A clinic group's HIPAA security risk analysis, external and internal penetration tests, and a tracked remediation plan

A healthcare group of 9 clinics needed to show that it had assessed the risks to the electronic protected health information (ePHI) it handles, as the HIPAA Security Rule requires. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. No patient data was needed or viewed: the work was about systems, settings and access, not records.

The risk analysis came first, because the rule requires one under 45 CFR 164.308(a)(1)(ii)(A). Our team built an inventory of every system that creates, stores or sends ePHI, drew where the data moves between clinics, billing, labs and vendors, and recorded the threats and weaknesses for each system. The U.S. Department of Health and Human Services publishes a Security Risk Assessment Tool for smaller practices, and its questions were used as one input, alongside NIST SP 800-66 guidance on the Security Rule. Each risk was rated by likelihood and impact so that the list could be ranked.

Testing then checked the ranked list against reality. An external penetration test, done under a signed authorization naming the addresses, accounts and hours, looked at what an attacker on the internet could reach: remote access, patient portal sign-in and exposed services. An internal test started as a stolen laptop on a clinic network would, and checked whether a user in a front office could reach the billing server, clinical devices or file shares, and whether passwords and local administrator rights could be reused across clinics.

Findings were written as a remediation plan with an owner, a priority and a due date for each item. The usual fixes were multi-factor authentication on remote access and email, network segmentation between clinical devices, front-office computers and guest Wi-Fi, patching of exposed services, removal of shared accounts, and backups that are tested by a restore. Items that could not be fixed at once stayed on a risk register with a decision recorded by the group's leadership, which is the evidence an auditor asks to see.

Retesting confirmed that the fixed items were closed, and the analysis was dated and filed. The group now repeats the analysis each year and after major changes, such as a new clinic or a new electronic health record system. This is a technical assessment, not a legal opinion or a certification of HIPAA compliance.