The first step in performing a HIPAA security risk assessment is to be sure you understand what Protected Health Information (PHI) your practice has.

Here’s how Wikipedia defines PHI: “Under the US Health Insurance Portability and Accountability Act (HIPAA), PHI that is linked based on the following list of 18 identifiers must be treated with special care:

  • Names
  • All geographical identifiers smaller than a state, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census: the geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000
  • Dates (other than year) directly related to an individual
  • Phone numbers
  • Fax numbers
  • Email addresses
  • Social Security numbers
  • Medical record numbers
  • Health insurance beneficiary numbers
  • Account numbers
  • Certificate/license numbers
  • Vehicle identifiers and serial numbers, including license plate numbers;
  • Device identifiers and serial numbers;
  • Web Uniform Resource Locators (URLs)
  • Internet Protocol (IP) address numbers
  • Biometric identifiers, including finger, retinal and voice prints
  • Full face photographic images and any comparable images
  • Any other unique identifying number, characteristic, or code except the unique code assigned
    by the investigator to code the data

Where is your PHI?

Next, build a list of all of the places you store PHI. Here are common places we’ve seen at other clients:

  • Desktop computers
  • Laptop computers
  • Servers in your office
  • Servers at a vendor or off-site location
  • Emails you send internally
  • Emails you send externally
  • File sharing sites like Dropbox or Google Drive
  • Business applications like Salesforce.com, electronic medical records, etc.
  • Mobile devices like iPhones, Androids, or tablets
  • Fax machines / Photocopiers / Scanners
  • Old school tech like pagers, dictation machines, etc.
  • File room(s) or Filing cabinets in hallways or people’s offices
  • Paper files stored off-site
  • Backup files on-site or off-site
  • USB / thumb drives
  • Medical devices (like x-ray machines, EKG, EEG, etc.)
  • In a website you run or someone runs on your behalf
  • In a database you run or someone runs on your behalf
  • Transcriptionist service
  • Billing service
  • Collections service
  • Hosted EMR / EHR provider
  • E-Prescriptions
  • Electronic Vaccine Records Exchanges
  • Hosted Email Service
  • Hosted Fax Service
  • Hosted Online Document Storage Service
  • IT company / person

What should you do next?

Get some free help!  Check out our free 42-Point Checklist for ways to make your practice HIPAA compliant.

Talk to us!

Have questions or feedback?  Please share them in the comments below.

Like this article?  Share it!