Completing a HIPAA Risk Assessment Survey

Completing a HIPAA Risk Assessment Survey provides a snapshot of your organization’s HIPAA compliance, helping identify strengths, weaknesses, and potential gaps. As you answer each question, you document findings and assign risk ratings. The results determine whether issues should be added to an Action Plan for follow-up and mitigation.

Follow these steps to complete a HIPAA Risk Assessment Survey task:

1. You can access all tasks by clicking Show All or Go To My Tasks at the bottom of your task list in the workspace, or by selecting My Tasks from the profile menu.

2. Select the HIPAA Risk Assessment type task from the list. You can also use the search bar or the filter panel to find the desired task quickly. A HIPAA Security Risk Assessment window will be displayed.

   

3. Click on Get Started to begin the assessment. A resource that will be helpful to reference is our Knowledge Base article, HIPAA Risk Assessment: Definitions and Resources.

   

4. Each question includes a quick link to the applicable regulation for easy reference. Answer each question by selecting Yes, In Part, No, or Not Applicable.

5. For every question, you may choose to include optional additions:

   • Add Comment - Comments will carry over to the HIPAA Workplan.

   • Include Attachments - When completing your first HIPAA Risk Assessment, it is recommended to attach all relevant supporting documents.

   • Recommended Actions - Selecting this option helps automate the creation of an Action Plan if the assessment is later sent to Workplan.

6. After responding to a question, choose Save & Exit to stop and return later, or Save and Continue to proceed to the next question.

Scoring

The survey is divided into Risk Groups, and each group generates a score based on the responses provided. Objective questions are scored according to the selected answer: Yes, In Part, No, or Not Applicable. Subjective questions contribute to the score by allowing the user to assess both the likelihood of an issue occurring and the potential impact within that Risk Group. Together, these responses determine the overall risk level for each group.

© Healthicity, LLC