Risk Assessments - Multifaceted and Necessary
In this segment, the speaker outlines a practical framework for conducting risk assessments in healthcare environments, especially under HIPAA. He proposes five assessment lenses—people and behaviors, IT systems (cloud or on‑premise), third‑party risk, business processes, and physical/site controls—to evaluate an organization’s maturity and control effectiveness. The core argument is that documented policies often mask on‑the‑ground gaps; therefore, assessors must verify actual practices. He illustrates common failures such as shared EMR password lists left in open offices, insufficient physical safeguards for areas storing PHI, and superficial multifactor authentication deployments that may not cover critical layers. The overall message stresses a hands‑on, reality‑checking approach to ensure true compliance and security.
