Security Risk Assessment Guide for Custom Foot Orthotic Labs

A security risk assessment helps a custom foot orthotic lab understand where patient information moves, how it could be exposed, and which safeguards can reduce that risk. It also supports compliance with the HIPAA Security Rule when the lab is a covered entity or business associate.

A lab’s HIPAA responsibilities depend on its role and the information it handles. Use the steps below to assess risks to electronic protected health information (ePHI), document decisions, and strengthen your security practices.

Map Protected Health Information Across Lab Workflows

Start by tracing how protected health information (PHI) enters, moves through, and leaves your lab. Include information in prescriptions, order forms, emails, phone messages, scanned documents, customer portals, and production or billing systems.

For custom orthotics, a patient’s name or other identifier may appear alongside a prescription, foot scan, image, measurement, or order number. Map how staff receive that information, use it to design and manufacture devices, communicate with clinicians, package orders, and retain or dispose of records.

List the people, devices, applications, and service providers involved at each step. Include workstations, mobile devices, CAD systems, cloud storage, printers, backups, shipping tools, and remote access. Note where records are stored and who can access them.

The Security Rule focuses on ePHI. Still, mapping paper records and other forms of PHI can help you identify where information is converted to digital form, transmitted electronically, or exposed during daily work.

Assess Risks to Electronic Protected Health Information

Identify potential threats and vulnerabilities that could affect the confidentiality, integrity, or availability of ePHI. Consider events such as phishing, stolen devices, misdirected emails, ransomware, unauthorized account use, equipment failure, and accidental deletion.

For each risk, consider which systems and records could be affected, how likely the event is, and how serious its potential impact would be. A shared production account, for example, may make it difficult to determine who viewed or changed a patient-specific order.

Review your safeguards and any gaps. Check whether access is limited to staff who need it, whether systems receive security updates, whether backups can be restored, and whether vendors that handle ePHI have appropriate protections. Assess risks across the lab rather than focusing only on the main computer system.

Risk analysis is an ongoing process, not a one-time checklist. Revisit your assessment when you add a system, change workflows, move to a new facility, experience an incident, or make another significant organizational change.

Document Findings and Mitigation Actions

Good risk analysis documentation records what you assessed and how you reached your conclusions. Include the ePHI and systems in scope, information sources reviewed, identified threats and vulnerabilities, existing safeguards, and your assessment of likelihood and potential impact.

For each finding, record the planned response. Specify the mitigation action, the person responsible, a target date, and how you will confirm completion. For example, a finding about shared user accounts might lead to individual accounts, revised access permissions, and a review of access logs.

Document risks you accept as well as those you reduce or address in another way. Record the rationale, approvals, and any remaining risk. Keep the assessment and related policies, procedures, and action records together so you can review progress and update them as circumstances change.

Establish Business Associate Agreements

Determine whether your lab is acting as a business associate for each organization that shares PHI with you. A lab may have business associate obligations when it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. The answer depends on the parties’ roles and arrangement; receiving patient information alone does not settle the question in every case.

When a business associate agreement (BAA) is required, put it in place before the relevant work begins. The agreement should describe permitted uses and disclosures, require appropriate safeguards, address reporting of security incidents and breaches, and set terms for handling PHI when the relationship ends.

Review agreements with subcontractors that may handle ePHI, such as cloud, IT, or data-processing providers. If your lab is a business associate, make sure any subcontractor handling ePHI agrees in writing to applicable privacy and security protections.

Implement Technical Safeguards

Choose technical safeguards based on the risks you identified. Use unique user accounts and grant each worker only the access needed for assigned duties. Review permissions when responsibilities change and promptly disable accounts when access is no longer needed.

Consider multifactor authentication, especially for remote access and systems containing ePHI. Protect data when it is transmitted and stored, secure devices used outside the lab, and configure backups so they are protected and can be restored.

Use audit controls to record and review activity in systems that contain or process ePHI. Logs can help you spot unusual access, investigate suspected incidents, and determine whether records were viewed or changed. Set clear procedures for reviewing alerts and retaining relevant records.

Technical tools work best alongside physical and administrative safeguards. Secure workstations and network equipment, protect paper records, establish clear handling procedures, and limit access to areas where patient information is visible.

Train the Workforce on Privacy and Security

Train employees and other workforce members on how to recognize, handle, and protect PHI in the lab’s actual workflows. Explain how to verify recipients before sending prescriptions or scans, keep credentials private, lock unattended workstations, and report suspected errors or security incidents promptly.

Use examples relevant to orthotic production, such as a patient label left at a shared printer, an order sent to the wrong clinic, or a suspicious attachment that appears to contain a prescription. Make clear whom staff should contact and what information to provide when reporting a concern.

Provide training when people join the workforce and when policies, systems, or risks change. Keep records of training and reinforce expectations through periodic reminders and supervision.

Maintain and Test an Incident Response Plan

Create a written plan for handling suspected or confirmed security incidents. Define how staff report concerns, who leads the response, and how the lab will contain an event, preserve evidence, investigate what happened, and restore systems or data.

Include steps for assessing whether ePHI may have been affected and for coordinating with covered entities, business associates, insurers, or other relevant parties. Follow applicable agreements and notification requirements, and document the incident, decisions, actions, and lessons learned.

Test the plan periodically with a tabletop exercise or another practical scenario. HIPAA does not specify a single testing interval for every lab, so choose a schedule that fits your risks and operations. Retest after major system or workflow changes, significant incidents, or findings that show the plan needs improvement.

In summary, map where PHI flows, assess and document ePHI risks, assign mitigation actions, and reinforce safeguards through agreements, access controls, workforce training, and incident response exercises. Review the assessment as your lab’s systems and operations change.

FAQs

What protected health information should a custom foot orthotic lab include in its HIPAA risk assessment?

Include all ePHI the lab creates, receives, maintains, or transmits, such as patient identifiers connected to prescriptions, foot scans, images, measurements, order records, and related communications. Map the systems, devices, people, and vendors that handle this information, including email, CAD tools, production systems, cloud services, backups, and remote access. Paper PHI can also help identify where information enters or moves into electronic workflows.

How should a lab document and mitigate identified security risks?

Record the systems and information assessed, identified threats and vulnerabilities, existing safeguards, and the likelihood and potential impact of each risk. For each finding, document the action, responsible person, target date, and method for verifying completion. Also record accepted risks, the reasons for accepting them, approvals, and any remaining risk.

When does a custom foot orthotic lab need a business associate agreement?

A BAA is generally needed when the lab acts as a business associate by creating, receiving, maintaining, or transmitting PHI on behalf of a covered entity or another business associate. Whether the agreement is required depends on the parties’ roles and the nature of their relationship. Review the arrangement before handling PHI, and address subcontractors that will handle ePHI.

How often should a lab test its incident response plan?

HIPAA does not set one fixed testing interval for every lab. Test the plan periodically based on your risks and operations, and repeat the exercise after significant system or workflow changes, incidents, or lessons that show the response needs improvement. A tabletop exercise can help staff practice reporting, decision-making, containment, and coordination.