Clear Path step · Business · Your industry's rules and risks
Do the HIPAA risk analysis, and include your AI tools
Why it matters: The risk analysis is the foundation the Security Rule requires, so it's the first document to have ready. AI tools that touch patient information belong in it like any other system.
On your path if you picked “Healthcare” for “What's your industry?”.
Do it
- List every system and vendor that stores, processes or transmits patient information.
- Add AI tools, including ones built into software you already use.
- Rate the threats and gaps for each, starting with email, EHR and backups.
- Write the remediation plan with owners and dates, and update it at least yearly and after big changes.
Check it worked: A dated, written risk analysis covers every system holding patient information, including AI scribes, chatbots and AI features in your EHR, with a plan for each gap.
Simply put
It's like a home inspection before you renovate: you list every room, including the new ones, and note what needs fixing. AI scribes and chatbots that touch patient data are new rooms, and belong on the list.
In detail
HHS's January 2025 proposal would make an asset inventory and network map explicit requirements; doing them now is no-regret whether or not it's finalized.
If this is new to you: Sounds daunting? It's a list, a rating and a plan, done in that order. Start with email, your health record system and backups, then work outward.
Points toward the Long View: an asset inventory and network map you'd want whatever the final HIPAA rules say.