Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was curious on if there was any good HIPAA risk assessment software out there, to pretty much input where you stand for each compliance check point, and it gives you a road map on what you have to do to get compliant.

I am currently looking at alternatives to bringing people in to guide our way. We looked into bringing in a consulting company to help us, and that became very expensive very quickly, so I was curious on other alternatives.

share|improve this question

closed as off-topic by Journeyman Geek Mar 11 '15 at 8:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they become outdated quickly and attract opinion-based answers. Instead, describe your situation and the specific problem you're trying to solve. Share your research. Here are a few suggestions on how to properly ask this type of question." – Journeyman Geek
If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

RWI HIPPA Risk Assesment appears to be what you're looking for. There is also HIPPA Manager that has what you're looking for as well. I honestly couldn't tell you which one is best for your needs or budget though.

share|improve this answer

I hope the following brief instructions might help to anyone starting the process of becoming HIPAA compliant

The HIPAA compliance requires access control, information integrity, audit control, user authentication and transmission security. Similarly as with other compliance regulations, it’s necessary to use software, hardware, or other methods that provide monitoring and capturing of user activities in information systems that contain or use electronic PHI. The security and integrity of electronic PHI must be ensured against any unauthorized access, modification, and deletion

“As required by Congress in HIPAA, the Privacy Rule covers: • Health plans

• Health care clearinghouses

• Health care providers who conduct certain financial and administrative transactions electronically. These electronic transactions are those for which standards have been adopted by the Secretary under HIPAA, such as electronic billing and fund transfers"

To be able to meet the HIPAA requirements, the entity must constantly audit and report all access attempts and events related the databases and objects that contain sensitive PHI records

Depending on the structure of health institution entities, supervisors periodically perform verification of HIPAA compliance to ensure its effectiveness. The verification frequency depends on the last verification report, and it’s less frequent in case of previous or constant positive HIPAA compliance

The HIPAA act requirements do not strictly address methods for database and IT security. However, according to the regulation requirements on providing integrity, confidentiality, privacy, and availability of patient health information, the following steps provide compliance with HIPAA:

• Define and document the required permissions for each health institution employee

• Periodically review permission configurations on database objects and modify access rights in order to maintain the integrity, confidentiality, and accuracy of the PHI records

• Audit the system that keeps and provides use of the PHI records

• Analyze the audit information that show events related to the PHI records periodically, and take action where needed

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .