Security Risk Assessment Checklist for Dual Eligible Special Needs Plans (D-SNPs)

A structured security risk assessment helps a Dual Eligible Special Needs Plan (D-SNP) understand where electronic protected health information (ePHI) resides, what could put it at risk, and which safeguards need attention. Use this checklist to examine the plan’s own systems and the relevant vendors, providers, and partners involved in its operations.

Tailor the assessment to your organization’s environment. A checklist can guide the work, but it does not replace a thorough evaluation of actual risks to ePHI or a documented plan for addressing them.

Define the ePHI Risk Analysis Scope

Start by defining which organization, business functions, systems, and locations the assessment covers. Include ePHI the organization creates, receives, maintains, or transmits, whether it is hosted internally or handled by a vendor.

• Confirm which legal entities and business units are included, and identify who is responsible for the assessment.
• Build an electronic protected health information (ePHI) ePHI inventory that covers enrollment, eligibility, claims, care coordination, member services, appeals, and other D-SNP operations.
• Map ePHI flows between plan systems, workforce members, providers, delegated entities, business associates, and other relevant partners.
• Include cloud platforms, mobile devices, remote work environments, backups, file transfers, email, and paper-to-digital workflows where they involve ePHI.
• Record system owners, data types, storage locations, connections, and the parties with access.

Use interviews, system records, contracts, diagrams, and technical inventories to validate what is in scope. Record gaps and assumptions so reviewers can see where further investigation is needed.

Identify Threats and Vulnerabilities

Assess how ePHI could be exposed, changed, lost, or made unavailable. Consider threats involving people, technology, natural events, and environmental conditions; their likelihood and potential impact depend on your organization’s circumstances.

• Consider phishing, ransomware, stolen credentials, malicious insiders, accidental disclosure, misdirected communications, and unauthorized access.
• Look for vulnerabilities such as unsupported software, unpatched devices, weak authentication, excessive access, insecure configurations, and incomplete backups.
• Evaluate risks from lost or stolen laptops, phones, removable media, and other devices that may store or access ePHI.
• Assess vendor and partner risks, including unclear responsibilities, inappropriate access, insecure data exchange, and gaps in incident reporting.
• Consider power outages, flooding, fire, network failure, and other events that could disrupt access to ePHI or essential services.
• Review prior security incidents, audit findings, complaints, test results, and known control failures for recurring patterns.

For each finding, record the affected information or system, the relevant threat and vulnerability, how the issue could occur, and its potential effect on the confidentiality, integrity, or availability of ePHI.

Evaluate Existing Security Safeguards

Determine whether safeguards are in place, working as intended, and appropriate to the risks identified. Do not rely on policy documents alone: compare written procedures with system configurations, access records, test results, and workforce practices.

• Check whether each identified risk has a related safeguard and an accountable owner.
• Verify that access is limited to appropriate roles and that access changes when workforce members change responsibilities or leave.
• Review authentication, encryption decisions, backup and recovery, security monitoring, and protections for remote access.
• Examine contracts and operational practices for vendors that create, receive, maintain, or transmit ePHI.
• Assess whether safeguards have been tested, whether issues were corrected, and whether corrective actions remain effective.
• Document safeguards that are missing, inconsistently used, or not supported by evidence.

Record the evidence reviewed, the assessment date, and any limitations. This makes it easier to distinguish a control that exists on paper from one that has been implemented and checked.

Prioritize and Manage Security Risks

Rank findings according to the likelihood of a threat, the potential impact on ePHI and operations, and the strength of existing safeguards. Risk management implementation means translating assessment findings into decisions and actions to reduce risk to a reasonable and appropriate level.

• Set a consistent method for rating likelihood, impact, and overall risk.
• Address high-impact or time-sensitive issues first, including risks that could interrupt member services or access to essential information.
• For each risk, document the chosen response, such as implementing a safeguard, improving an existing control, or taking another documented approach.
• Assign an owner, target date, required resources, and measurable completion criteria to each action.
• Track unresolved risks and formally document decisions, approvals, and any accepted residual risk.
• Reassess a risk after remediation to confirm whether the action reduced it as intended.

Keep a risk register that links each finding to its supporting evidence, planned action, responsible owner, status, and verification results.

