With the kids back in school, it’s time to catch up on your MIPS homework! That means it’s time for the Security Risk Assessment (SRA)!
What is SRA?
The Security Risk Analysis (SRA) is a critical process for both MIPS and HIPAA. Under MIPS, it directly impacts a provider’s performance score in the Promoting Interoperability (PI) category, while under HIPAA, it is a legal requirement to ensure the protection of electronic Protected Health Information (ePHI).
MIPS (Merit-based Incentive Payment System): As part of the Promoting Interoperability (PI) category, healthcare providers are required to conduct or review a Security Risk Analysis (SRA) to protect electronic health information. This requirement ensures that practices have assessed the risks to the confidentiality, integrity, and availability of Protected Health Information (PHI) and have taken steps to mitigate those risks. The SRA is a measure that contributes to a provider’s overall MIPS score.
HIPAA (Health Insurance Portability and Accountability Act): HIPAA requires covered entities and their business associates to conduct a Security Risk Analysis as part of their compliance with the HIPAA Security Rule. The SRA is crucial for identifying potential risks and vulnerabilities to the electronic PHI (ePHI) that an organization holds. After identifying risks, organizations are expected to implement appropriate security measures to manage and mitigate those risks. Regular reviews and updates of the SRA are also necessary to ensure continued compliance.
How do I complete the SRA?
Many practices involve their IT to assist with completing the SRA. The SRA Tool Kit can be useful for practices trying to complete the SRA independently. However, while CMS provides these tools to aid self-evaluation, many industry leaders believe that relying on non-experts for your SRA could leave your organization vulnerable to attacks, potentially leading to reputational damage and financial penalties.
Compliance with the NIST Cybersecurity Framework 2.0 offers safe harbor protection in the event of a cybersecurity incident. Our security partner, PatientLock, provides enterprise-grade Security Risk Assessment services that are compliant with CSF 2.0.
How do I report or submit my SRA?
For MIPS PI reporting, you can submit your Security Risk Assessment (SRA) by providing a simple Yes/No attestation. It is essential to maintain a record of each SRA completed annually for potential MIPS audits. Ensure you keep multiple copies of these records off-site to safeguard against data breaches or corruption.
EyeMD EMR Named 2024 Best In KLAS: Ambulatory Ophthalmology EMR