A five-lens framework for assessing healthcare risk under HIPAA: people and behaviors, IT systems, third-party risk, business processes, and physical controls. What looks secure on paper often isn't. An EMR password list left in an office, unlocked rooms with patient data, and multifactor authentication that isn't actually deployed everywhere reveal the gap between policy and reality.
What can you assess underneath a program? There are of course people and behaviors, but IT systems could be cloud, could be within your hospital network. There's third party, lots of third party risk programs out there. And then there's business process. And then for HIPAA, obviously you've got the physical elements as well. So sites, facilities. So I like to think that those 5 lenses are important to kind of dive in to understand. You can understand maturity and overall controls in your policy, but the question is, are you going into what's actually happening on the ground? Because I've seen a number of organizations that, you know, show high maturity, but if they're getting audits or if they have issues, like no one's checked that, you know, an EMR shared password list is sitting in open office or from a physical standpoint, or there's not the right physical controls to guard areas where PHI is kept unlocked. Or on the IT side, like, hey, you have multifactor authentication, but at what layer within the organization is it at?
