HIM 530 Module 3 Final Project Milestone One Example

Final Project Milestone One: Where the Risk Lives, a Security Risk Analysis for Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Final Project Milestone One

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone One: Where the Risk Lives, a Security Risk Analysis for Osprey Point Health

Osprey Point Health's last enterprise risk analysis was completed in 2021, before the medical center moved most health information staff to remote work, added 11 vendors and connected its infusion pumps to the network. The HIPAA Security Rule requires an accurate and thorough assessment of risks to electronic protected health information, and federal enforcement actions repeatedly cite its absence. This milestone updates the analysis and ranks the risks that the risk management plan in Milestone Two must address.

Scope and Method

The analysis covers all electronic patient information that Osprey Point creates, receives, maintains or transmits, wherever it resides: the record system, ancillary systems, medical devices, workstations, laptops, mobile devices, backups and systems operated by business associates. The method follows federal risk assessment guidance, which frames risk as a function of the likelihood that a threat exploits a vulnerability and the impact if it does (NIST, 2012). The team, including the information protection manager, the information security officer, a clinical engineer and a representative from each major department, gathered information through system inventories, interviews, a review of incident logs and a vendor survey.

Where Patient Data Live

The inventory found patient data in 46 systems. Most are expected, such as the record system, laboratory and pharmacy systems and the billing platform. Several were not on the 2021 list: a cloud-based transcription service, a text-messaging tool used by the transfer center, 212 networked infusion pumps and an imaging archive that stores 11 years of radiology images on a server whose operating system no longer receives security updates. The 38 business associates who hold patient data are also in scope, since a breach at a vendor is still a breach of Osprey Point's patients' information.

Threat Sources Considered

The team considered four kinds of threat sources. Criminal groups seeking ransom or data to sell are the most active against hospitals and favor phishing, stolen credentials and vendor connections. Insiders, whether curious, careless or malicious, already hold access and are harder to detect. Accidents, such as a record sent to the wrong fax number or a misconfigured cloud folder, cause many breaches without any bad intent. And environmental events, including hurricanes that regularly threaten the North Carolina coast, can take systems offline for days. Considering all four prevents the analysis from focusing only on dramatic cyberattacks while missing the everyday errors and storms that are just as likely to cause harm.

Rating Scales

Likelihood and impact are each rated on a five-point scale. Likelihood ranges from 1, rare, not expected within five years, to 5, almost certain, expected within the year. Impact ranges from 1, negligible, with no patient harm and minimal data exposure, to 5, severe, with disruption of patient care, exposure of large volumes of data or major regulatory consequences. Multiplying the two ratings yields a score as low as 1 or as high as 25; anything at 15 and above counts as high, 8 through 14 as moderate and the rest as low. Using defined scales lets others check the ratings and allows scores to be compared from year to year.

Risk Register

Table 1 lists the eight most significant risks identified.

Table 1. Security Risk Register

Note. Ratings by the risk analysis team; composite organization.

Why the Top Risks Rate High

The ratings rest on local facts and published evidence. Credential theft through phishing rates high because 11% of staff clicked the last simulated phishing email and email lacks multifactor authentication; Across the hospitals that Gordon et al. (2019) tested, staff clicked on simulated lures at a similar rate, so Osprey Point is typical rather than exceptional. Ransomware and backup risks rate high on impact because an attack could halt care. The national count by Neprash et al. (2022) showed ransomware against care delivery organizations increased sharply over six years and frequently disrupted care. The imaging archive and infusion pumps illustrate the problem that Argaw et al. (2020) describe in hospitals: legacy systems and connected medical devices that cannot easily be patched but still hold or reach patient data.

What Changed Since 2021

Comparing the new register with the 2021 analysis shows how risk moved. Remote work added home networks and personal spaces to the environment, although laptops are encrypted. Vendor connections nearly doubled. The imaging archive's operating system reached the end of support in 2023. And insider snooping, rated low in 2021, rose after two incidents last year showed that audit logs are not reviewed proactively. The change underlines why the risk analysis must be a recurring process rather than a one-time document.

Limitations

Ratings involve judgment, even with defined scales, and the team may underestimate risks in systems it knows less well, such as vendor-operated platforms. The vendor survey received responses from 29 of 38 business associates, so some vendor risks may be missing. The analysis will be repeated annually and after any major change.

Conclusion

Osprey Point's updated analysis identifies two high risks that share a score of 20, the unsupported imaging archive and credential theft through phishing, followed by vendor remote access and untested backups at 15. These four will be the first priorities for the risk management plan in Milestone Two, with the moderate risks, led by insider snooping and unpatched devices, scheduled close behind.

References

Argaw, S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M.-V., Calcavecchia, F., Anderson, D., Burleson, W., Vogel, J.-M., O'Leary, C., Eshaya-Chauvin, B., & Flahault, A. (2020). Cybersecurity of hospitals: Discussing the challenges and working towards mitigating the risks. BMC Medical Informatics and Decision Making, 20, Article 146. https://doi.org/10.1186/s12911-020-01161-7

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

National Institute of Standards and Technology. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Rev. 1). https://doi.org/10.6028/NIST.SP.800-30r1

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873