Portable Radiology Security Risk Assessment Checklist for Nursing Homes

Portable radiology systems can create, display, store, and transmit electronic protected health information (ePHI) throughout a nursing home. Use this checklist to assess the devices, connections, people, and procedures involved, then document risks and corrective actions as part of your HIPAA Security Rule risk analysis.

Inventory Portable Radiology Systems and Network Connections

Start by identifying every portable imaging device and the systems it connects to. Include equipment owned by the facility, brought in by a mobile imaging provider, or used by contractors.

• Record each device’s type, manufacturer, model, serial number, owner, assigned department, operating system or firmware, and physical location.
• Inventory connected workstations, tablets, detectors, image storage, removable media, wireless access points, and any vendor-managed or cloud services.
• Map how images and related information move from acquisition to the electronic health record (EHR), picture archiving and communication system (PACS), radiology provider, and other authorized recipients.
• Identify wired and wireless network connections, remote access paths, vendor connections, and any shared network segments.
• Confirm who is responsible for maintaining each device and connection, including the facility, radiology vendor, and technology service providers.
• Document equipment that is unused, retired, temporarily stored, or no longer supported, and specify how it will be securely removed or decommissioned.

A complete inventory helps you include all systems that create, receive, maintain, or transmit ePHI in the assessment. HHS guidance describes inventorying relevant systems and applications as one possible part of a risk analysis.

Assess Patient Data Encryption and Access Controls

Check how ePHI is protected while stored on imaging equipment and while transmitted between the device, the facility’s systems, and the radiology provider. Encryption can reduce the chance that exposed data will be readable, but it should be considered alongside other safeguards and documented in the risk assessment.

• Verify whether stored images, worklists, cached records, and local device backups are encrypted.
• Check whether image transfers and other electronic protected health information are encrypted in transit, including over wireless networks and vendor connections.
• Determine how encryption keys are protected and who can access them.
• Require unique user accounts where supported, strong authentication, and automatic session locking or timeouts.
• Apply role-based access control so staff and vendor users can access only the functions and information needed for their duties.
• Review account provisioning, changes in job duties, termination procedures, emergency access, and periodic access reviews.
• Check whether the system logs sign-ins, image access, exports, administrative changes, and failed access attempts, and establish who reviews those records.

The HIPAA Security Rule treats encryption as an addressable implementation specification, not a one-size-fits-all mandate. If your organization determines that encryption is not reasonable and appropriate for a particular situation, it must document that decision and implement an appropriate alternative measure when one is reasonable and appropriate.

Secure Mobile Devices and EHR Connections

Portable imaging equipment often works alongside mobile devices, applications, and EHR connections. Assess how each endpoint is configured and how information is transmitted, received, and removed when it is no longer needed.

• Use mobile device management to enforce approved security settings, authentication, encryption, screen locks, and the ability to remotely lock or wipe supported devices.
• Restrict installation of unapproved applications and prevent staff from using personal devices to capture, store, or transmit resident information outside approved workflows.
• Confirm that EHR connections use authorized accounts and approved interfaces, and that electronic health record transmission security is evaluated for each data path.
• Limit access to EHR integrations and vendor portals, and review who can view, upload, download, or alter imaging records.
• Establish endpoint patch management procedures for imaging consoles, mobile devices, workstations, and network components. Track vendor support, security updates, and any devices that cannot be patched.
• Test safeguards for lost or stolen equipment, including rapid reporting, account revocation, remote lock or wipe, and incident documentation.
• Confirm that service providers handling ePHI have appropriate agreements and that their security responsibilities are understood.

HHS allows mobile devices to access ePHI when appropriate safeguards protect the information on the device and in connected services. Include the technology and its risks in your assessment rather than assuming that a mobile or cloud connection is secure by default.

Protect Imaging Equipment and Storage Areas

Assess where equipment is kept when it is not in use, how it is moved through the building, and who can handle it. Physical access controls should reduce opportunities for theft, tampering, or unauthorized viewing of resident information.

