After a HIPAA Security Risk Assessment, select one exposed ePHI location and ask for evidence that its proposed safeguard will work. Closing a remediation task can leave that location exposed if the team has only checked installation. Before accepting the fix, state what the evidence must show and who will review it.
A HIPAA Security Risk Assessment examines potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.
Turn each ePHI finding into a remediation decision
The next step is to connect assessment findings to security measures. The HHS Security Rule summary distinguishes risk analysis from risk management. It says regulated entities must implement measures that reduce identified risks and vulnerabilities to a reasonable and appropriate level. A completed assessment therefore leaves implementation work to do.
Start with the assessment's location inventory. Select a device, application, shared folder, or service where a finding remains unresolved. Keep its identifier with the finding. Specify the proposed safeguard and the exposure it should reduce. Then assign the work and identify the person who can accept its result. These are practical suggestions for making the follow-up reviewable.
A remediation item needs an acceptance test before anyone can reliably call it complete. Write the test beside the task. An installation receipt establishes that something was installed. For an access restriction, the reviewer also needs evidence that the intended restriction applies to the affected location. Link the test to the finding rather than to the vendor's product description.
The checklist represents the starting point for this review, not findings about any particular organization. Adapt its status to the actual evidence. For the wider handoff, the risk assessment hub separates assessment outputs from decisions about action. The same distinction matters when following up an internal audit.
A complete assessment gives safeguards a defined scope
A sound assessment helps the team see what it must protect and where the weaknesses lie. HHS risk analysis guidance includes all ePHI in the scope, regardless of its source or location. It also calls for assessment of existing security measures, including whether they are properly configured and used.
That scope makes follow-up work more precise. A proposed safeguard can be checked against the identified locations. The team can see whether a change applies only to new devices or also to devices already in use. It can separate evidence about one application from evidence about the rest of the affected environment. These distinctions help prevent a narrow fix from being accepted for a broader finding.
The assessment provides the starting evidence for remediation; keep that evidence attached to the task. Preserve the location list, the observed weakness, and the date of observation. If the environment has changed since the assessment, record the change before using the original finding to accept a fix.
This work also supports a useful discussion with suppliers. The organization can ask for evidence tied to its own configuration and responsibilities. The questions after a third-party risk assessment are relevant when a proposed safeguard depends on a service provider.
Which test would show that the proposed safeguard protects the ePHI location named in the finding? Start the Walk →
What evidence is enough to accept a safeguard?
A finding's severity does not specify the evidence needed to accept its remediation. A high rating can establish urgency while leaving the acceptance test unstated. The reviewer still needs to know which claim is being tested: coverage of the safeguard, its configuration, or its operation. Combining these claims into a single “done” status makes uncertainty harder to see.
Sufficient certainty means enough evidence for the specific remediation decision, while preserving every applicable requirement. It does not authorize a team to lower legal requirements or technical acceptance criteria. HHS guidance states that an addressable implementation specification is not optional. The organization's security and compliance specialists must establish the applicable requirements before the decision's evidence threshold is set.
Use those requirements to write an acceptance statement. Identify the affected location, the protection being claimed, and the conditions in which it must work. Specify the evidence the reviewer will examine. Where a sample is proposed, ask what it can establish about the remaining scope. Do not let an unexplained sampling choice become a claim that every affected instance is protected.
Match the evidence to the consequence of being wrong. A configuration record may answer whether a setting exists. A suitable controlled test may be needed to answer whether that setting prevents the identified access path. Choose a test that protects ePHI and avoids interrupting necessary care. These are decision-method applications, not a prescribed HIPAA test protocol.
Uncertainty that could change acceptance needs a named next action and an escalation date. If coverage remains unknown, request the missing inventory. If a test fails, keep the finding open and review protection immediately. Record which responsible person receives an unresolved question. The discussion of enough information to decide explains why the decision determines the evidence needed.
OHSU's 2016 agreement required dated, reviewable remediation
Oregon Health & Science University provides a historical example of a formal follow-up plan. In July 2016, HHS announced a $2.7 million settlement concerning potential HIPAA violations. It included a three-year corrective action plan. This was a resolution of specified conduct, not evidence of OHSU's present security posture.
The resolution agreement and corrective action plan describes two 2013 breach notifications: a stolen laptop and ePHI stored with an internet provider without a business associate agreement. HHS's investigation identified disclosure affecting 3,044 individuals, gaps in security-violation procedures, and missing encryption or an equivalent measure for enterprise ePHI. The agreement expressly states that OHSU did not admit liability.
The plan required an analysis across OHSU's facilities and its ePHI systems, networks, and devices. Its risk-management plan had to identify remediation dates and interim compensating controls. The analysis and plan were due to HHS for review and approval within 310 days. Separate encryption provisions required supporting evidence and periodic effectiveness testing for specified device protections.
The useful lesson is to make the proposed protection reviewable before accepting remediation. This is an application drawn from the agreement's structure. An organization can connect each outstanding finding to a completion date, interim protection, and evidence for acceptance. The historical agreement cannot establish current compliance, either for OHSU or another organization.
The 310-day submission period belonged to OHSU's agreement. Another organization must establish its own applicable deadlines rather than copy that settlement timetable.
A dated plan should make slippage visible before its protection assumptions fail. Separate the date for installing a measure from the date for accepting its evidence. This also clarifies the follow-up after a data protection impact assessment, where planned action still needs verification.
Set the evidence checkpoint before closing the finding
For the selected ePHI location, create a short remediation acceptance record. Attach it to the existing assessment or task system. Record the finding, applicable requirements, proposed safeguard, acceptance evidence, and reviewer. Add the implementation date and the evidence-review date. This record should help a responsible person make the decision, without creating another report that repeats the assessment.
Review the evidence before the finding changes to closed. Compare the test result with the written acceptance statement. Record any uncovered instances or unresolved questions. Give each a responsible person and a date for action. The Universal Decision-Making Method provides the broader discipline for deciding whether the available evidence is sufficient to act.
Where permanent remediation takes time, record what protects the location now. State who checks that protection and when it must be reconsidered. If evidence is missing at the review date, escalate the acceptance decision to the responsible security official and relevant specialists. A delayed test should not silently extend a temporary arrangement.
Closure must remain open to review when the conditions supporting it change. HHS's Security Rule summary calls for periodic evaluation and modification of security measures as needed. Add specific review triggers to the record, such as an uncovered device, a failed test, or a change in the service used to hold ePHI. Keep the applicable requirements visible when deciding the response.
The immediate result is one finding with a clear decision trail. A reviewer can see what protection was claimed, what evidence was accepted, and what should happen if that evidence stops applying.
An ePHI remediation task can close while evidence about its protection remains unresolved.
Work through your decisionNo sign-up. Just pick your decision and start.
Grant Purdy is the co-author, with Roger Estall, of Deciding (2020), and the architect of the Universal Decision-Making Method.