The #1 cause of most meaningful use audits is failure to conduct a proper security risk analysis. Learn common myths and pitfalls associated with this meaningful use core objective.

1. Cause of Most MU Audit failures
Protect electronic health information. Conduct or
review a security risk analysis and implement updates
as necessary and correct identified security
deficiencies
Core Objectives not met
Medicaid volume mismatch

2. Security Risk Analysis Key Points
This is not a new requirement
The risk assessment needs to include the certified
version of your EHR
The risk assessment needs to be updated each year
It is a simple Yes/No answer during the attestation

3. Top 10 Myths of Security Risk Analysis
1. The SRA is optional for small Providers
2. Simply installing a certified EHR fulfills the SRA requirement
3. My EHR vendor took care of everything I need to do
4. I have to outsource the security risk analysis
5. A checklist will suffice for the SRA requirement
6. There is a specific SRA method that I must follow
7. My SRA only needs to look at my EHR
8. I only need to do the SRA once
9. Before I attest to MU I must mitigate all risks
10. Each year I’ll have to completely redo my SRA

4. What an SRA is
A documented It inventory of all hardware that stores,
processes or transmits ePHI
A documented assessment of the current physical,
technical and administrative environment
A list of identified risks that are prioritized by risk level
A documented mitigation plan
A full documented set of security policies

5. What Can I Do About Audits?
Make sure someone is responsible
Anticipate an audit
Know where the documentation is
Know what is in the documentation
Answer audits specifically and in a timely manner
Answer requests thoroughly
Contact Primaris

6. What Primaris Can Do For You
Conduct a thorough security risk analysis, providing:
– Recommended remediation action
– Facility walkthrough notes
– Sample security policy
– Privacy security breach reporting management plan
– Recommendation for obtaining ongoing security updates

7. Schedule your security review
Larry Henderson
Certified Security Specialist
573-355-8180
lhenderson@primaris.org