Risks
This page explains the Risks page: what the risk register is, how scoring works, what you can do about a risk, and how the register turns two HIPAA controls green or red.
The idea in one minute
Your risk register is a list of what could go wrong with your patient data. For each risk you say how likely it is, how bad it would be, who owns it, what you are doing about it, and when you will look at it again.
You don't set the two risk controls by hand. RiskFlow reads the register and turns them green or red, and a failing control names the risk that caused it:
- A risk analysis is done at least yearly (
risk-analysis, 164.308(a)(1)(ii)(A)) - Risks found are tracked and reduced (
risk-management-plan, 164.308(a)(1)(ii)(B))
Two things to know:
- No risks, no signal. Turning on HIPAA doesn't turn anything red. These controls only move once you add a risk.
- The readiness score on Frameworks moves with the register.
The old Google-only Risk Assessment page is separate and stays as it is. The signed security risk assessment is a later module.
Who can do what
| Role | Risks |
|---|---|
| ORG Admin | See, add, edit, score, treat, accept, review, close, reopen and delete |
| ORG Auditor | See everything. Read-only |
| Other ORG roles | No access |
A custom role needs the risk-management permission (MANAGE_RISKS) to change the register, and the controls permission to see it. Each clinic sees only its own risks. Another clinic, even one managed by the same MSP, can't see yours, and asking for one of your risks behaves as if it doesn't exist.
Starting fast: Add from library
Select Add from library to pick from a ready list of about 25 common healthcare risks, such as Ransomware locks the EHR or file shares or A lost or stolen laptop.
- Risks that fit the systems on your Assets list are pre-ticked. A practice with laptops sees the laptop risk ticked.
- Each risk arrives with starting scores and is linked to the controls that reduce it, for example Encryption at rest or MFA is enforced, when you have turned on HIPAA.
- You can add a library risk once. After that the copy is yours: change anything on it. Risks you already added show as added.
- You can set an owner for everything you add at the same time.
You can also add your own risk with Add risk.
Scoring
Every risk has two scores. Each is likelihood × impact, both from 1 to 5:
| Likelihood | Impact | ||
|---|---|---|---|
| 1 | Rare | 1 | Minor |
| 3 | Possible | 3 | Moderate |
| 5 | Almost certain | 5 | Severe |
| Score | Band |
|---|---|
| 1–4 | Low |
| 5–9 | Medium |
| 10–15 | High |
| 16–25 | Critical |
- Before controls (inherent): if you did nothing.
- After controls (residual): with what you have in place. Optional. It can't be higher than the "before" score.
The page shows the band of the after score once you set it, and of the before score until then. Only a person sets the scores. RiskFlow never works out "after" from your control status. When a control a risk depends on fails, it asks you to look again instead (see Flags below).
A risk with no scores yet is not scored. That is a problem to fix, not an error.
What you can do about a risk
| Treatment | Meaning |
|---|---|
| Mitigate | Reduce it with controls |
| Accept | Live with it, with a sign-off |
| Transfer | Hand it on, for example insurance or a vendor |
| Avoid | Stop doing the thing that causes it |
Add a short plan with the treatment if you like. Only Medium and higher risks must be treated. Low risks can sit without one.
Accepting a risk
Select Accept when the practice decides to live with a risk. You must write a note explaining why, for example Covered by offsite backups and insurance. RiskFlow records who accepted, when, and until when. The acceptance is valid for one year unless you pick another date.
- The sign-off is kept on the risk and in the audit log. It is not a formal signature.
- Changing the treatment to something else clears the sign-off.
- When the acceptance runs out, the risk is a problem again until someone accepts it again.
Owner
Every Medium or higher risk needs an owner who is on your team. If the owner is removed from the team, the risk counts as having no owner and the control updates right away.
Reviews
A review means "I looked at this risk again". It records who, when, a note, and the scores and treatment at that moment, so you can show how a risk changed. A review moves the next review date forward and clears any flag.
| Band | Next review |
|---|---|
| Critical, High | 90 days |
| Medium | 180 days |
| Low | 365 days |
Close, don't delete
Close a risk that no longer applies, with a reason. It moves to the Closed tab and keeps its history. Closed risks never change a control. You can reopen a closed risk. Delete is only for a risk added by mistake.
Flags: a failing control asks you to look again
Each risk can be linked to controls and to assets. When a control a risk depends on starts failing, for example the nightly Google test finds that MFA is off, the risk is flagged for review with the reason, such as MFA is enforced started failing.
- A flag is a note for a person. It never changes a control's status, so a control and a risk can't push each other around in a circle.
- Only a review clears the flag.
- Linking a risk to a control that is already failing flags it straight away.
How the register drives controls
| Control | Failing when | Needs evidence when |
|---|---|---|
| A risk analysis is done at least yearly | An open risk isn't scored, or an active ePHI asset rated High or Critical isn't linked to any open risk | Nobody has reviewed the register for a year |
| Risks found are tracked and reduced | A Medium or higher risk has no owner on the team, is untreated, is past its review date, or has an expired acceptance |
When everything is in order, the control is Passing and says how many risks it checked. If another source disagrees, the worst one wins, the same as on Evidence.
Good to know:
- Only open risks count. Closed risks never drive a control.
- Low risks and unscored risks never fail Risks found are tracked and reduced. An unscored risk fails A risk analysis is done at least yearly instead.
- A brand-new register is never stale on day one. The yearly clock starts from the newest of the last review and your oldest open risk.
- Changing an asset also rechecks the analysis control, so a system that becomes critical and has no risk turns it red.
Passing time changes things too: a review date or an acceptance can run out with nobody touching the page. A step in the daily job notices and updates the control. See Evidence: the daily job.
The heatmap
At the top of the page, a 5×5 grid counts your open risks by likelihood and impact. Use the Before controls / After controls toggle to see how the risks move once your controls are counted. Select a square to filter the list to those risks. The summary tiles show how many risks sit in each band and how many have a problem, and a link takes you to High and Critical risks with no treatment.
Risks on Controls and Assets
- A control's page lists the open risks linked to it and shows when a risk is flagged.
- An asset's edit drawer lists the open risks that cover it, with an Add a risk for this asset shortcut. The shortcut needs the risk-management permission and an active asset.
Audit trail
Every change is written to the audit log: compliance.risk_created, compliance.risk_updated, compliance.risk_accepted, compliance.risk_reviewed, compliance.risk_flagged, compliance.risk_closed, compliance.risk_reopened, compliance.risk_deleted and compliance.risks_added_from_library (one entry for the whole add). Flags are written by the system, not a person. Each time a control changes colour because of the register, compliance.control_status_changed is written too.
Good to know
- Details of the design are in ADR 011.
- Tasks, reminders and the signed risk assessment come in later modules.