Home Forums Discussions General Discussion Risk Assessment Update

The office had a HIPAA Security Expert came over to do the Risk Assessment in the past year. Wonder if it is mandatory to have it completed for Meaningful Use or Medicare(CMS) on yearly base. I will appreciate for any input.

Greetings,

The Risk Assessment for Meaningful Use does have to be updated every year. This is one of the main points CMS will audit you on. You do not have to have a 3rd party agency update it, however. You can update the form they gave you with the current years information (most offices, its the same from year to year)

Thanks Mark for the help.

hello Mark,
does it have to be a third party ?
can we conduct our own risk assessment , my understanding was that as long as all the criteria were addressed it was ok .
thanks
Bala

With them using the RA as a key part of the audits, I would recommend having it professionally done at least on the first go around. This was a good use of $300 for us. You may want to just update it yourself in following years, but YMMV.

I'm in agreement with Chris. You can conduct it yourself, but since the auditors are looking closely at that specific measure, it is better to have a 3rd party who is familiar with the requirements perform the assessment.

You can contact your local Regional Extension Center and they will be able to get this done for you, for a fee. I have heard of the fees ranging from $250 up to $5000, depending on the state.

You can also reach out to your malpractice carrier. They may be able to perform a SRA for you. In some cases, I have heard them doing it for free as well. This would of course vary from carrier to carrier.

Unfortunately, I did it myself so do not know how that will work .
thanks . Too late to get it done now for 2011 or 2012
bala