# HIPAA Risk Analysis — Standards and References

## Primary Legal Sources
- **45 CFR §164.308(a)(1)(ii)(A)** — Risk Analysis (Required implementation specification)
- **45 CFR §164.308(a)(1)(ii)(B)** — Risk Management (Required implementation specification)
- **45 CFR §164.306(a)** — General requirements (security standards must reduce risks to reasonable and appropriate levels)
- **45 CFR §164.306(b)** — Flexibility of approach (size, complexity, capabilities, costs, probability and criticality of risks)

## OCR Guidance
- **OCR Guidance on Risk Analysis Requirements under the HIPAA Security Rule** (July 14, 2010) — defines nine essential elements
- **OCR Frequently Asked Questions on Risk Analysis** — clarifications on scope, methodology, and documentation
- **OCR HIPAA Audit Protocol** — risk analysis assessment criteria used in OCR audits

## NIST Standards
- **NIST SP 800-30 Rev. 1** — "Guide for Conducting Risk Assessments" (September 2012) — primary risk assessment methodology
- **NIST SP 800-66 Rev. 2** — "Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide" (February 2024)
- **NIST SP 800-37 Rev. 2** — "Risk Management Framework for Information Systems and Organizations" (December 2018)
- **NIST SP 800-39** — "Managing Information Security Risk" (March 2011) — organization-wide risk management
- **NIST SP 800-53 Rev. 5** — "Security and Privacy Controls" — control catalog for risk mitigation
- **NIST Cybersecurity Framework 2.0** — risk-based approach to managing cybersecurity risk

## Threat Intelligence Sources
- **HHS HC3 (Health Sector Cybersecurity Coordination Center)** — healthcare-specific threat intelligence and advisories
- **CISA Known Exploited Vulnerabilities Catalog** — vulnerabilities requiring immediate remediation
- **FBI Internet Crime Complaint Center (IC3)** — annual Internet Crime Reports with healthcare sector data
- **MITRE ATT&CK for Healthcare** — adversary tactics and techniques targeting healthcare organizations

## Industry Frameworks
- **HITRUST CSF v11** — risk-based framework incorporating HIPAA, NIST, ISO 27001
- **ISO/IEC 27005:2022** — information security risk management guidance
- **FAIR (Factor Analysis of Information Risk)** — quantitative risk analysis framework
- **OCTAVE Allegro** — operationally critical threat, asset, and vulnerability evaluation