What is the difference between a HIPAA Gap Analysis and a HIPAA Risk Analysis? Many organizations use these interchangeably, however, they are not correct in doing so. Don’t make the same mistake. We can help you understand the difference.
Office of Civil Rights Requirements
The Office for Civil Rights clearly spelled out the steps and requirements for a HIPAA Security Risk Analysis. As a result, it requires covered entities to conduct an accurate and thorough assessment. It must consider potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the organization. Furthermore, entities must consider the potential risks, threats and vulnerabilities to all of the covered entities ePHI. This includes all ePHI which is created received, maintained or transmitted, including the source or location of the ePHI
Understanding a HIPAA Gap Analysis
The HIPAA Rule does not require a HIPAA Gap Analysis. The Gap Analysis is usually a limited evaluation of a covered entity or business associate’s organization to reveal whether there are certain policies, controls or safeguards required by the HIPAA. As a result, it is important rules are in place and implemented. The HIPAA Gap analysis should begin with a review of all policies, procedures, processes, practices and systems. It must investigate all facilities that relate to privacy, uses and disclosures of PHI.
Gap Analysis Insufficient for HIPAA Rule
A Gap Analysis does not satisfy the Security Risk Analysis requirement. It does not demonstrate an accurate and thorough analysis. In effect, it must consider all risks, threats and vulnerabilities to all of the ePHI an entity creates, receives, maintains or transmits. Consequently, the gap analysis is not equivalent to the risk analysis as it does not satisfy the rule as specified by 45 C.F.R. §164.308(a)(ii)(A). It is important to note that OCR expects a covered entity to document and implement all of the necessary regulations of the HIPAA Rule to obtain a Compliant rating.
Therefore, it is important to identify your covered entity’s needs and determine whether you require a Gap Analysis or Risk Analysis. Assure that the vendor you engage is qualified to perform the specific type of analysis that you need.