Lessons Learned About HIPAA Risk Management Plans  

Category: Security

By: Tod Ferran

Many healthcare entities haven't yet separated the difference between the HIPAA Security Rule and HIPAA Privacy Rule. Because of this confusion, they leave many security regulations unfulfilled. Most practices I've communicated with are trained, strict adherers to the Privacy Rule, but don't understand that the Security Rule is a completely different ballgame.

I'd like to clarify a misperceived section of HIPAA security: The RMP. The Risk Management Plan (RMP) is the compliance step that works through issues discovered in the risk analysis and provides a documented instance proving your active acknowledgement (and correction) of PHI risks and HIPAA requirements.

There are three vastly different approaches to RMP that vary in cost, time, and work required. To my knowledge, every covered entity engaged with HIPAA is using at least one of these methods...