Privacy Risk Assessment, Auditing, and Monitoring
Risk Analysis and Management
Risk analysis is the foundational activity: identify threats and vulnerabilities to PHI, assess likelihood and impact, and document results. Risk management then applies safeguards proportionate to the risk. The analysis must be ongoing, not a one-time event, and must cover all systems and locations where ePHI resides, including mobile devices and vendors.
Auditing and Monitoring
Audit controls are technical mechanisms-such as system logs and access reports-that record and examine activity. Monitoring is the ongoing review of those records to detect inappropriate access. Effective programs combine proactive monitoring (periodic access reviews, anomaly detection) with reactive investigation (responding to complaints or audit findings). Findings should feed back into policy updates and training.
Traps Candidates Miss
- Audit logs that are never reviewed do not satisfy the intent of audit controls.
- Risk analysis is required, not merely recommended, and must be documented.
- A gap analysis is not a risk analysis; identifying missing controls differs from assessing risk.
- Monitoring must cover workforce access, including snooping in records of family, neighbors, or public figures.
Rule of Thumb
Treat risk analysis as the "what could go wrong and how bad" step and risk management as the "what we will do about it" step. Questions that describe a control with no documentation or review are usually testing whether you recognize an incomplete program.
Worked Example
A hospital enables logging on its EHR but never reviews the logs. An auditor would find the audit control implemented but monitoring absent. The corrective action is to establish a review schedule, assign responsibility, and document findings and follow-up.