A missing or inadequate HIPAA Security Risk Assessment (SRA) can leave a major gap in your HIPAA compliance program. It is also one of the issues most frequently identified in OCR enforcement actions. Yet many practices remain uncertain about what an SRA should cover, how often it should be updated, and what distinguishes a genuine risk analysis from a simple checklist.

Read the full article at HIPAA Journal →