Security Risk Assessment Checklist for Ostomy and Catheter Mail-Order Companies

A security risk assessment helps an ostomy and catheter mail-order company identify where electronic protected health information (ePHI) is created, received, maintained, or transmitted—and what could compromise its confidentiality, integrity, or availability. If your company is a HIPAA covered entity or business associate, the HIPAA Security Rule requires an accurate and thorough risk analysis and appropriate action to manage identified risks. Your company’s HIPAA status depends on its role and relationships, not simply on the products it sells.

Use this checklist to examine the systems and processes involved in receiving prescriptions, confirming coverage, fulfilling orders, communicating with patients, and coordinating deliveries. Document what you find, assign responsibility for follow-up, and revisit the assessment as your operations or technology change.

Map ePHI Data Flows and Systems

Start by identifying the ePHI your company handles and tracing how it moves through your business. Include information held by your own workforce and by vendors that create, receive, maintain, or transmit it for you.

• Inventory ePHI: Identify patient names and contact details linked to prescriptions, medical supply orders, diagnoses, insurance claims, payment records, customer-service conversations, and clinical documentation. Consider delivery details when they are connected to a patient’s healthcare or supply order.
• Map the order lifecycle: Trace information from referral or prescription intake through eligibility checks, order entry, packing, shipping, delivery updates, refills, billing, returns, and record retention or deletion.
• List systems and devices: Include order-management and customer-relationship platforms, electronic fax, email, call-center tools, payment and billing systems, warehouse software, mobile devices, file shares, backups, and cloud services.
• Record connections and transfers: Note interfaces and information exchanges with healthcare providers, health plans, payment processors, shipping services, cloud providers, and other vendors. Distinguish ePHI from data that has been properly de-identified.
• Identify access locations: Document offices, warehouses, remote-work locations, data centers, and any locations where paper documents, devices, or removable media containing ePHI may be used or stored.

Keep the inventory specific enough to show which systems contain ePHI, who can access them, and how the information moves between systems. HHS guidance describes identifying relevant systems and applications as part of a risk analysis.

Identify Threats and Vulnerabilities

For each system and data flow, consider events that could expose, alter, destroy, or make ePHI unavailable. Assess both deliberate attacks and everyday failures in people, processes, facilities, and technology.

• Cyber threats: Consider phishing, stolen credentials, ransomware, malware, unauthorized access, insecure remote connections, and exploitation of unpatched or outdated systems.
• Order and fulfillment risks: Examine misdirected prescriptions or order confirmations, incorrect recipient records, unauthorized changes to patient accounts, exposed packing or shipping information, and improper disposal of labels or paperwork.
• Workforce and process risks: Look for excessive permissions, shared accounts, weak account termination procedures, inadequate training, accidental disclosures, and unclear reporting channels.
• Physical and availability risks: Consider device loss or theft, unauthorized warehouse or office access, fire, power or network outages, and interruptions affecting order systems or backups.
• Vendor and integration risks: Assess how vendor access, software connections, subcontractors, and data transfers could create exposure or disrupt services.
• Existing vulnerabilities: Review known software weaknesses, unsupported devices, poor configuration, missing safeguards, and gaps found through prior incidents, audits, or testing.

Describe each risk in terms of the threat, the relevant weakness, the ePHI or system affected, and the possible effect on confidentiality, integrity, or availability. A useful assessment considers reasonably anticipated threats and vulnerabilities across the organization’s ePHI environment.

Assess Administrative Physical and Technical Safeguards

Review whether your safeguards address the risks you identified and are implemented in day-to-day operations. The right mix depends on your systems, workforce, business processes, and the nature and extent of the ePHI you handle.

• Administrative safeguards: Check that security responsibilities are assigned; workforce access is approved, reviewed, and removed when appropriate; staff receive security training; incidents have a reporting and response process; and contingency planning and data backup procedures are documented and tested.
• Physical safeguards: Review facility access, visitor procedures, workstation placement and use, device protections, and how electronic media and paper records are stored, transported, reused, and disposed of.
• Technical safeguards: Examine unique user accounts, authentication, role-based access control, audit logging, integrity protections, and secure transmission. Review encryption at rest and in transit as a risk-reduction measure, along with key management and access to encrypted data.
• Operational effectiveness: Confirm that safeguards work as intended—for example, that access is limited to job needs, logs are reviewed, alerts reach responsible staff, and backup restoration can be performed.
• Incident readiness: Verify that staff know how to report suspected exposure, lost devices, suspicious activity, or disrupted systems, and that response roles and escalation steps are clear.

Encryption can help protect ePHI, but it does not by itself address every Security Rule safeguard or ensure data remains accurate and available. Review it alongside access, audit, physical, administrative, and contingency controls.

Evaluate Likelihood and Impact

Estimate how likely each identified threat is to exploit a vulnerability and what the consequences could be. Use a consistent method—such as defined likelihood and impact levels—so that risks can be compared and prioritized.

