HIM 530 Module 5 Final Project Milestone Two Example

Final Project Milestone Two: From Register to Response, a Risk Management Plan for Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Final Project Milestone Two

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Final Project Milestone Two: From Register to Response, a Risk Management Plan for Osprey Point Health

Milestone One produced a risk register for Osprey Point Health with eight significant risks scored from 6 to 20. A register without a plan is only a list of worries. Under the Security Rule, a hospital must put in place measures that bring risks down to a reasonable and appropriate level, and this milestone sets out how Osprey Point will do that: which response each risk receives, which controls will be implemented, who owns them, what they cost, when they will be done and how much risk remains afterward.

Four Ways to Respond to Risk

Every risk can be handled in one of four ways. Mitigation reduces likelihood or impact through controls. Transfer shifts part of the consequence to another party, such as through cyber insurance or contract terms with a vendor. Avoidance removes the activity that creates the risk, such as retiring a system. Acceptance means leaders knowingly tolerate a risk, usually a low one, and document why. Most of Osprey Point's risks call for mitigation, but the plan uses avoidance for the imaging archive over time and acceptance for the lowest-rated risk.

The Plan by Risk

Table 1 summarizes the response for each risk, with its owner, cost, completion date and expected residual score.

Table 1. Risk Management Plan

Note. Plan prepared by the author with the security committee; costs are estimates.

The Reasoning Behind the Top Responses

The imaging archive cannot be patched, so the only fast mitigation is to limit who and what can reach it; isolation cuts likelihood sharply within a month, while migration removes the risk entirely. Argaw et al. (2020) describe legacy systems like this as a characteristic weakness of hospital security, often left in place because replacing them competes with clinical priorities. For phishing, multifactor authentication matters more than training, because it stops a stolen password from being enough, but training still helps. Gordon et al. (2019) found that the odds of clicking a simulated phishing email fell as employees received more simulation campaigns, which supports quarterly exercises rather than one annual course.

Backups deserve priority because they determine how quickly care can resume after ransomware. Year over year, the ransomware incidents cataloged by Neprash et al. (2022) kept rising, and a large share of them interrupted patient care. The effects reach beyond the victim: Dameff et al. (2023) found that when one health system suffered a ransomware attack, neighboring emergency departments saw more patients, longer waits and more ambulance arrivals. Osprey Point is the only large hospital for its coastal region, so a long outage would strain every surrounding facility.

Risks the Plan Could Create

Controls can create new problems, and the plan anticipates three. Isolating the imaging archive could slow radiologists who compare new images with old ones, so the network change will be tested with the radiology department on a weekend and a fast-path request process will exist for urgent retrievals. Multifactor authentication could lock out night staff who forget their phones, so the help desk will offer a temporary code process verified through a supervisor. And restricting vendor access could delay repairs to critical equipment, so vendors will be able to request emergency access by phone with a documented callback. Planning for these side effects reduces the chance that frustrated staff will work around the new controls.

Documenting Acceptance

The lowest risk, loss of a personal mobile phone used in the transfer center, scored 6. Replacing those phones immediately would cost more than the risk justifies, since messages are brief and the phones use screen locks. The chief information officer and privacy officer signed a risk acceptance stating the rationale, the conditions under which it would be revisited and a plan to issue hospital devices at the next hardware refresh. Documented acceptance is itself a control: it proves the risk was considered rather than ignored.

Budget and Sequencing

The plan's first-year cost is about $443,000, of which the archive migration is the largest item. The sequence follows the scores and speed of effect: archive isolation, multifactor authentication, backups and vendor access controls in the first four months, then insider monitoring, device segmentation and archive migration. Cyber insurance renewal next spring provides a second reason to act quickly, since insurers increasingly require multifactor authentication and tested backups as conditions of coverage.

Governance and Tracking

The security steering committee will track each item monthly and report residual risk to the board each quarter. When an item is complete, the owner will provide evidence, such as a report showing multifactor enrollment above 98% or a successful restore test, and the risk score will be updated in the register. If an item misses two target dates, the committee chair takes it directly to the hospital's president.

Conclusion

This plan gives each of Osprey Point's eight risks a documented response, owner, cost, date and expected residual score, bringing the highest risks from 20 to 8 within the year. It uses mitigation where controls work quickly, avoidance where a system cannot be made safe and acceptance where cost outweighs risk. Milestone Three will plan for the incidents that controls cannot prevent.

References

Argaw, S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M.-V., Calcavecchia, F., Anderson, D., Burleson, W., Vogel, J.-M., O'Leary, C., Eshaya-Chauvin, B., & Flahault, A. (2020). Cybersecurity of hospitals: Discussing the challenges and working towards mitigating the risks. BMC Medical Informatics and Decision Making, 20, Article 146. https://doi.org/10.1186/s12911-020-01161-7

Dameff, C., Tully, J., Chan, T. C., Castillo, E. M., Savage, S., Maysent, P., Hemmen, T. M., Clay, B. J., & Longhurst, C. A. (2023). Ransomware attack associated with disruptions at adjacent emergency departments in the US. JAMA Network Open, 6(5), Article e2312270. https://doi.org/10.1001/jamanetworkopen.2023.12270

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873