Our previous article covers what a risk analysis is and why it matters. This one is the how.

This is written for a practice of five to fifty people without a dedicated compliance officer. If that is you, this is a two to three day exercise, not a six month project.

Step 1. Inventory where ePHI lives. Walk the building. Every workstation, laptop, tablet, phone, server, printer with a hard drive, backup device and USB drive. Then every cloud service: EHR, practice management, billing, email, storage, patient communications, telehealth. Then every third party that receives data from you.

Most practices find something they had forgotten. That is the point of walking rather than remembering.

Step 2. Map how data moves. Where does it enter, where does it go, where does it leave. The gaps show up in the movement rather than the storage.

Step 3. List realistic threats for each. Ransomware, theft, loss, insider error, vendor compromise, failed backup. Keep it plausible rather than exhaustive.

Step 4. Record what you already do about each. Encryption, access control, backup, training, agreements. Be honest where the answer is nothing.

Step 5. Rate each risk. Likelihood against impact. A simple high, medium, low is fine and is far more useful than a scoring system nobody maintains.

Step 6. Write the remediation plan. What you will fix, who owns it, by when. Not everything at once.

Step 7. Date it and diary the next one. Annually, or whenever you change a major system.

Two Arizona specifics

If a breach happens, Arizona gives you 45 days from determination to notify affected individuals, which is tighter than the federal 60. Knowing that in advance changes how you plan your response.

And if 1,000 or more Arizona residents are affected, the Attorney General and the consumer reporting agencies must be notified in the same window.

The mistake to avoid

Do not outsource this to someone who will not walk your building. A risk analysis produced from a questionnaire describes a generic practice. Yours has a machine in a back room that nobody has logged into since 2021, and that is exactly the sort of thing this exercise exists to find.