Review Administrative Safeguards

Review HIPAA administrative safeguards alongside the people, policies, and processes that govern access to and protection of ePHI. Confirm that responsibilities are assigned and that written procedures match operational practice.

• Confirm that a responsible security official or equivalent role coordinates security policies and assessment follow-up.
• Review workforce access authorization, role changes, onboarding, termination, supervision, and periodic access review.
• Check that workforce members receive security awareness training and know how to report suspected incidents.
• Review policies for incident response, contingency planning, backup, recovery, and continuity of operations.
• Verify that vendor and delegated-entity responsibilities for safeguarding ePHI and reporting security events are documented and monitored.
• Check that security policies, procedures, assessment results, and remediation records are maintained and updated.

Look for evidence that administrative procedures are followed, such as completed training records, access approvals, incident logs, vendor reviews, and documented corrective actions.

Assess Physical and Technical Safeguards

Examine how physical locations, devices, and information systems protect ePHI. Evaluate safeguards in context: the relevant control should address the risks identified for the plan’s actual facilities, technologies, and workflows.

• Review facility access controls for offices, server rooms, records areas, and other locations where systems or devices containing ePHI are used or stored.
• Check visitor procedures, badge access, workstation placement, device storage, and secure disposal or reuse of equipment.
• Review technical access controls, unique user accounts, authentication, permissions, and protections for remote access.
• Assess audit controls and security incident review processes, including how access and system activity are logged, reviewed, and escalated.
• Examine protections for data in storage and transmission, including encryption decisions and any documented alternatives.
• Test backup, recovery, malware protection, vulnerability management, and system monitoring procedures.
• Check whether system changes are approved, tested, documented, and reviewed for security impacts.

Record how each safeguard was assessed—for example, through configuration review, access sampling, inspection, testing, or interviews—and note any exceptions that require remediation.

Establish Ongoing Assessment Procedures

Make security risk assessment a continuing process rather than a one-time exercise. Set a recurring review schedule and reassess when significant changes or events may affect ePHI or the safeguards that protect it. HHS guidance describes periodic evaluation and consideration of changes in the security environment, including incidents and new technology.

• Define when routine assessments occur, who participates, and who approves results.
• Trigger a focused reassessment after a security incident, major system change, new vendor relationship, significant workflow change, or newly identified vulnerability.
• Update the ePHI inventory, system diagrams, threat information, risk register, and safeguard evidence as the environment changes.
• Track remediation through completion and verify that implemented changes work as intended.
• Share relevant findings with accountable leaders and coordinate follow-up across security, IT, compliance, operations, and vendor-management teams.
• Retain assessment records and use prior findings to identify recurring issues and improve future reviews.

A disciplined cycle of inventory, analysis, safeguard review, risk prioritization, and follow-up helps your D-SNP focus resources on protecting ePHI and maintaining reliable operations.

FAQs

What ePHI systems and locations should a D-SNP include in its security risk assessment?

Include systems and locations that create, receive, maintain, or transmit the plan’s ePHI. Consider enrollment, eligibility, claims, care coordination, member-service platforms, email, file transfers, cloud services, endpoints, mobile devices, backups, remote work, and relevant vendor or partner environments. Map where information flows and who can access it so the assessment covers more than the plan’s primary applications.

How should a D-SNP document threats and vulnerabilities affecting ePHI?

For each finding, identify the affected system or information, the threat, the vulnerability, potential impact, likelihood, existing safeguards, and supporting evidence. Record the risk rating, chosen response, accountable owner, target date, and remediation status. Include relevant incident history and note assumptions or areas where information is incomplete.

How often should a D-SNP reassess security risks and safeguards?

Set a recurring assessment schedule suited to the organization’s systems and risks, and reassess sooner when a material change or event could affect ePHI. Examples include a security incident, new technology, a major workflow change, or a change in the organization’s security environment. HHS describes periodic evaluation but does not prescribe one universal calendar interval for every organization.

What safeguards should a D-SNP review after a security incident or system change?

Review the controls connected to the affected data, system, people, and workflows. This may include access permissions, authentication, audit controls, security monitoring, incident response, backups, recovery, vulnerability remediation, vendor responsibilities, and physical protections. Document what changed, whether the prior risk assessment remains accurate, what additional actions are needed, and how you will verify that safeguards are working.