Primary Ciliary Dyskinesia Center Security Risk Assessment Guide

What Does a HIPAA Security Risk Assessment Cover at a PCD Center?

A HIPAA Security Rule risk assessment identifies where your center’s electronic protected health information (ePHI) is created, received, maintained, or transmitted, then evaluates potential threats and vulnerabilities to its confidentiality, integrity, and availability. The assessment should include all ePHI—not only information in the electronic health record, but also data in connected systems, portable devices, backups, and vendor-hosted services. The HHS Office for Civil Rights (OCR) risk analysis guidance explains these scope and documentation expectations.

For a PCD center, map information flows across the services and workflows you actually provide. Depending on your operations, that may include scheduling and check-in, clinical visits, respiratory testing, specimen collection and handling, care coordination, telehealth, and research or registry activities involving ePHI. Record which people and systems handle the information, where it moves, and which outside organizations can access or maintain it.

Assess the center’s administrative safeguards, physical safeguards, and technical safeguards. These include workforce responsibilities and security policies; protection of facilities, workstations, and devices; and electronic controls such as access control and audit controls. HIPAA requires appropriate safeguards, but does not prescribe one assessment template or a single set of security tools for every center. See HHS’s summary of the HIPAA Security Rule.

How to Assess Risks to Protected Health Information in Clinical and Testing Areas

Walk through the center’s spaces and observe how staff, patients, caregivers, and visitors move through them. Include reception and waiting areas, exam rooms, staff work areas, records and equipment storage, and any testing, specimen, or laboratory spaces where patient information is accessed or handled. Review physical safeguard areas as part of the walkthrough. The assessment should cover both the electronic information accessed in those areas and relevant physical risks to the devices and systems that hold ePHI.

Where present, review respiratory testing stations, nasal nitric oxide testing, sputum collection or processing, and ciliary-sample workflows. Check whether screens can be seen from public areas, conversations can be overheard, printed labels or worklists are left unattended, and staff can securely access the systems they need. Also consider how equipment, paper records, portable media, and devices move between rooms or off-site.

Observe actual practices rather than relying only on written policies. For example, check whether workstations lock when unattended, whether access to restricted areas is controlled, and whether staff know how to report a lost device or suspected disclosure. HHS identifies facility access, workstation use and security, and device and media controls as HIPAA physical safeguard areas.

Keep the scope precise: the Security Rule risk analysis concerns ePHI, while paper and spoken information are addressed under the HIPAA Privacy Rule and other applicable requirements. A broader privacy walkthrough can include those formats without treating them as ePHI. HHS explains this distinction in its Security Rule summary.

Which Electronic Systems and Workflows Should Be Reviewed?

Inventory each system that stores, displays, sends, or provides access to ePHI, including systems managed by another organization. Depending on your setup, this may include:

• Electronic health records, scheduling, registration, billing, and patient portals.
• Respiratory testing, spirometry, laboratory, specimen, and clinical-device software that handles identifiable information.
• Health information exchanges, interfaces, imaging systems, telehealth platforms, and secure messaging.
• Research or registry platforms when they contain ePHI, along with related data exports and transfer workflows.
• Workstations, laptops, mobile devices, removable media, email, fax, network storage, cloud services, and backups.
• Vendor and business associate connections, including remote support and data-processing access.

For each system, identify who has access and why, whether accounts are individual, how access is changed or removed, what activity is logged and reviewed, and how data is backed up and restored. Review access control and audit controls in the context of clinical workflows: staff should be able to do their jobs, while access and activity remain appropriately controlled and reviewable. HHS describes these safeguards in its HIPAA Security Rule summary.

Include service providers that create, receive, maintain, or transmit ePHI for the center. Assess how their services affect your risks, who is responsible for safeguards, and whether required business associate arrangements are in place. HHS’s cloud computing guidance explains that covered entities and business associates must consider risks to ePHI handled through cloud services.

How Should Assessment Findings Inform Security Policies?

Document the systems and locations reviewed, identified threats and vulnerabilities, existing safeguards, and the reasoning behind your risk determinations. For each finding, record its potential impact, likelihood or other risk rationale, existing controls, and any corrective action needed. HIPAA requires documentation of the risk analysis but does not prescribe a particular format; HHS explains that the analysis should feed into risk management in its risk analysis guidance.

Turn findings into a tracked action plan. Assign an owner and target date, define the safeguard or process change, and record progress and evidence that the change was completed. If leadership decides to defer or accept a risk, document the rationale, approval, and any interim protections. Use the findings to review relevant security policies, such as user access, workstation use, device handling, backup and recovery, incident response, and workforce responsibilities.

Retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. The HHS documentation requirements guidance describes this retention period. Keep records in a form that authorized personnel can retrieve and use in later reviews.

Make the assessment an ongoing management process, not a one-time report. Revisit risks when meaningful changes occur—for example, after a security incident, a change in staffing or operations, or the introduction of a new system or vendor. Review related workforce policies and training so they reflect your center’s current procedures.

How Do Infection-Control Practices Affect Privacy and Security?

Infection-control workflows can change where staff work, how they enter or leave a patient area, and how equipment is shared or cleaned. When assessing security, consider how those workflows affect access to computers and devices, the handling of patient labels or testing records, and opportunities for conversations or screens to be seen by people who do not need the information.

For example, assess whether staff can follow hand-hygiene and personal protective equipment procedures while still using clinical systems safely, and whether shared workstations or devices can be cleaned according to applicable infection-control procedures and equipment instructions. The CDC Standard Precautions guidance addresses hand hygiene, protective equipment, and handling potentially contaminated patient-care equipment. Coordinate infection-control and privacy procedures rather than weakening one to accommodate the other.

Consider whether signs, labels, whiteboards, or spoken updates reveal more patient information than needed to people in public or shared areas. HIPAA does not require eliminating every incidental disclosure; it permits certain incidental uses or disclosures when reasonable safeguards are in place and the underlying use or disclosure is permitted. See HHS’s guidance on incidental uses and disclosures.

What Limitations Should PCD Centers Consider When Assessing Risk?

The assessment should reflect your center’s actual size, services, systems, staffing, and operating environment. A small center may have fewer systems than a large health system, but it still needs to identify all ePHI and assess reasonably anticipated risks. HHS notes that suitable safeguards vary with an organization’s circumstances in its risk analysis guidance.

There is no federally specified schedule requiring every center to perform the assessment annually. The Security Rule requires an ongoing process, and HHS says the appropriate timing varies with the organization and its circumstances. Annual review can be a practical choice, but centers should also revisit risks when changes or events make an update necessary.

A risk assessment is not, by itself, a guarantee of security or proof that the center meets every HIPAA obligation. It is focused on risks and vulnerabilities to ePHI under the Security Rule; other privacy, breach-notification, state-law, contractual, and research requirements may also apply. Use qualified privacy, security, clinical, and infection-control expertise where appropriate, and adapt generic tools or checklists to the center’s real workflows.

In short, a useful PCD center assessment connects every ePHI system and relevant location to practical safeguards, documented findings, and assigned follow-up. Keep the process active, tailored to your operations, and coordinated with patient care and infection control.

FAQs

How often should a PCD center update its HIPAA security risk assessment?

The HIPAA Security Rule does not set a fixed frequency. HHS describes risk analysis as an ongoing process and recommends reviewing risks as the organization’s environment changes. A center may choose an annual review as a practical cadence, but it should also reassess when significant changes, new technology, incidents, or other developments could affect ePHI. See HHS OCR risk analysis guidance.

What physical areas should a PCD center include in its assessment?

Include the facility areas where ePHI is accessed, stored, transmitted, or handled, and where systems or devices containing ePHI are located. Depending on the center’s services, this may include reception, waiting areas, exam rooms, testing and specimen areas, staff workspaces, records storage, and equipment or network areas. Also consider shared spaces where screens, printed information, or conversations may be exposed, while distinguishing the Security Rule’s ePHI scope from broader Privacy Rule safeguards.

How should a center document and address identified security risks?

Record the systems and workflows assessed, the threats and vulnerabilities identified, existing safeguards, and the rationale for each risk determination. Link each finding to a corrective action, responsible owner, target date, and follow-up evidence; document decisions to defer or accept a risk and the reasons for them. Retain required Security Rule documentation for six years from creation or the date it was last in effect, whichever is later, as described in HHS documentation guidance.

How can infection-control precautions affect patient privacy?

Precautions may change how staff move between rooms, use shared workstations or devices, and handle signs, labels, and patient information during testing or cleaning. Assess whether staff can follow infection-control procedures while maintaining appropriate access controls and limiting unnecessary exposure of patient information. CDC’s Standard Precautions guidance addresses infection-prevention practices, and HHS explains that reasonable safeguards can limit incidental disclosures without requiring every possible incidental disclosure to be eliminated.