• Assess likelihood: Consider prior incidents, observed attack activity, system exposure, known weaknesses, current safeguards, and how often the affected process is used.
• Assess impact: Consider the volume and sensitivity of ePHI involved, potential unauthorized disclosure or alteration, disruption to order fulfillment, effects on patient service, and recovery needs.
• Account for existing controls: Record which safeguards reduce the likelihood or impact and whether evidence shows those safeguards are operating consistently.
• Prioritize risks: Rank findings using your documented method, giving attention to significant risks to ePHI and essential business processes.
• Record uncertainty: Note missing information, assumptions, and areas needing further investigation so decision-makers understand the limits of the assessment.

The purpose is not merely to assign a score. Use the assessment to decide which safeguards are reasonable and appropriate for managing the risks you identified, and track whether the chosen response reduces those risks.

Review Business Associate Security Controls

Identify vendors and other business associates that create, receive, maintain, or transmit ePHI for your company. Depending on your role in a particular relationship, your company may itself be a business associate, a covered entity, or neither; assess the applicable relationships and responsibilities rather than assuming one status applies to every service.

• Maintain a vendor inventory: Record each vendor’s service, the ePHI it handles, its access level, and any subcontractors involved in handling that information.
• Review agreements: Confirm that required business associate agreements (BAAs) are in place and that responsibilities for safeguarding ePHI, incident reporting, permitted uses, and termination are understood.
• Examine security controls: Review relevant access restrictions, authentication, encryption, audit logging, vulnerability management, backup and recovery, workforce training, and security incident response.
• Clarify shared responsibilities: Document which party manages each safeguard, who investigates incidents, how access is granted and removed, and how ePHI is returned or handled when a service ends.
• Seek appropriate evidence: Use contract terms and your risk-management process to determine whether you need security documentation, assessment results, incident information, or other assurances from a vendor.

A BAA is an important part of the relationship, but it does not replace reviewing how a vendor’s services affect your own risk profile. HHS notes that customers may seek additional assurances, such as safeguards documentation or audit information, based on their risk analysis and risk management activities.

Document Risk Management Decisions

Turn assessment findings into a documented plan. For each risk, record its priority, the decision made, the safeguard or other response, the responsible owner, and the target date for follow-up.

• Choose and explain a response: Document whether you will mitigate, avoid, transfer, or accept a risk, and explain the basis for the decision.
• Assign accountability: Name the role or team responsible for each action and identify who approves residual-risk decisions.
• Set milestones: Track due dates, resources, implementation status, and any dependencies such as vendor changes or system upgrades.
• Keep supporting evidence: Retain the system inventory, data-flow maps, risk ratings, policies, approvals, testing records, incident findings, and remediation updates.
• Reassess when circumstances change: Review the assessment periodically and when meaningful changes—such as a new platform, vendor, workflow, incident, or significant system change—may affect ePHI risks.
• Test key recovery procedures: Document backup and restoration tests, contingency exercises, lessons learned, and corrective actions.

A risk assessment tool can help organize the work, but completing a tool alone does not show that every relevant risk has been found or that safeguards are effective. Treat the assessment as part of an ongoing cycle of analysis, risk management, evaluation, and documentation.

In summary, map the ePHI your business handles, identify threats and weaknesses, evaluate safeguards and vendors, prioritize likelihood and impact, and document accountable decisions. A current, evidence-based process helps your company protect patient information while keeping essential mail-order services dependable.

FAQs.

What ePHI should an ostomy and catheter mail-order company include in its risk assessment?

Include all electronic information that identifies a patient and relates to their healthcare or payment for care, wherever your company creates, receives, maintains, or transmits it. This may include prescriptions, diagnoses, supply orders, refill history, insurance and billing records, patient communications, delivery details linked to orders, and related information in vendor systems, email, backups, or mobile devices. Map the systems and transfers involved rather than limiting the review to your primary order platform.

How often should the company review its security risk assessment?

Review it periodically and when operational, technical, or environmental changes could affect ePHI risks. Significant changes may include adopting a new system, changing vendors, expanding remote access, altering fulfillment workflows, or responding to an incident. Establish a review schedule appropriate to your operations and document updates; do not treat a completed assessment as a one-time exercise.

What security controls should be reviewed for vendors handling ePHI?

Review controls relevant to the vendor’s service and access, including user authorization, authentication, role-based access control, encryption at rest and in transit, audit logging, incident reporting, workforce practices, backups, recovery, and subcontractor oversight. Check the BAA and clarify how security tasks are divided between your company and the vendor. Consider requesting appropriate evidence of controls as part of your risk-management process.

Does using a HIPAA Security Risk Assessment tool guarantee compliance?

No. A tool can help structure and document an assessment, but it does not guarantee that the assessment is complete, that safeguards are effective, or that all applicable HIPAA requirements are met. Your organization must evaluate its own ePHI, risks, safeguards, and business relationships, then take and document appropriate risk-management steps.