EHR Availability Risk at a 25-Bed Critical Access Hospital
Riverside Critical Access Hospital is a 25-bed facility with 14,000 active patients, three IT staff, and a 2019 on-premises EHR. Eleven days ago a failed RAID controller took the EHR offline for six hours; clinicians used paper order sets, and two medication orders were transcribed late. The hospital has no failover cluster. A HIPAA security risk analysis was last completed in 2021 and lists EHR availability as medium. The CIO requests $450,000 for a high-availability pair plus a replicated data center. The CFO proposes a $40,000 backup appliance and a promise to revisit failover in three years. The board asks the newly hired security officer to score the risk and recommend a treatment plan before the next capital cycle. The vendor supports neither option fully and will only certify the $450,000 design.
1. How should the security officer score and prioritize the EHR availability risk, and what assumptions must be documented?
Read the worked answer
Score the risk as high, not medium, and document why the 2021 rating is stale. Use a defined likelihood-impact matrix rather than a vendor label. Impact should be weighted toward patient safety: delayed medication orders, paper-order transcription errors, diversion of clinical staff, and inability to retrieve records during emergencies. Likelihood is not remote because a six-hour outage already occurred and there is no failover. Separate inherent risk from residual risk. Record assumptions explicitly: backup restore time, whether backups are encrypted and tested, how long paper processes remain safe, the number of simultaneous users, RAID controller failure rate, vendor support terms, and the clinical areas most affected. Note uncertainty instead of hiding it. Do not let the CFO's price determine the score. The risk register entry should name the owner, review date, and trigger for escalation. The board should see that the score reflects patient harm and regulatory exposure, not just replacement cost.
2. Recommend a treatment plan and explain how to handle the CFO's lower-cost option.
Read the worked answer
Treat the risk in phases. The $40,000 appliance is acceptable only as an interim compensating control if restore is tested quarterly, a spare RAID controller is stocked, downtime procedures are drilled with pharmacy and nursing, and paper orders are reconciled within a defined window. Even then, residual risk remains high because the appliance does not provide automatic failover during a controller failure. The CFO's option therefore does not meet the same risk appetite as the $450,000 design unless leadership formally accepts the residual risk. Require a written, time-limited risk acceptance from the CEO or board, with triggers such as a second outage, failed restore test, or ransomware near-miss. Fund the high-availability design in the next capital cycle, but do not delay the interim controls. Transfer through cyber insurance does not reduce the operational risk. Report back with measurable indicators: restore test results, downtime minutes, paper-order reconciliation errors, and remediation milestones. This gives the board a defensible decision rather than a binary budget argument.