Gustavo Ochoa
John Webb
Dani Deandresi
Unit 9 Discussion 1: Risk Analysis

To protect information, businesses need to implement rules and controls for the protection of information and the systems that store and process this information. This is achieved through the implementation of information security policies, standards, guidelines and procedures. This document states how a company will protect its physical and information assets. It is a living document, meaning that the document is never finished. This document can include an acceptable use policy, a description of how the company plans to educate its employees about protecting the company’s assets, an explanation of how security measurements will be carried out and enforced, and a procedure for evaluating the effectiveness of the security policy. A security policy should be written by senior management. This plan also outlines security roles and responsibilities.
System characterization is used to expedite the risk analysis. It is the process of identifying which information assets need protecting either because of their criticality to the business and/or because ePHI is processed and stored on the system. This process includes conducting an inventory of major applications and general support systems—any systems that process or store PHI. A major application is an application that is critical to an organization or stores PHI. Generally, the “owner” for a major application is the director of the department that is the primary user of the application. Conducting a thorough risk analysis does not imply that organizations need to identify every possible threat. The term “reasonably anticipated” is used three times within the HIPAA security rule (twice in the preamble and once in the actual rule) as it pertains to threats or hazards. Factors for determining what could be reasonably anticipated includes