By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Risk Assessment
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
A risk assessment has two meanings in the HIMSS Dictionary. The first is a process: identifying risks, analyzing them, and evaluating them. The second is a document: a report showing an organization’s vulnerabilities and the estimated cost of recovery if damage occurs, along with a summary of protective measures and what they cost, scaled to how much risk the organization will tolerate, its risk tolerance.
The HIPAA Security Rule makes the process mandatory. Under 45 CFR 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI, which the rule calls a risk analysis. Under paragraph (B), they must then implement risk management measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level. The rule also requires periodic evaluation when the environment or operations change. The Office of the National Coordinator’s Security Risk Assessment Tool page notes that the Security Rule requires covered entities and their business associates to conduct a risk assessment.
NIST Special Publication 800-30 Revision 1, Guide for Conducting Risk Assessments, published in September 2012, gives a widely used structure: prepare for the assessment, conduct it by identifying threat sources and events, vulnerabilities, likelihood, and impact, communicate the results, and maintain the assessment over time.
| Step | Question | Output |
|---|---|---|
| Scope and inventory | What assets and data are in scope? | Asset and data flow list |
| Identify threats and vulnerabilities | What could go wrong, and where are we weak? | Threat and vulnerability list |
| Estimate likelihood and impact | How likely, and how bad? | Risk ratings |
| Evaluate against tolerance | Which risks are acceptable? | Priority list |
| Treat and monitor | Reduce, transfer, avoid, or accept | Risk management plan |
⚠️ Exam Alert: A risk assessment combines threats, vulnerabilities, likelihood, and impact; a vulnerability assessment only finds weaknesses. Risk management is the ongoing response to the assessment. Accepting a risk is a documented decision, not neglect. HIPAA calls the required assessment a risk analysis.
🌐 Why It Matters: Real-World Healthcare IT Context
Resources for security are limited, so an organization cannot protect everything equally. A risk assessment tells it where to look first. Several recent studies indicate where risk concentrates.
Vendors are one such area. A 2026 analysis in JMIR Medical Informatics of 6,612 US health care data breaches reported to the Office for Civil Rights between October 2009 and December 2025 found that business associates were involved in 29.5 percent of breaches but in 48.8 percent of affected individuals, and that the share of breaches involving business associates grew over time, with hacking and IT incidents as the dominant mechanism. The finding implies that a risk assessment limited to an organization’s own network will miss exposure that sits with its vendors.
Connected devices are another. A 2023 review in the Journal of Clinical Monitoring and Computing argued that the explosion of wired and wireless medical devices, including ventilators, anesthesia machines, infusion pumps, pacing devices, and monitors, adds opportunities for attackers once the devices are connected to a hospital network, and that chronic underfunding of cybersecurity had left the sector exposed. It is a narrative review and an expert viewpoint, but it matches what many assessments find: unmanaged devices on shared networks.
Clinical impact is a third. A 2026 review in the Journal of Emergency Medicine concluded that cyberattacks disrupt care and compromise data integrity in emergency departments, and that preparedness requires planning and simulation. These effects make availability and integrity, not only confidentiality, central to hospital risk assessment.
The technology response is evolving but uneven. A 2026 scoping review in the Journal of Medical Internet Research mapped machine learning applications in health care cybersecurity against the six functions of NIST Cybersecurity Framework 2.0. Intrusion detection was the most common application (29 studies). Only two studies addressed the Respond function, and none addressed Recover or Govern. Only one study demonstrated real-world deployment, and most relied on synthetic or outdated benchmark datasets. The authors concluded that machine learning is concentrated in preincident functions. For risk assessment, the message is that tools can help detect threats but do not replace governance and recovery planning.
Practical methods follow from these findings. A sound assessment starts with an accurate inventory of systems, data, vendors, and devices, and a map of where ePHI flows. It identifies realistic threats, such as ransomware, phishing, insider misuse, vendor compromise, and loss of devices, and rates vulnerabilities using scans, configuration reviews, interviews, and past incidents. It rates likelihood and impact, with impact defined in clinical terms such as delayed care as well as financial and legal ones. Leaders then decide which risks to reduce, transfer through insurance or contracts, avoid, or accept, and record their reasoning. The assessment is repeated on a schedule and whenever significant changes occur, such as a new system, vendor, or merger, and it feeds the risk management plan, budget, and board reporting.
Common risk assessment problems:
- Incomplete inventory of systems, vendors, and devices
- Assessments done once for compliance and then shelved
- Focus on confidentiality while ignoring availability and patient safety
- Risk ratings with no clinical impact definitions
- Findings without owners, deadlines, or funding
- Accepted risks that are not documented
What supports effective risk assessment:
- Accurate inventory and data flow maps
- A recognized method such as NIST SP 800-30
- Clinical and operational leaders at the table
- Inclusion of vendors and connected devices
- A tracked risk register with owners and dates
- Regular updates and board-level reporting
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses know where patient information and critical equipment really are, which makes their input valuable in assessments.
At the Bedside
Nurses see the practical risks that diagrams miss: shared logins on a busy shift, unlocked workstations, a connected pump on an old software version, or paper lists left on a counter. Reporting these helps security teams place them in the risk register.
In Clinical Workflow
Nurse managers take part in assessments by identifying which systems are critical to care on their units, what downtime would mean, and which processes are workarounds. They help rank the clinical impact of a loss of each system.
Nurse informaticists join risk workshops, translate technical risk into clinical terms, and represent nursing needs when controls are chosen. They also help ensure that mitigations, such as stricter login rules, do not create unsafe workarounds.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live adds users, interfaces, devices, and vendors, so it triggers an updated assessment. At-the-elbow support analysts see which controls clinicians struggle with, such as password prompts or badge-in steps, and report unsafe workarounds so that the risk register reflects what actually happens.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Risk assessment appears in security, compliance, and governance questions:
| CAHIMS Domain | How Risk Assessment Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA Security Rule, regulation, threat landscape |
| Clinical Informatics | Patient safety impact, downtime, clinical workflow |
| Healthcare Information & Systems Management | Asset inventory, vulnerability scanning, controls |
| Management & Leadership | Risk tolerance, governance, budgeting, reporting |
Key Terms to Know Alongside Risk Assessment
- Risk Analysis — HIPAA-required assessment of risks and vulnerabilities to ePHI
- Risk Management — implementing measures to reduce risk to an acceptable level
- Risk Tolerance — amount of risk an organization is willing to accept
- Threat — circumstance or actor that could exploit a vulnerability
- Risk Register — documented list of risks with ratings, owners, and actions
- NIST Cybersecurity Framework — voluntary framework organizing cybersecurity activities into functions
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.308, Administrative Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- NIST — SP 800-30 Rev. 1, Guide for Conducting Risk Assessments https://csrc.nist.gov/pubs/sp/800/30/r1/final
- HealthIT.gov — Security Risk Assessment Tool https://healthit.gov/privacy-security/security-risk-assessment-tool/
- Ignatovski (2026), JMIR Medical Informatics — Business Associates’ Involvement in US Health Care Data Breaches: Longitudinal Analysis https://pubmed.ncbi.nlm.nih.gov/42837534/
- Cartwright (2023), Journal of Clinical Monitoring and Computing — The Elephant in the Room: Cybersecurity in Healthcare https://pubmed.ncbi.nlm.nih.gov/37088852/
- Rajput et al. (2026), Journal of Medical Internet Research — Mapping Machine Learning-Driven Cybersecurity Solutions in Health Care: Scoping Literature Review https://pubmed.ncbi.nlm.nih.gov/42507996/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply