By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Risk Management
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
Risk management has four related meanings in the HIMSS Dictionary. It can mean an organization’s culture, processes, and structures aimed at handling the potential for adverse events well. It can mean the coordinated activities through which an organization steers and governs its handling of risk. It can mean allocating resources to buy the most cost-effective protection. And, in health care specifically, it refers to the clinical and administrative machinery, meaning the systems, routines, and reporting, that an organization uses to spot, track, evaluate, lessen, and head off risks.
What the four share is a cycle. An organization identifies risks, assesses their likelihood and impact, decides how to treat each one, acts, and then monitors whether the treatment worked. A risk assessment, covered in an earlier post, is the analysis step. Risk management is the whole cycle, including the decisions and the follow-through.
For health information, HIPAA makes the cycle a requirement. Under 45 CFR 164.308(a)(1)(ii)(B), covered entities and business associates must implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The NIST Risk Management Framework, described in Special Publication 800-37 Revision 2 (December 2018), adds a structured process that includes categorizing systems, selecting, implementing, and assessing controls, authorizing systems, and continuous monitoring, and it links system-level decisions to organization-level risk management.
| Treatment Option | Meaning | Example |
|---|---|---|
| Reduce (mitigate) | Add controls to lower likelihood or impact | Multifactor sign-in, network segmentation |
| Transfer | Shift part of the financial risk | Cyber insurance, vendor contract terms |
| Avoid | Stop the risky activity | Retire an unsupported system |
| Accept | Document a decision to live with the risk | Low-impact risk with high cost to fix |
| Monitor | Track the risk over time | Risk register review each quarter |
⚠️ Exam Alert: Risk assessment identifies and rates risk; risk management is the ongoing response. The four treatments are reduce, transfer, avoid, and accept. Accepting a risk requires a documented decision by someone with authority. HIPAA requires risk analysis and risk management as separate but linked specifications.
🌐 Why It Matters: Real-World Healthcare IT Context
Risk management matters because the work does not end when the assessment is filed. Studies of practice show how often it stalls at that point.
One example comes from EHR safety. The Safety Assurance Factors for EHR Resilience (SAFER) Guides are recommendations that help health care organizations assess the safety of their EHR implementation and use. A 2018 study in JAMIA asked eight organizations of different sizes and EHR vendors to self-assess adherence to all 140 unique recommendations in the nine guides then in use. Together, they fully implemented only 25 of 140 recommendations (18 percent). Average full implementation ranged from 94 percent for system interfaces to 63 percent for clinical communication, and adherence was higher for building safe health IT (82.1 percent) than for using it safely (72.5 percent) or monitoring it (67.3 percent). The authors concluded that most recommendations were not fully implemented, and called for national policy to encourage adoption. The sample was small and the assessments were self-reported, but the pattern, that monitoring lags design, is a common risk management gap.
The guides have since been revised. A 2025 case study in JAMIA described how a multidisciplinary team updated them over nine months, cutting the number of recommended practices by about 40 percent, consolidating nine guides into eight, adding an evidence grading scheme, and adding a five-point scale for rating implementation. The authors noted that in 2022 the Centers for Medicare and Medicaid Services began requiring US hospitals to attest annually to their use of the guides. For informatics teams, that connects safety self-assessment to a regulatory cycle, much as the Security Rule links risk analysis to the safeguards chosen.
A second example comes from clinical process risk. A 2026 systematic review in the Journal of Applied Clinical Medical Physics synthesized 11 studies that used failure modes and effects analysis (FMEA), a structured method for listing how a process might fail and how severe each failure would be, to examine online adaptive radiotherapy. The studies identified 300 unique failure modes, and 49.6 percent of them were classified as high risk after the reviewers harmonized the different scoring scales. Most high-risk failures were concentrated in online treatment delivery, particularly in human-computer interactions and anatomical contouring. The authors argued for quality assurance frameworks that prioritize human factors and process consistency. The review covers one specialized technology, so its numbers do not transfer to other settings, but it shows how a structured method can reveal where design and interface choices create risk, which is also the core of clinical risk management.
