Lion Cipher Lab
Conduct a HIPAA Security Rule risk analysis (for a small healthcare practice)
- GRC / Compliance
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Healthcare is one of the biggest employers of security and compliance people anywhere, and it is one of the most breached industries — patient records are valuable and often poorly protected. Every US organisation that handles electronic health information is legally required by the HIPAA Security Rule to perform a risk analysis, and it is the number-one thing regulators ask for after a breach. "We never did a risk analysis" is the finding that turns an incident into a fine. Learning to run one is a directly hireable healthcare-compliance skill, and the method transfers to every other…
What you'll learn
- HIPAA Security Rule fundamentals
- ePHI inventory and data-flow mapping
- threat and vulnerability identification
- likelihood x impact risk scoring
- mapping risks to administrative / physical / technical safeguards
- required vs. addressable implementation specifications
- documenting a defensible risk analysis
Steps in this lab
- The words you need first — HIPAA, ePHI, the Security Rule
- Why the risk analysis is the foundation of everything
- Meet the practice, and set up your worksheet
- Step 1 — Inventory the ePHI and where it lives
- Step 2 — Identify threats and vulnerabilities for each asset
- Step 3 — Score each risk: likelihood x impact
- Step 4 — Map each risk to a safeguard (and know Required vs. Addressable)
- Step 5 — Decide treatment, assign owners, and write it up
- What you just did — and why it's a hireable skill