Sports Medicine and Athletic Training Clinic Security Risk Assessment Checklist

How to conduct and document a recurring security risk assessment

A recurring security risk assessment helps your sports medicine or athletic training clinic identify threats to patient information and clinical operations, evaluate existing safeguards, and plan improvements. If your clinic is a HIPAA covered entity or business associate, the Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). HHS explains that the assessment should cover ePHI your organization creates, receives, maintains, or transmits. HHS guidance on risk analysis

Use a repeatable process that includes people who understand your clinical workflows, technology, facility, and emergency procedures. Document the scope, assessment date, participants, methods, systems and locations reviewed, findings, risk ratings, and decisions. A checklist or assessment tool can help organize the work, but using a tool alone does not establish that your clinic is HIPAA compliant. HHS Security Risk Assessment Tool user guide

• Identify where patient information is created, received, stored, viewed, printed, and shared.
• Inventory relevant systems, devices, applications, vendors, records, and work areas.
• Consider threats such as unauthorized access, theft, fire, water damage, power loss, equipment failure, and malicious software.
• Record existing safeguards and gaps, then assess the likelihood and potential impact of each risk.
• Track each decision, corrective action, owner, due date, and verification of completion.

HHS does not prescribe one assessment format or a universal calendar interval. Its guidance emphasizes an ongoing process that is revisited as the clinic’s environment and risks change. HHS guidance on risk analysis

Which facility and equipment safeguards should the checklist cover?

Walk through every space where patients, staff, visitors, or vendors may encounter equipment, records, or systems. Consider reception and waiting areas, treatment rooms, rehabilitation gyms, storage rooms, staff offices, server or network closets, and any off-site locations used for clinic work.

• Entry and access: Review door locks, keys, badges, visitor procedures, after-hours access, and how access is removed when a worker or vendor no longer needs it.
• Workstations and devices: Check the placement and physical security of computers, tablets, phones, printers, scanners, and connected clinical equipment. Confirm that screens and printed documents are not visible to people who should not see them.
• Equipment and infrastructure: Review protection for networking equipment, power supplies, backup media, and devices that support EHR access or treatment. Identify who maintains each device and how failures are reported.
• Paper and portable media: Check how paper records, labels, removable drives, and other storage media are secured, transported, retained, and disposed of.
• Environmental threats: Consider fire, leaks, severe weather, temperature problems, power interruptions, and other conditions that could damage equipment or interrupt access to information.
• Hazardous materials handling: Review how cleaning products and other hazardous chemicals are identified, stored, and handled, and whether relevant safety information is accessible to exposed staff. OSHA describes hazard communication requirements that can include labels, safety data sheets, and worker information and training. OSHA Hazard Communication Standard

For each safeguard, note what you observed, who or what could be affected, and whether the control works in practice. A written policy is not enough if staff cannot follow it or a physical control is routinely bypassed.

How to assess patient privacy and electronic health information security

Trace protected health information (PHI) through the clinic’s actual workflows: scheduling, intake, examination, rehabilitation, billing, referrals, communication with patients, and record retention. Include both electronic records and paper or verbal disclosures. Focus on where information could be viewed, changed, lost, or shared with the wrong person.

• EHR access controls: Review whether each user has an individual account and access appropriate to their role. Check how accounts are approved, changed, disabled, and reviewed when job duties change or employment ends.
• Authentication and sessions: Assess password practices, multifactor authentication where used, automatic screen locking, and access from mobile or remote devices.
• Encryption at rest and in transit: Identify where ePHI is stored or transmitted and whether encryption is used. Under the HIPAA Security Rule, encryption is an addressable implementation specification: the clinic must assess whether it is reasonable and appropriate and document its decision and any alternative measures. HHS guidance on encryption
• Audit log monitoring: Confirm that systems record and examine activity involving ePHI. Decide how your clinic will review relevant logs, recognize unusual access, escalate concerns, and document follow-up. The HIPAA Security Rule requires audit controls but does not set one universal review schedule or list of events to monitor. HHS guidance on technical safeguards
• Backups and vendors: Review backup access, restoration testing, and the safeguards used by service providers that handle ePHI. Check that required business associate agreements are in place when applicable.
• Privacy in daily workflows: Observe conversations at reception, screen positioning in treatment areas, printed schedules, shared workstations, and how staff verify recipients before sending records.

Record which controls are in place, what evidence you reviewed, and what remains uncertain. HHS describes the Security Rule as requiring safeguards appropriate to protect ePHI and an ongoing process of reviewing and updating security measures. HHS summary of the HIPAA Security Rule

What staffing policies and training should be reviewed?

Review the policies and practices that shape how employees, contractors, students, and other workforce members handle patient information and clinic systems. Check whether responsibilities are clearly assigned and whether the procedures match how people actually work.

