Security Risk Assessment Guide for Pediatric Myopia Control Clinics

What Does a HIPAA Security Risk Analysis Require?

A HIPAA Security Rule risk analysis is an accurate, thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) your clinic creates, receives, maintains, or transmits. It is not simply a checklist or a review of whether security products are installed: you must consider how your clinic’s systems and workflows operate and whether safeguards are configured and used appropriately. See HHS guidance on Security Rule risk analysis.

The analysis should identify where ePHI is located, reasonably anticipated threats and vulnerabilities, existing security measures, and the likelihood and potential impact of risks. Use those findings to decide whether safeguards reduce risk to a reasonable and appropriate level for your clinic. The Security Rule requires administrative, technical, and physical safeguards, but the appropriate measures depend on your environment; a risk analysis is not a guarantee that a clinic is “HIPAA certified.” Learn more from HHS’s overview of the HIPAA Security Rule.

Risk analysis and risk management are related but distinct: the analysis identifies and assesses risks; risk management implements and tracks measures to address them. Document the assessment and decisions. HIPAA does not prescribe one required assessment template or a universal annual certificate or training-renewal schedule.

Which Systems and Locations Store or Transmit Pediatric Patient Information?

Build an inventory of the places ePHI is stored, received, created, or transmitted, including systems hosted by vendors and devices used away from the clinic. For a pediatric myopia control practice, consider whether patient-identifiable information appears in:

• Electronic health records, practice-management tools, scheduling, billing, claims, and patient portals.
• Clinical records and images, such as refraction history, prescriptions, axial-length measurements, corneal topography, retinal images, and myopia-management plans.
• Diagnostic instruments, imaging equipment, workstations, local drives, removable media, and connected devices, if they store or can access identifiable patient information.
• Email, messaging, telehealth, file-sharing, online forms, appointment reminders, and backup or disaster-recovery systems.
• Optical dispensing, lens ordering, and payment workflows when patient-identifiable information is included.
• Paper records and physical locations where staff access electronic records, including reception areas, exam rooms, imaging rooms, and off-site work locations.

Record what information each system holds, who can access it, how it moves between systems, where it is backed up, and which outside parties support it. A data-flow map can help reveal copies or connections that are easy to miss, such as exported reports, email attachments, and device-service access. HHS recommends identifying where ePHI is stored, received, maintained, and transmitted as part of risk analysis.

How Can Clinics Assess Cybersecurity, Workforce, and Environmental Threats?

Assess threats that could affect confidentiality, integrity, or availability—not only malicious attacks. Cybersecurity risks may include phishing, stolen credentials, ransomware, insecure remote access, unsupported software, misconfigured cloud storage, lost devices, and unprotected data transfers. Consider whether access is appropriately limited, user activity can be reviewed, and backups can support recovery.

Review workforce and operational risks as well. Examples include staff sharing accounts, excessive access, delayed removal of access after a role change or departure, sending information to the wrong recipient, or handling records without following clinic procedures. Check that workforce members receive training on your clinic’s policies and know how to report suspected security incidents.

Include physical, natural, and environmental threats: theft, unauthorized entry, fire, water damage, power or network outages, and equipment failure. HIPAA’s physical safeguards address facility access, workstation use and security, and device and media controls; they apply whether systems are located at your clinic or elsewhere. See HHS guidance on physical safeguards.

What Clinic-Specific Exposure Points Should Be Reviewed?

Trace a typical visit from scheduling through follow-up. Check how staff verify a child’s identity and an adult’s authority to access the child’s records, how measurements and images are entered or transferred, and how clinicians communicate results and treatment plans. Review the full workflow rather than assuming that a device or application is in scope—or out of scope—without checking whether it stores, processes, or can access ePHI.

Look for information visible or accessible to people who do not need it. Examples include patient names displayed on waiting-room screens, charts left at reception, imaging workstations positioned where visitors can view them, printed lens orders left unattended, and staff conversations that reveal patient details. Review shared exam-room devices, unattended sessions, paper sign-in processes, printed labels, and disposal of paper or electronic media.

Also inspect less obvious connections: staff smartphones used for work, remote access, vendor-maintained diagnostic equipment, shared mailboxes, old user accounts, and exported spreadsheets. These examples are review prompts; include them in your inventory when they apply to your clinic’s actual systems and workflows.

How Should Vendors and Business Associates Be Assessed?

Identify vendors and other outside parties that create, receive, maintain, or transmit ePHI on your clinic’s behalf. Depending on their services and access, these may include EHR or cloud providers, billing companies, IT support, imaging or device-service vendors, and patient communication platforms. HIPAA generally requires a business associate agreement (BAA) when a business associate handles PHI on behalf of a covered entity. HHS describes the definition and examples in its Business Associates FAQs.

