Risk Management and Risk Assessment
Domain 6 tests whether you can run a defensible risk process. The exam leans on NIST publications because HIPAA names them as the reference approach.
Definitions that get tested
Risk is a function of the likelihood of a threat event exploiting a vulnerability and the resulting impact. Risk analysis identifies and assesses; risk management treats, tracks, and monitors. NIST SP 800-30 covers the assessment method; SP 800-37 defines the six-step Risk Management Framework (categorize, select, implement, assess, authorize, monitor); SP 800-39 sets three tiers - organization, mission/business process, and information system.
A repeatable method
Inventory assets and data flows, identify threat sources and events, identify vulnerabilities given existing controls, determine likelihood, determine impact (including patient safety and regulatory exposure), assign a risk level, then select a treatment: mitigate, transfer, avoid, or accept. Record residual risk with an accountable owner's sign-off, then monitor and re-assess on change. Qualitative scales (high/medium/low) are common in healthcare; quantitative methods use SLE × ARO = ALE where data supports it.
The HIPAA hook
The Security Rule requires a risk analysis as an administrative safeguard, and OCR treats it as foundational: documented, enterprise-wide, ongoing, and tied to a corrective action plan - not a one-time checklist.
Worked example
An unpatched radiology workstation sits on a flat clinical network. Reasoning: threat = ransomware; vulnerabilities = missing patches, no segmentation, shared local admin; likelihood = high; impact = high (imaging outage, PHI exfiltration); risk = high. Treatment: vendor-coordinated patching, VLAN segmentation, removal of local admin, tested offline backups. Residual risk is rated medium and accepted in writing by the CIO with a review date.
Traps
- A once-a-year assessment that never updates after change.
- Listing vulnerabilities without tying them to assets and threats.
- Delegating the exercise to IT with no clinical or executive involvement.
- Confusing a gap assessment or audit with a risk assessment.
- Leaving residual risk unowned.