• Confirm that the clinic has assigned responsibility for security oversight and knows who staff should contact with a concern.
• Review hiring, onboarding, role changes, termination, account approval, and access-removal procedures.
• Check policies for acceptable technology use, remote access, mobile devices, passwords, information sharing, and incident reporting.
• Review security awareness and training records, including whether staff know how to protect ePHI and report suspected incidents.
• Verify that training addresses clinic-specific risks, such as unattended treatment-room workstations, shared devices, misplaced paperwork, and inappropriate photography or messaging.
• Review whether staff know the correct procedures for handling hazardous materials relevant to their work, including where to find safety data sheets and how to report a spill or exposure.

HIPAA requires a security awareness and training program for workforce members, including management. That does not mean federal law establishes a universal annual certificate-renewal schedule; assess your clinic’s policies, workforce needs, and applicable requirements, and document how training is provided. HHS summary of the HIPAA Security Rule

How to evaluate emergency response and downtime plans

Assess how the clinic would protect patients, staff, and information during a disruption such as a cyber incident, fire, severe weather, power outage, internet failure, or EHR outage. Review the clinic’s emergency operations plan (EOP) alongside its information-system contingency procedures. An EOP supports broader emergency response; HIPAA’s contingency plan addresses emergencies or other events that damage systems containing ePHI. HHS summary of the HIPAA Security Rule

• Confirm that staff know how to report an emergency or suspected security incident and who has authority to coordinate the response.
• Review procedures for protecting ePHI, maintaining essential clinical operations, and communicating with patients when systems are unavailable.
• Check that backup procedures create retrievable copies and that restoration steps are documented and tested.
• Review how staff will access necessary information and record care during downtime, then reconcile records when systems return.
• Assess arrangements with vendors and other partners whose services are needed for recovery.
• Document test results, gaps, lessons learned, and follow-up actions.

HHS identifies data backup, disaster recovery, and emergency-mode operations among the contingency planning safeguards to consider. HHS HIPAA Audit Protocol

How to prioritize findings and assign corrective actions

Rank findings using a consistent method that considers the likelihood of an event, its potential impact on patients and clinic operations, the sensitivity and availability of affected information, and the strength of existing safeguards. A risk score can help organize decisions, but explain how the score was assigned so clinic leaders can understand and revisit it.

Maintain Remediation plan tracking in a register that gives each finding a unique identifier and includes:

• A clear description of the risk, affected systems or workflows, and evidence reviewed.
• The likelihood, impact, priority, and rationale for the rating.
• The selected response, such as reducing the risk, accepting it with documented rationale, or pursuing another appropriate option.
• A named owner with authority to carry out the work, supporting resources, and a target completion date.
• The status, interim safeguards, completion evidence, and date the action was verified.

Assign corrective actions to people with the right operational or technical responsibility—for example, a clinic manager, privacy or security lead, IT administrator, facilities contact, or vendor liaison. Leadership should approve priorities and unresolved risks, while action owners provide progress updates. HHS describes risk analysis as informing risk management, which involves implementing measures to reduce identified risks. HHS explanation of risk analysis and risk management

When should the clinic reassess security risks?

Set a recurring review schedule that reflects the clinic’s size, operations, technology, and risk environment, and reassess sooner when a meaningful change could affect ePHI or patient care. HIPAA does not specify one fixed interval for conducting risk analysis; HHS guidance says frequency depends on the organization and its circumstances. HHS guidance on risk analysis

Trigger an earlier review when the clinic introduces or changes an EHR, connected treatment equipment, a vendor, a location, remote-access process, or information-sharing workflow. Also revisit risks after a security incident, a significant facility change, changes in key staff or management, or a test that reveals gaps in the EOP or downtime procedures. Document what changed, whether prior risk ratings remain valid, and which actions need to be updated.

Use the assessment as a continuing cycle: identify risks, document evidence, prioritize findings, assign corrective actions, and verify that the chosen safeguards remain effective as the clinic changes.

FAQs

How often should a sports medicine clinic conduct a security risk assessment?

There is no universal HIPAA-mandated calendar interval. Establish a recurring schedule suited to your clinic’s circumstances and reassess when significant operational, technology, staffing, or security changes occur. HHS characterizes risk analysis as an ongoing process. HHS guidance on risk analysis

What should be documented for each identified security risk?

Record the risk and affected information, systems, locations, or workflows; the evidence reviewed; existing safeguards; likelihood and potential impact; risk rating and rationale; planned response; responsible owner; target date; progress; and evidence that completed actions were verified.

Who should be responsible for corrective actions?

Assign each action to a named person with the authority and expertise to complete it, such as a clinic manager, IT administrator, facilities lead, or vendor contact. A designated security lead can coordinate tracking, while clinic leadership approves priorities and addresses unresolved risks.

When should a clinic update its risk assessment after operational or technology changes?

Review the assessment when planning a change that may affect ePHI or clinical operations, and update it as needed after implementation. Examples include adopting or changing an EHR, adding connected equipment, changing vendors or locations, expanding remote access, reorganizing staff responsibilities, or responding to a security incident.