• Store imaging systems, detectors, accessories, and media in designated areas with access limited to authorized personnel.
• Use secure storage, key or badge controls, and sign-in and sign-out procedures when equipment is shared or moved between units.
• Keep devices and visible displays out of public areas and away from unauthorized visitors, residents, and other patients.
• Use inventory checks to track equipment location, assigned users, and return after each round or vendor visit.
• Protect storage rooms and network equipment areas from unauthorized entry, and review access rights when staff or vendor assignments change.
• Secure removable media and printed materials containing resident information; dispose of them using approved procedures.
• Plan for power loss, fire, water damage, theft, and equipment failure, including secure backups and a process to restore access to necessary records.

Safeguard Resident Privacy During Imaging

Portable imaging may take place in a resident’s room or another shared care area. Before and during a study, protect the resident’s dignity and limit the exposure of information, images, and conversations to people who need them for care.

• Verify the resident’s identity using approved clinical procedures while avoiding unnecessary display or discussion of identifying information.
• Explain the imaging process in a way the resident can understand, respect the resident’s preferences, and follow applicable consent-to-treatment procedures.
• Close doors or curtains when appropriate, position screens so others cannot view them, and limit access to the immediate imaging area.
• Take only the images required for the clinical purpose and transmit them through approved systems.
• Prevent staff from using personal phones or cameras to photograph, record, or share residents or private spaces outside authorized procedures.
• Follow facility policies for conversations, displays, worklists, printed labels, and image review in shared spaces.

For nursing homes covered by federal long-term-care requirements, CMS guidance states that photographing or recording a resident or the resident’s private space without written consent from the resident or designated representative violates the resident’s privacy and confidentiality rights. Diagnostic radiographs are part of a clinical imaging workflow; follow the facility’s applicable treatment-consent process and consult its privacy and clinical policies about any additional photographs or recordings. State law and facility policy may add requirements.

Identify Threats Vulnerabilities and Operational Risks

Evaluate both cybersecurity and day-to-day operational risks. Consider how likely each threat is, what harm it could cause to residents or care operations, and which safeguards can reduce the risk.

• Assess threats such as ransomware, phishing, stolen equipment, unauthorized access, weak passwords, misdirected images, insecure wireless connections, and vendor compromise.
• Look for vulnerabilities including unsupported software, missing patches, shared accounts, unencrypted storage, excessive permissions, exposed screens, and unmonitored access.
• Review operational risks such as network outages, delayed image transmission, incorrect routing, device failure, incomplete records, and unavailable vendor support.
• Include human, environmental, and third-party risks, as well as the potential effects of ePHI loss, alteration, exposure, or unavailability.
• Rate each risk by likelihood and impact, identify existing safeguards, and assign an owner and due date for each corrective action.
• Test incident response steps for a lost device, suspected disclosure, malware event, or interruption to imaging services.
• Reassess when equipment, vendors, network connections, workflows, or facility conditions change, and retain documentation of the assessment and follow-up.

A useful assessment brings together the equipment inventory, data flows, access restrictions, physical access controls, resident privacy practices, and operational threats. Documenting gaps and assigning corrective actions helps the facility manage risk rather than treating the checklist as a one-time exercise.

FAQs.

What assets should a nursing home include in a portable radiology security risk assessment?

Include portable imaging systems, detectors, consoles, tablets, connected workstations, wireless and wired network connections, EHR and PACS interfaces, local storage, removable media, backups, vendor portals, cloud services, and equipment used by outside radiology providers. Record who owns, maintains, and can access each asset, along with the ePHI it creates, receives, stores, or transmits.

How should portable radiology devices protect electronic protected health information?

Use safeguards suited to the device and documented risks, such as encryption for stored and transmitted ePHI, unique accounts, strong authentication, role-based access control, automatic locking, audit logging, secure network connections, and timely security updates. Include a process for reporting and responding to lost devices, and ensure that images are transferred and stored only through approved systems.

What physical controls help prevent portable imaging equipment from being lost or accessed without authorization?

Use designated secure storage, restricted room or cabinet access, equipment sign-out and return logs, routine inventory checks, and clear responsibility for equipment during transport and imaging rounds. Keep screens and worklists away from public view, secure removable media, and promptly report missing or damaged equipment.

When is written consent required for resident photographs or recordings?

CMS guidance for nursing homes states that written consent from the resident or designated representative is needed before photographing or recording a resident or the resident’s private space. This concerns photographs and recordings; follow the facility’s clinical consent procedures for diagnostic imaging and check applicable state law and facility policy for any additional requirements.