Case Study: Information Security Risk Assessment for a Small Healthcare Clinic Using the Security Risk Assessment Tool Provided by HealthIT.gov

摘要

Information security risk assessments in the healthcare industry are legally required and demand an ongoing investment of time and resources. Small clinics, in particular, are less likely to have streamlined processes in place to meet these requirements. In this case study, we evaluate a small dental clinic using an assessment tool recommended by the federal government to cover the main benchmarks required by law. We found that the clinic owner demonstrated a proactive approach which balances security needs with business functionality. We identified several areas where improvements could be made, which included addressing vulnerabilities, improving communication with key business associates, and creating an appropriate level of documentation to validate existing processes. This clinic is likely ahead of the security curve and yet still was found to be vulnerable in key areas, a cautionary tale for other healthcare providers who have yet to initiate serious efforts in this area.