Volunteer-Run Free Clinic Security Risk Assessment Checklist

This Volunteer-Run Free Clinic Security Risk Assessment Checklist helps you identify, prioritize, and remediate risks while safeguarding Patient Data Confidentiality and maintaining Legal Compliance Regulations. Use it to standardize practices, drive accountability, and build a culture of privacy and safety across your clinic.

Security Risk Assessment

Scope and governance

• Define assessment scope: people, processes, technology, facilities, and third parties supporting care delivery and administration.
• Assign an owner (security lead or board designee) and establish reporting to clinic leadership with clear decision authority.
• Create a risk register with categories (privacy, cyber, physical, operational) and set review cadence (quarterly minimum).

Identify assets and threats

• Inventory assets: Electronic Health Record Security systems, laptops, paper records, medical devices, mobile phones, keys, badges, backups.
• Map data flows from intake to discharge, including cloud services and referrals.
• List realistic threats: lost devices, unauthorized access, phishing, misdirected email, social engineering, theft, fire, and severe weather.

Analyze and prioritize

• Rate likelihood and impact; calculate risk levels to focus on high-value controls first.
• Document existing controls and control gaps for each asset and process.
• Define risk treatment plans (accept, mitigate, transfer, avoid) with owners and deadlines.

Validate and iterate

• Test controls through spot checks, tabletop exercises, and walk-throughs of Physical Access Controls and digital safeguards.
• Track metrics: closed risks, time-to-remediate, training completion, incident counts, and audit findings.
• Reassess after major changes (new EHR, facility move, new programs) and update the risk register.

Patient Information Privacy

Foundations of Patient Data Confidentiality

• Apply the minimum necessary standard: access, use, and disclose only what you need to perform your role.
• Obtain and document consent where required; verify patient identity before sharing information.
• Prevent overheard conversations; use private rooms or low voices and avoid discussing cases in public areas.

Handling paper and verbal data

• Store paper charts in locked cabinets; maintain sign-out logs for retrieval and return.
• Use cover sheets in shared areas; turn documents face-down; never leave files unattended.
• Dispose via secure shred bins; prohibit home storage or transport unless approved and logged.

Digital privacy safeguards

• Use clinic-approved messaging and patient portals; prohibit unencrypted texting or personal email for clinical details.
• Enable automatic screen locks and privacy filters on shared workstations.
• Log access and regularly review EHR audit trails for inappropriate viewing or changes.

Document how your privacy program meets applicable Legal Compliance Regulations and keep policies, attestations, and training records current.

Access Control

Logical access (systems and apps)

• Issue unique user IDs; prohibit shared accounts; require strong passwords and multi-factor authentication.
• Apply role-based access control (RBAC) aligned to duties; enforce least privilege and time-bound access for temporary volunteers.
• Implement joiner-mover-leaver procedures to provision, modify, and revoke access within 24 hours of role changes.
• Set automatic session timeouts on kiosks and shared terminals; restrict remote access through VPN with MFA.

Physical Access Controls (premises and records)

• Use keys or badges with photo ID; keep a visitor log; escort non-staff at all times in restricted areas.
• Lock server/network rooms, medication storage, and records areas; limit keys to authorized roles only.
• Maintain key/badge inventory, lost/stolen reporting, and immediate deactivation procedures.

Data Security

Data Encryption Standards and device protection

• Encrypt data at rest (for example, AES-256) on servers, laptops, and mobile devices; enable full-disk encryption and secure boot.
• Encrypt data in transit using TLS 1.2 or higher; disable insecure protocols and ciphers.
• Deploy mobile device management (MDM) to enforce screen locks, remote wipe, and app restrictions.

Electronic Health Record Security controls

• Harden EHR configurations: RBAC, MFA, audit logging, and alerting for anomalous access.
• Segment clinical and administrative networks; restrict EHR access to approved IP ranges where feasible.
• Schedule regular backups, offsite or cloud-redundant, and test restore procedures at least twice a year.

Secure operations

• Patch operating systems and applications promptly; maintain antivirus/EDR and block unauthorized USB devices.
• Use approved cloud storage with access logs; apply data loss prevention policies for downloads and sharing.
• Assess vendors handling clinic data; require security assurances aligned with Legal Compliance Regulations.

Facility Security

Perimeter and interior protections

• Ensure adequate lighting, cameras covering entrances/exits, and clearly marked restricted zones.
• Position reception to observe the waiting area; post visitor procedures and privacy notices at check-in.
• Secure storage for paper records and devices after hours; lock down printers and fax machines in non-public spaces.

Safety and continuity

• Install panic buttons or emergency numbers at reception and triage; keep first-aid and spill kits available.
• Maintain fire extinguishers, smoke detectors, and surge protection for critical systems.
• Document evacuation, shelter-in-place, and backup power plans; conduct regular drills.

Staff Training

Volunteer Security Training program

• Deliver onboarding covering privacy principles, acceptable use, secure communications, and Incident Reporting Protocols.
• Use role-based modules for clinicians, front-desk, interpreters, and IT helpers; require annual refreshers.
• Run phishing awareness and social engineering simulations; teach verification procedures for unusual requests.

Accountability and culture

• Collect signed confidentiality agreements and track completion in a training log.
• Appoint security champions per shift to answer questions and spot risks.
• Reinforce “see something, say something” with simple reporting channels posted in work areas.

Incident Response

Prepare

• Define an incident severity matrix and on-call contacts; store an incident playbook accessible offline.
• Pre-assign roles: incident lead, communications, technical triage, facilities, and legal/compliance liaison.
• Create incident forms to capture who, what, when, systems involved, data types, and actions taken.

Detect and contain

• Encourage prompt reporting of suspicious emails, lost devices, or unusual EHR activity.
• Isolate affected devices from networks; change credentials and revoke tokens where needed.
• Preserve evidence (logs, emails, device state) following chain-of-custody practices.

Eradicate, recover, and notify

• Remove malicious software, close access gaps, and patch vulnerabilities.
• Restore from clean backups; validate system and data integrity before returning to service.
• Follow Legal Compliance Regulations for breach assessment and notification; document rationale and timelines.

Post-incident improvement

• Conduct an after-action review within two weeks; capture lessons, update policies, and adjust training.
• Track remediation tasks to completion and report outcomes to leadership and the board.

Strong preparation, disciplined execution, and continuous learning transform incidents into improvements—protecting your patients, volunteers, and mission.

FAQs

What are the key components of a security risk assessment?

Define scope and ownership, inventory assets and data flows, identify realistic threats, evaluate likelihood and impact, document existing controls and gaps, prioritize treatments with deadlines, and verify progress through testing and metrics. Update the risk register after material changes and on a regular cadence.

How can volunteers protect patient information?

Access only what your role requires, verify identities, avoid public discussions, secure paper records, lock screens, use approved messaging or portals, and never email or text PHI unencrypted. Report lost devices or misdirected messages immediately using Incident Reporting Protocols.

What measures ensure secure access control?

Use unique IDs, strong passwords, and MFA; implement RBAC and least privilege; enforce session timeouts; and promptly revoke access when roles change. For Physical Access Controls, lock sensitive areas, issue badges or keys with logs, escort visitors, and deactivate lost credentials at once.

How should incidents be reported and documented?

Report immediately via the clinic’s designated channel (phone, form, or email). Capture who discovered the issue, what happened, when and where, systems or records involved, containment steps taken, and current status. The incident lead should preserve evidence, classify severity, coordinate notifications per Legal Compliance Regulations, and complete an after-action review.