Security Management Process

Implement policies and procedures to prevent, detect, contain and correct security violations. This is the foundational standard of the Security Rule: the four specifications beneath it drive every other safeguard decision you make, and all four are Required — none is addressable.

Required implementation specifications:
• Risk analysis — 164.308(a)(1)(ii)(A). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI you hold. This is the single most frequently cited failure in OCR enforcement. It must cover the whole ePHI estate, not a sample, and it must be documented and dated.
• Risk management — 164.308(a)(1)(ii)(B). Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The analysis identifies risk; risk management is what you do about it, prioritised by the ratings you assigned.
• Sanction policy — 164.308(a)(1)(ii)(C). Apply appropriate sanctions against workforce members who fail to comply with your security policies and procedures. It must exist, be communicated, and be applied consistently — selective enforcement undermines it entirely.
• Information system activity review — 164.308(a)(1)(ii)(D). Regularly review records of information system activity: audit logs, access reports and security incident tracking reports. This pairs directly with the audit controls standard at 164.312(b), which provides the records this specification requires you to examine.

Implementation approach:
- Scope the risk analysis to every system, device, medium, facility and third party that creates, receives, maintains or transmits ePHI, then diagram the data flows
- Rate risks on a documented, reproducible scale of likelihood and impact, and publish the scale
- Feed every identified risk into a tracked remediation plan with an owner and a date, and record accepted risks with the reasoning
- Update the analysis on material change — new systems, mergers, new premises, significant incidents — rather than only annually
- Make activity review a scheduled task with a named owner and a written record of what was examined
- Apply the sanction policy visibly and record every application, including the decision not to sanction

A vulnerability scan is not a risk analysis. A scan enumerates technical weaknesses in the systems it was pointed at; a risk analysis covers the whole estate, includes non-technical vulnerabilities such as absent policy or untrained staff, and rates the risk each presents. Submitting a scan report in place of an analysis is a recurring enforcement finding.

• Security management process policy and supporting procedures
• Risk analysis report: scope, methodology, asset and data flow inventory, threats, vulnerabilities, current controls, likelihood and impact ratings, and risk determinations
• Documented likelihood and impact rating scales
• Risk management plan with owners, priorities and target dates
• Risk acceptance records, with the reasoning and the approver
• Sanction policy, evidence of communication to the workforce, and records of application
• Information system activity review procedure naming reviewer, scope and frequency
• Completed activity review records showing what was examined and what was found
• Evidence of risk analysis updates following material change
• Approval and version history for each document

• Confirm a documented, dated risk analysis exists and covers the entire ePHI estate rather than a subset
• Compare the risk analysis asset inventory against an independently compiled system list to test completeness
• Confirm the analysis includes non-technical vulnerabilities, not only scan output
• Verify likelihood and impact scales are documented and applied consistently
• Trace a sample of identified risks into the risk management plan and confirm owners and dates
• Confirm remediation priority follows risk rating rather than convenience
• Review risk acceptance records for reasoning and appropriate approval
• Confirm the sanction policy exists, was communicated, and has been applied consistently where breaches occurred
• Inspect activity review records and confirm they show substance, not just attestation
• Confirm the analysis was updated after recent material changes or incidents