreement addresses required safeguards and reporting responsibilities.
• Track the agreement and review the relationship when services, data flows, or risks change.

A BAA documents required assurances; it does not by itself replace the clinic’s responsibility to assess its own risks and manage them. HHS describes core requirements for business associate contracts and arrangements. HHS business associate contract provisions

How should risks, remediation actions, and assessment records be documented and reviewed?

Keep a usable record of the assessment: its scope and date, information and systems reviewed, identified threats and vulnerabilities, current safeguards, likelihood and impact judgments, risk ratings, and the rationale for decisions. HIPAA requires documentation but does not prescribe a specific format. HHS guidance on risk-analysis documentation

• Create a remediation plan for each risk that identifies the action, accountable owner, target date, priority, and status.
• Prioritize risks according to their potential effect on ePHI and essential clinic operations, alongside likelihood and existing protections.
• Record whether a risk is being reduced, accepted, or otherwise addressed, with the reason and appropriate approval.
• Recheck completed actions to confirm they work as intended and update the risk record when residual risk remains.
• Retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later; review and update documentation as needed when environmental or operational changes affect ePHI security. 45 C.F.R. § 164.316

The Security Rule does not set one universal schedule for repeating a risk analysis. Keep the process ongoing and reassess when changes, incidents, or new technologies could affect ePHI security. A documented scope, risk ranking, remediation plan, and review process give your clinic a practical foundation for managing security risks. HHS guidance on periodic review

FAQs.

How often should a neurogenic bowel and bladder clinic update its security risk assessment?

The HIPAA Security Rule does not specify a fixed interval, such as annually. Keep risk analysis ongoing and review it when operational or environmental changes, new technology, incidents, or other circumstances may affect ePHI security. Choose a review schedule that fits the clinic’s environment and document the reasons for updates. HHS guidance on assessment frequency

What ePHI systems and workflows should the assessment include?

Include all ePHI the clinic creates, receives, maintains, or transmits, wherever it is located. Assess EHR and billing systems, messaging, devices, backups, vendor services, and relevant workflows such as documentation, scheduling, telehealth, care coordination, patient communications, and records access. Map how information moves between staff, systems, locations, and service providers.

How should the clinic prioritize and track identified security risks?

Rate each identified risk using a consistent assessment of likelihood and potential impact on the confidentiality, integrity, and availability of ePHI. Then document a response, accountable owner, target date, priority, status, and rationale. Review completed actions to confirm they have reduced risk and record any remaining exposure.

What documentation should the clinic retain after completing the assessment?

Retain the assessment scope and date, information and systems reviewed, identified threats and vulnerabilities, existing safeguards, risk judgments and ratings, and remediation decisions and follow-up. Keep required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later, and update it as needed when relevant environmental or operational changes occur. 45 C.F.R. § 164.316