Confirm that each applicable BAA covers permitted uses and disclosures, appropriate safeguards, incident and breach reporting, subcontractors, and the return or destruction of information when the relationship ends, as applicable. Then assess the practical risk: what information the vendor can access, whether access is necessary and limited, how the vendor reports incidents, and how your clinic can retrieve records or maintain care if the service becomes unavailable.

A BAA is important, but it does not replace your clinic’s own risk analysis or review of vendor-related risks. Conversely, do not assume every company that provides a service needs a BAA: the relationship and whether it handles PHI on the clinic’s behalf matter. See HHS’s sample business associate agreement provisions.

How Should Findings Be Documented and Risk Mitigation Assigned?

For each finding, document the affected information or system, the threat and vulnerability, existing safeguards, the likelihood and potential impact, and the clinic’s risk determination. Record the rationale for decisions, including why a particular safeguard is appropriate or what alternative measure addresses the risk. HHS states that the risk analysis must be documented but does not require a specific format.

Turn findings into an actionable risk-management plan. Assign an owner and target date to each action, identify the resources or approvals required, and record progress and any remaining risk. For example, a finding about former staff accounts might lead to a defined access-removal procedure and periodic account review; a finding about an unprotected workstation might lead to repositioning the screen and reinforcing workstation safeguards.

Keep the assessment, policies, procedures, and records of required actions in written or electronic form, and update documentation when environmental or operational changes affect ePHI security. HIPAA’s documentation rule generally requires retaining required documentation for six years from its creation or the date it was last in effect, whichever is later. See 45 CFR § 164.316.

When Should Access Rules and Breach Notification Duties Be Reviewed?

Review access rules when staff join, leave, or change roles; when the clinic adds or replaces systems; when vendors or workflows change; and when a security incident reveals a weakness. Check whether each user’s access remains appropriate, whether unique accounts and authentication are used, and whether system activity can be reviewed. HHS identifies access control, audit controls, authentication, and transmission security among the Security Rule’s technical safeguards.

For pediatric records, review access processes when parental authority or custody information changes, when the child’s legal status or age changes, and when a request involves care that may be subject to a minor-consent exception. HIPAA generally treats a parent as a minor child’s personal representative, but exceptions and state or other applicable law can affect access. Confirm authority and apply the relevant law and clinic procedures before granting or changing access; see HHS guidance on parental access to minor children’s medical records.

Maintain and review written procedures for responding to security incidents and evaluating whether an impermissible use or disclosure is a breach. A breach of unsecured protected health information (PHI) generally requires notification unless an applicable exception applies or the clinic documents a low probability that the PHI was compromised based on the required assessment. For covered breaches, individual notice must be made without unreasonable delay and no later than 60 days after discovery; other reporting duties depend on the circumstances. See HHS’s Breach Notification Rule guidance.

In short, maintain a current ePHI inventory, assess clinic-specific threats and safeguards, document and assign mitigation actions, and revisit access and incident procedures when people, systems, vendors, or circumstances change.

FAQs

How often should a pediatric myopia control clinic update its security risk assessment?

HIPAA does not set one fixed interval for completing a comprehensive risk analysis. HHS says the process should be ongoing, with updates as needed based on the clinic’s circumstances. Review it when significant changes occur—such as a security incident, new technology, changes in ownership or key staff, or altered operations—and establish a periodic review schedule suited to your clinic. See HHS guidance on periodic review and updates.

What systems must be included in an ePHI inventory?

Include the systems and devices that create, receive, maintain, or transmit identifiable electronic health information, including those managed by vendors. Depending on your clinic’s actual workflows, this can include the EHR, scheduling and billing platforms, portals, diagnostic and imaging systems, email, backups, mobile devices, file-sharing services, and vendor-supported equipment. Document connections and copies of information, not just the main record system.

When does a clinic need a business associate agreement?

Generally, a clinic needs a BAA when an outside person or organization—other than a workforce member—creates, receives, maintains, or transmits PHI on the clinic’s behalf or provides a service involving PHI. The details of the relationship matter; a vendor’s mere connection to healthcare does not automatically make it a business associate. Consult HHS’s Business Associates FAQs when assessing a particular service.

How can changing parental access affect pediatric health records?

A change in custody, guardianship, or decision-making authority may affect who can act as the child’s personal representative, so review the relevant documentation and applicable state law before changing access. HIPAA generally permits parental access as a personal representative, but exceptions apply, including certain care a minor can consent to independently. Follow the clinic’s verification and escalation procedures, and seek legal guidance when the applicable rules are unclear.