Requirements for PHI breaches revolve around risk assessment of what actually occurred. At least three of the following must be considered:

A Threat is an information system weakness that can be exploited to cause disturbance or harm to PHI

Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity, is a Sanction policy (required).

There are three main categories of policies:

Threats are an indication of intent to inflict harm or damage.

The Security Rule requires CEs, BAs, and subcontractors (also considered to be BAs under HIPAA) to perform an initial risk analysis to determine specific unauthorized uses, disclosures, and data integrity losses that could occur to PHI if the proper security systems and safeguards are not in place. 

The Security Rule covers all protected health information (PHI) that a covered entity (CE), business associate (BA), or any BA subcontractor ________, _________, ____________, or __________ in an electronic format.

When calculating risk, risk is defined in the following formula: Risk = ______ × _______ × ________

As outlined in 45 CFR § 164.316 of the Security Rule, CEs must  implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of the Security Rule.

The 18 Security Rule standards contain a total of 42 implementation specifications that are either __________ or ___________.  (Choose all that apply)