CMS and OCR / Tuesday, June 7, 2016 / Categories: Achieving Meaningful Use, HIPAA Security Risk Analysis Tip Sheet Protect Patient Health Information - Updated March 2016 Conducting or reviewing a security risk analysis to meet the standards of Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule is included in the meaningful use requirements of the Medicare and Medicaid EHR Incentive Programs. Eligible professionals must conduct or review a security risk analysis for each EHR reporting period to ensure the privacy and security of their patients’ protected health information. Conducting a security risk analysis is required when certified EHR technology is adopted in the first reporting year. In subsequent reporting years, or when changes to the practice or electronic systems occur, a review must be conducted. Documents to download 2016_SecurityRiskAnalysis(.pdf, 245.22 KB) - 756 download(s) Resource Links Link to the original file at CMS.GovThis tip sheet1 provides an overview of the security risk analysis requirement. Print 26279 Tags: CMS EHR Attestation Eligible Professionals Meaningful Use MU Incentive Program Stage 2 reporting difficulties electronic protected health information ePHI PHI Security Risk Analysis SRA Related Resources Keeping the Pediatric PHI Secure: Using the Security Risk Assessment Tool Health Center Health IT/ EHR Assessment Tool Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients The Health Center CIO’s Guide to HIPAA Compliant Text Messaging Online Reputation Management for Health Centers