HHS releases Security Risk Assessment Tool version 3.7
HHS (ASTP/ONC with OCR) released version 3.7 of its free Security Risk Assessment Tool for small and medium practices, as a Windows application and an Excel workbook. It adds a question on assessment scope across every location handling ePHI and one on remote access and telework.
What changed. Version 3.7 of the free HHS SRA Tool updates questions, answers and educational content, adds an assessment-scope question so the analysis covers every location that creates, receives, maintains or transmits ePHI, and adds a question on remote access and telework. It is available as a Windows application and an Excel workbook; data stays on your computer.
What it means. Practices using the tool for this year’s risk analysis — including for the MIPS Security Risk Analysis measure — should use 3.7 and make sure home and remote work are in scope.
What we updated. The HHS SRA Tool page and the risk assessment guides.