These findings point to a practical program. A risk management program starts with a register that lists risks, owners, ratings, treatment decisions, and review dates. It sets risk tolerance with senior leaders and the board so that accept-or-treat decisions are consistent. It uses established frameworks, such as the NIST RMF for information systems, SAFER Guides for EHR safety, and FMEA for clinical processes. It tests whether controls work, monitors measures over time, and reports to governance bodies. And it reviews risk when the environment changes: a new vendor, system, device, or care model.
Common risk management problems:
- Assessments completed but not turned into funded actions
- Risk registers without owners or review dates
- Accepted risks with no documented decision-maker
- Safety recommendations adopted in design but not monitored in use
- Separate processes for cybersecurity and clinical safety that never meet
- No reassessment after major system or vendor changes
What supports effective risk management:
- A risk register with ratings, owners, and dates
- Leadership-defined risk tolerance
- Recognized frameworks suited to each risk type
- Monitoring and testing of controls
- Regular reporting to a governance committee
- Reassessment after significant changes
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses manage clinical risk constantly, and their observations are often the earliest warning that a process is unsafe.
At the Bedside
At the bedside, nurses weigh risks of falls, pressure injury, medication errors, and infection, and they see when technology adds risk, such as a confusing screen, a missing barcode label, or an alert that interrupts a critical task. Reporting near misses and workarounds gives risk managers the data to act.
In Clinical Workflow
Nurse managers take part in safety huddles, review event reports, and help rank risks by clinical impact. They make sure that controls chosen by leaders, such as new documentation steps, can be done within real workloads.
Nurse informaticists use structured tools such as FMEA and the SAFER Guides to evaluate EHR changes and downtime plans. They bring front-line workflow knowledge to risk workshops and help check that mitigations work as intended.
In EHR Implementation (Go-Live Perspective)
An Epic Go-Live is a concentrated period of risk, and organizations track issues in a command center. At-the-elbow support analysts report patterns of confusion, workarounds, and safety concerns, which feed daily risk review and priority fixes while the system stabilizes.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
Risk management appears in security, safety, and governance questions:
| CAHIMS Domain | How Risk Management Appears |
|---|---|
| Healthcare & Technology Environments | HIPAA requirements, regulation, accreditation |
| Clinical Informatics | Patient safety, EHR safety practices, workflow risk |
| Healthcare Information & Systems Management | Controls, monitoring, business continuity, security |
| Management & Leadership | Risk tolerance, governance, budgeting, reporting |
Key Terms to Know Alongside Risk Management
- Risk Assessment — process of identifying, analyzing, and evaluating risks
- Risk Tolerance — amount of risk an organization is willing to accept
- Risk Register — documented list of risks with ratings, owners, and actions
- Failure Modes and Effects Analysis (FMEA) — structured method for identifying how a process might fail
- SAFER Guides — recommendations for assessing EHR safety
- Continuous Monitoring — ongoing tracking of controls and risk over time
HIMSS Organizational Position
HIMSS supports healthcare cybersecurity and patient safety through its Healthcare Cybersecurity Community, research, and education. Members can find related resources through the HIMSS Healthcare Cybersecurity Community page.
🔗 Explore Further: External References
- eCFR — 45 CFR 164.308, Administrative Safeguards https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
- NIST — SP 800-37 Rev. 2, Risk Management Framework for Information Systems and Organizations https://csrc.nist.gov/pubs/sp/800/37/r2/final
- HealthIT.gov — SAFER Guides https://healthit.gov/clinical-quality-and-safety/safer-guides/
- Sittig et al. (2018), Journal of the American Medical Informatics Association — Adherence to Recommended Electronic Health Record Safety Practices Across Eight Health Care Organizations https://pubmed.ncbi.nlm.nih.gov/29701854/
- Sittig et al. (2025), Journal of the American Medical Informatics Association — Revisions to the Safety Assurance Factors for Electronic Health Record Resilience (SAFER) Guides to Update National Recommendations for Safe Use of Electronic Health Records https://pubmed.ncbi.nlm.nih.gov/40220287/
- Balaji et al. (2026), Journal of Applied Clinical Medical Physics — Failure Modes and Effects Analysis for Clinical Implementation of Online Adaptive Radiotherapy: A Systematic Review https://pubmed.ncbi.nlm.nih.gov/42638337/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply