---
title: 5 Security Risk Analysis Myths
description: Although HIPAA risk analysis and risk assessment are terms that closely resemble each other, there are significant differences between the two.
image: https://blog.netgainhosting.com/hubfs/social-suggested-images/riskanalysis.jpg
---

- [About Us](http://netgainhosting.com/about-us)
- [Why Netgain](http://netgainhosting.com/why-netgain/)
- [Who We Serve](http://netgainhosting.com/who-we-serve/)
- [Blog](https://blog.netgainhosting.com/)
- [![](http://netgainhosting.com/wp-content/themes/chat.png)Support](http://netgainhosting.com/support/)
- [![](http://netgainhosting.com/wp-content/themes/phone.png)Contact Us](http://netgainhosting.com/contact/)

# Netgain

[![Advancing Healthcare IT](http://netgainhosting.com/wp-content/uploads/2016/03/logo.png)](http://netgainhosting.com/) Navigation

- [Cloud Services](http://netgainhosting.com/cloud-services/)
- [On-Site services](http://netgainhosting.com/on-site-services/)
- [Professional Services](http://netgainhosting.com/professional-services/)
- [Products](http://netgainhosting.com/products/)

## [5 Security Risk Analysis Myths](https://blog.netgainhosting.com/5-security-risk-analysis-myths)

Posted by [Jessie Golombiecki - Marketing Coordinator](https://blog.netgainhosting.com/author/jessie-golombiecki-marketing-coordinator) on Jan 11, 2017 9:56:10 AM

- [Tweet](https://twitter.com/share)

![riskanalysis.jpg](https://blog.netgainhosting.com/hs-fs/hubfs/social-suggested-images/riskanalysis.jpg?width=200&name=riskanalysis.jpg "riskanalysis.jpg")Risk assessment and risk analysis are often used interchangeably. Although HIPAA risk analysis and risk assessment are terms that closely resemble each other, there are significant differences between the two.

Netgain and [4MedApproved](http://www.4medapproved.com/) partnered to present a learning lunch session to help remove the confusion and understand what the requirements are to fulfill the Meaningful Use measure. [In this on-demand webinar](https://blog.netgainhosting.com/webinar-security-risk-analysis), Charles Killmer, Security Officer at Netgain, dispels myths surrounding risk analysis, answers common questions, and addresses how to document to protect your practice in the event of an audit.

One of the most common myths is simply installing a certified EHR fulfills the Security Risk Analysis Meaningful Use requirement. Even with a certified EHR, you must perform a full security risk analysis. Security requirements address all electronic protected health information you maintain, not just what is in your EHR.

Here are four other myths of a security risk analysis

1. MYTH: A security risk analysis is optional for small providers.   
TRUTH: All providers who are “covered entities” under HIPAA are required to perform a risk analysis. In addition, all providers who want to receive EHR incentive payments must conduct a risk analysis.

2. MYTH: My EHR vendor took care of everything I need to do about privacy and security.   
TRUTH: Your EHR vendor may be able to provide information, assistance, and training on the privacy and security aspects of the EHR product. However, EHR vendors are not responsible for making their products compliant with HIPAA Privacy and Security Rules. It is solely your responsibility to have a complete risk analysis conducted.

3. MYTH: I have to outsource the security risk analysis.   
TRUTH: It is possible for small practices to do risk analysis themselves using self-help tools. However, doing a thorough and professional risk analysis that will stand up to a compliance review will require expert knowledge that could be obtained through services of an experienced outside professional.

4. MYTH: A checklist will suffice for the risk analysis requirement.   
TRUTH: Checklists can be useful tools, especially when starting a risk analysis, but they fall short of performing a systematic security risk analysis or documenting that one has been performed.

During the webinar, Charles also shares the answers to these commonly asked questions:

1. What is the difference between a risk assessment and a risk analysis?   
2. How is the scope of the analysis determined?   
3. What are the common myths of a security risk analysis?   
4. How often do we need to perform a risk assessment?   
5. Can I do an in-house risk analysis or do I have to hire a third party?   
6. What are common pitfalls of conducting a risk analysis?   
7. What is the difference between a review and a full risk analysis?   
8. What documents should I retain to protect my practice in the event of an Audit?   
9. What can I expect after the analysis?   
10. How much time do I have to resolve findings?

Keeping up with healthcare IT regulations and understanding how to properly secure ePHI is a big undertaking. [View the webinar](https://blog.netgainhosting.com/webinar-security-risk-analysis) to gain insight that will help your practice understand what goes into a risk assessment so you know what to expect when it comes time for your practice’s risk assessment.

[![New Call-to-action](https://no-cache.hubspot.com/cta/default/355362/aae86d24-c019-4189-8ccf-770fae613457.png)](https://cta-redirect.hubspot.com/cta/redirect/355362/aae86d24-c019-4189-8ccf-770fae613457)

 Topics: [Security Risk Analysis](https://blog.netgainhosting.com/topic/security-risk-analysis)

Thanks for visiting the *Netgain IT* blog.  The goal of our blog is to help our readers stay current on the changing needs and requirements of IT.  

We do this by proactively bringing ideas, expertise, and solutions to your attention, which enables you to communicate the related technology, security or compliance best practices to your employees.

 

---

 

### Subscribe to Email Updates

## Check out our latest resources:

[![New Call-to-action](https://no-cache.hubspot.com/cta/default/355362/ca25be1d-1426-4bd9-92b7-95822bafded0.png)](https://cta-redirect.hubspot.com/cta/redirect/355362/ca25be1d-1426-4bd9-92b7-95822bafded0)

[![New Call-to-action](https://no-cache.hubspot.com/cta/default/355362/909e2b46-a36a-4dbc-a9a9-bd869c766281.png)](https://cta-redirect.hubspot.com/cta/redirect/355362/909e2b46-a36a-4dbc-a9a9-bd869c766281)

[![New Call-to-action](https://no-cache.hubspot.com/cta/default/355362/fb40152b-e40d-4631-91c0-260d6afbad02.png)](https://cta-redirect.hubspot.com/cta/redirect/355362/fb40152b-e40d-4631-91c0-260d6afbad02)

 

 

 

### Recent Posts

### Posts by Topic

- [healthcare IT (15)](https://blog.netgainhosting.com/topic/healthcare-it)
- [cloud-computing (14)](https://blog.netgainhosting.com/topic/cloud-computing)
- [EHR (12)](https://blog.netgainhosting.com/topic/ehr)
- [Meaningful Use (11)](https://blog.netgainhosting.com/topic/meaningful-use)
- [Security Breaches, (6)](https://blog.netgainhosting.com/topic/security-breaches)
- [HIPAA (5)](https://blog.netgainhosting.com/topic/hipaa)
- [IT security (4)](https://blog.netgainhosting.com/topic/it-security)
- [malware (4)](https://blog.netgainhosting.com/topic/malware)
- [password security (4)](https://blog.netgainhosting.com/topic/password-security)
- [Cloud Adoption (3)](https://blog.netgainhosting.com/topic/cloud-adoption)
- [HealthIT (3)](https://blog.netgainhosting.com/topic/healthit)
- [Healthcare Mobile Security (3)](https://blog.netgainhosting.com/topic/healthcare-mobile-security)
- [Password best practices (3)](https://blog.netgainhosting.com/topic/password-best-practices)
- [Private Cloud Hosting (3)](https://blog.netgainhosting.com/topic/private-cloud-hosting)
- [Support Team (3)](https://blog.netgainhosting.com/topic/support-team)
- [cloud security (3)](https://blog.netgainhosting.com/topic/cloud-security)
- [ransomware (3)](https://blog.netgainhosting.com/topic/ransomware)
- [Client Satisfaction (2)](https://blog.netgainhosting.com/topic/client-satisfaction)
- [Computer Crash (2)](https://blog.netgainhosting.com/topic/computer-crash)
- [FQHCs (2)](https://blog.netgainhosting.com/topic/fqhcs)
- [Federally Qualified Health Centers (2)](https://blog.netgainhosting.com/topic/federally-qualified-health-centers)
- [Flash Storage (2)](https://blog.netgainhosting.com/topic/flash-storage)
- [Giving Back (2)](https://blog.netgainhosting.com/topic/giving-back)
- [Hybrid Cloud (2)](https://blog.netgainhosting.com/topic/hybrid-cloud)
- [IT Costs (2)](https://blog.netgainhosting.com/topic/it-costs)
- [IT solutions (2)](https://blog.netgainhosting.com/topic/it-solutions)
- [IT team (2)](https://blog.netgainhosting.com/topic/it-team)
- [IT-as-a-Service (2)](https://blog.netgainhosting.com/topic/it-as-a-service)
- [ITaaS (2)](https://blog.netgainhosting.com/topic/itaas)
- [Outsourced IT (2)](https://blog.netgainhosting.com/topic/outsourced-it)
- [PHI (2)](https://blog.netgainhosting.com/topic/phi)
- [Private Cloud (2)](https://blog.netgainhosting.com/topic/private-cloud)
- [Private Telecom (2)](https://blog.netgainhosting.com/topic/private-telecom)
- [Reviews (2)](https://blog.netgainhosting.com/topic/reviews)
- [cloud provider (2)](https://blog.netgainhosting.com/topic/cloud-provider)
- [data storage (2)](https://blog.netgainhosting.com/topic/data-storage)
- [hardware refresh (2)](https://blog.netgainhosting.com/topic/hardware-refresh)
- [outsourcing (2)](https://blog.netgainhosting.com/topic/outsourcing)
- [security services (2)](https://blog.netgainhosting.com/topic/security-services)
- [social engineering (2)](https://blog.netgainhosting.com/topic/social-engineering)
- [whitelisting (2)](https://blog.netgainhosting.com/topic/whitelisting)
- [ALS ice bucket challenge (1)](https://blog.netgainhosting.com/topic/als-ice-bucket-challenge)
- [APM (1)](https://blog.netgainhosting.com/topic/apm)
- [BYOD (1)](https://blog.netgainhosting.com/topic/byod)
- [Bring your own device (1)](https://blog.netgainhosting.com/topic/bring-your-own-device)
- [Budgeting (1)](https://blog.netgainhosting.com/topic/budgeting)
- [Casual for a Cause (1)](https://blog.netgainhosting.com/topic/casual-for-a-cause)
- [Client Feedback (1)](https://blog.netgainhosting.com/topic/client-feedback)
- [Cloud Implementation (1)](https://blog.netgainhosting.com/topic/cloud-implementation)
- [Computer Hardware (1)](https://blog.netgainhosting.com/topic/computer-hardware)
- [Connecting to the Cloud (1)](https://blog.netgainhosting.com/topic/connecting-to-the-cloud)
- [Data Breaches (1)](https://blog.netgainhosting.com/topic/data-breaches)
- [Disaster Recovery, Business Continuity (1)](https://blog.netgainhosting.com/topic/disaster-recovery-business-continuity)
- [Exchange Delivery (1)](https://blog.netgainhosting.com/topic/exchange-delivery)
- [FIT (1)](https://blog.netgainhosting.com/topic/fit)
- [Flex-IT Act (1)](https://blog.netgainhosting.com/topic/flex-it-act)
- [Futz Factor (1)](https://blog.netgainhosting.com/topic/futz-factor)
- [HIPAA Compliance (1)](https://blog.netgainhosting.com/topic/hipaa-compliance)
- [HIT (1)](https://blog.netgainhosting.com/topic/hit)
- [Health Information (1)](https://blog.netgainhosting.com/topic/health-information)
- [Healthcare IT trends (1)](https://blog.netgainhosting.com/topic/healthcare-it-trends)
- [Healthcare Information Security (1)](https://blog.netgainhosting.com/topic/healthcare-information-security)
- [Healthcare Trends (1)](https://blog.netgainhosting.com/topic/healthcare-trends)
- [Hosting Provider (1)](https://blog.netgainhosting.com/topic/hosting-provider)
- [ICD10 (1)](https://blog.netgainhosting.com/topic/icd10)
- [IT Aspects (1)](https://blog.netgainhosting.com/topic/it-aspects)
- [IT Hardware (1)](https://blog.netgainhosting.com/topic/it-hardware)
- [IT Strategy (1)](https://blog.netgainhosting.com/topic/it-strategy)
- [IT hosting (1)](https://blog.netgainhosting.com/topic/it-hosting)
- [IT outsourcing (1)](https://blog.netgainhosting.com/topic/it-outsourcing)
- [IT partner (1)](https://blog.netgainhosting.com/topic/it-partner)
- [IT roadmap (1)](https://blog.netgainhosting.com/topic/it-roadmap)
- [IT software (1)](https://blog.netgainhosting.com/topic/it-software)
- [Information Technology (1)](https://blog.netgainhosting.com/topic/information-technology)
- [Internet Explorer Security Alert (1)](https://blog.netgainhosting.com/topic/internet-explorer-security-alert)
- [Internet Wall of Shame, (1)](https://blog.netgainhosting.com/topic/internet-wall-of-shame)
- [MACRA (1)](https://blog.netgainhosting.com/topic/macra)
- [MGMA Annual Conference (1)](https://blog.netgainhosting.com/topic/mgma-annual-conference)
- [MIPS (1)](https://blog.netgainhosting.com/topic/mips)
- [Malicious Websites (1)](https://blog.netgainhosting.com/topic/malicious-websites)
- [Meaninguful Use (1)](https://blog.netgainhosting.com/topic/meaninguful-use)
- [Military Backgrounds (1)](https://blog.netgainhosting.com/topic/military-backgrounds)
- [Netgain (1)](https://blog.netgainhosting.com/topic/netgain)
- [Network Security (1)](https://blog.netgainhosting.com/topic/network-security)
- [Office 365 (1)](https://blog.netgainhosting.com/topic/office-365)
- [Performance & Availability (1)](https://blog.netgainhosting.com/topic/performance-availability)
- [Petya (1)](https://blog.netgainhosting.com/topic/petya)
- [Pure Storage (1)](https://blog.netgainhosting.com/topic/pure-storage)
- [SLA (1)](https://blog.netgainhosting.com/topic/sla)
- [SSAE 16 Audit (1)](https://blog.netgainhosting.com/topic/ssae-16-audit)
- [Sandworm Threat (1)](https://blog.netgainhosting.com/topic/sandworm-threat)
- [Security Breach (1)](https://blog.netgainhosting.com/topic/security-breach)
- [Security Risk Analysis (1)](https://blog.netgainhosting.com/topic/security-risk-analysis)
- [Service Level Agreement (1)](https://blog.netgainhosting.com/topic/service-level-agreement)
- [Shared Cloud, (1)](https://blog.netgainhosting.com/topic/shared-cloud)
- [Storage Costs (1)](https://blog.netgainhosting.com/topic/storage-costs)
- [Tech Gifts (1)](https://blog.netgainhosting.com/topic/tech-gifts)
- [Technology Terms (1)](https://blog.netgainhosting.com/topic/technology-terms)
- [Telecom (1)](https://blog.netgainhosting.com/topic/telecom)
- [Telecom Services (1)](https://blog.netgainhosting.com/topic/telecom-services)
- [Tiered Storage (1)](https://blog.netgainhosting.com/topic/tiered-storage)
- [Windows Security (1)](https://blog.netgainhosting.com/topic/windows-security)
- [antivirus (1)](https://blog.netgainhosting.com/topic/antivirus)
- [application whitelisting (1)](https://blog.netgainhosting.com/topic/application-whitelisting)
- [breach (1)](https://blog.netgainhosting.com/topic/breach)
- [business continuity (1)](https://blog.netgainhosting.com/topic/business-continuity)
- [cloud based (1)](https://blog.netgainhosting.com/topic/cloud-based)
- [cloud comparison (1)](https://blog.netgainhosting.com/topic/cloud-comparison)
- [cloud service provider (1)](https://blog.netgainhosting.com/topic/cloud-service-provider)
- [cloud services (1)](https://blog.netgainhosting.com/topic/cloud-services)
- [communication style (1)](https://blog.netgainhosting.com/topic/communication-style)
- [compliance (1)](https://blog.netgainhosting.com/topic/compliance)
- [compliance management (1)](https://blog.netgainhosting.com/topic/compliance-management)
- [computer disk failure (1)](https://blog.netgainhosting.com/topic/computer-disk-failure)
- [cost analysis (1)](https://blog.netgainhosting.com/topic/cost-analysis)
- [cryptolocker (1)](https://blog.netgainhosting.com/topic/cryptolocker)
- [cybercrime (1)](https://blog.netgainhosting.com/topic/cybercrime)
- [cybersecurity (1)](https://blog.netgainhosting.com/topic/cybersecurity)
- [ePHI (1)](https://blog.netgainhosting.com/topic/ephi)
- [email cons (1)](https://blog.netgainhosting.com/topic/email-cons)
- [equifax (1)](https://blog.netgainhosting.com/topic/equifax)
- [equifax breach (1)](https://blog.netgainhosting.com/topic/equifax-breach)
- [freedom (1)](https://blog.netgainhosting.com/topic/freedom)
- [hardware upgrade (1)](https://blog.netgainhosting.com/topic/hardware-upgrade)
- [hardware-based crashes (1)](https://blog.netgainhosting.com/topic/hardware-based-crashes)
- [health data (1)](https://blog.netgainhosting.com/topic/health-data)
- [himss (1)](https://blog.netgainhosting.com/topic/himss)
- [iOS 11 (1)](https://blog.netgainhosting.com/topic/ios-11)
- [independence day (1)](https://blog.netgainhosting.com/topic/independence-day)
- [integrations (1)](https://blog.netgainhosting.com/topic/integrations)
- [internet whitelisting (1)](https://blog.netgainhosting.com/topic/internet-whitelisting)
- [interoperability (1)](https://blog.netgainhosting.com/topic/interoperability)
- [machine learning (1)](https://blog.netgainhosting.com/topic/machine-learning)
- [medical billing (1)](https://blog.netgainhosting.com/topic/medical-billing)
- [mobile devices (1)](https://blog.netgainhosting.com/topic/mobile-devices)
- [mother's day (1)](https://blog.netgainhosting.com/topic/mothers-day)
- [patient information (1)](https://blog.netgainhosting.com/topic/patient-information)
- [personal health information (1)](https://blog.netgainhosting.com/topic/personal-health-information)
- [phishing attack (1)](https://blog.netgainhosting.com/topic/phishing-attack)
- [public cloud (1)](https://blog.netgainhosting.com/topic/public-cloud)
- [reducing operating costs (1)](https://blog.netgainhosting.com/topic/reducing-operating-costs)
- [security concerns (1)](https://blog.netgainhosting.com/topic/security-concerns)
- [security tools (1)](https://blog.netgainhosting.com/topic/security-tools)
- [software refresh (1)](https://blog.netgainhosting.com/topic/software-refresh)
- [ssae 18 (1)](https://blog.netgainhosting.com/topic/ssae-18)
- [ssae 18 certified (1)](https://blog.netgainhosting.com/topic/ssae-18-certified)
- [sysadmin day (1)](https://blog.netgainhosting.com/topic/sysadmin-day)
- [system administrators (1)](https://blog.netgainhosting.com/topic/system-administrators)
- [technology (1)](https://blog.netgainhosting.com/topic/technology)

see all

# Leverage IT Toward Your Desired Outcomes

### [![disaster](http://netgainhosting.com/wp-content/uploads/2016/04/DisasterRecovery.png)](http://netgainhosting.com/why-netgain#protection)[Data Protection & Disaster Recovery](http://netgainhosting.com/why-netgain#protection)

### [![Flixibiliity](http://netgainhosting.com/wp-content/uploads/2016/04/FlexibilityChange.png)Flexibility](http://netgainhosting.com/why-netgain#flexibility) [to Change](http://netgainhosting.com/why-netgain#flexibility)

### [![stabilize](http://netgainhosting.com/wp-content/uploads/2016/04/StabilzeCost.png)Stabilize](http://netgainhosting.com/why-netgain#stabilize) [Cost](http://netgainhosting.com/why-netgain#stabilize)

### [![streamline](http://netgainhosting.com/wp-content/uploads/2016/04/StreamlineSupport.png)Streamline](http://netgainhosting.com/why-netgain#streamline) [Support](http://netgainhosting.com/why-netgain#streamline)

### [![security](http://netgainhosting.com/wp-content/uploads/2016/04/Security.png)Heighten](http://netgainhosting.com/why-netgain#heighten) [Security](http://netgainhosting.com/why-netgain#heighten)

### [![Expand](http://netgainhosting.com/wp-content/uploads/2016/04/ExpandAccessibility.png)Access Anywhere](http://netgainhosting.com/why-netgain#access)

- [Sales: 877.797.4700 ext 3 /](tel:%20877-797-4700)
- [Support: 877.797.4700 ext 2 /](tel:%20877-797-4700)
- [![](http://netgainhosting.com/wp-content/uploads/2016/06/envl.png)Email Support /](mailto:support@netgainhosting.com?subject=Support%20Inquiry)
- [![](http://netgainhosting.com/wp-content/uploads/2016/06/chat.png)Contact 877.797.4700 /](tel:%20877-797-4700)
- [![](http://netgainhosting.com/wp-content/uploads/2016/06/fb.png) /](https://www.facebook.com/NetgainHosting)
- [![](http://netgainhosting.com/wp-content/uploads/2016/06/tweet.png) /](https://twitter.com/netgainhosting)
- [![](http://netgainhosting.com/wp-content/uploads/2016/06/linked.png)](https://www.linkedin.com/company/netgain-technology-inc)

## [Netgain](http://netgainhosting.com/about-us/)

- [History](http://netgainhosting.com/about-us/history/)
- [Leadership Team](http://netgainhosting.com/about-us/leadership-team/)
- [Mission & Values](http://netgainhosting.com/about-us/our-brand/)
- [Careers](http://netgainhosting.com/career/)
- [Resources](http://netgainhosting.com/resources/)
- [News](http://netgainhosting.com/news/)

## [Cloud Services](http://netgainhosting.com/cloud-services/)

- [Private Cloud Hosting](http://netgainhosting.com/cloud-services/private-cloud-hosting/)
- [Infrastructure as a Service](http://netgainhosting.com/cloud-services/infrastructure-as-a-service/)
- [Hybrid Cloud](http://netgainhosting.com/cloud-services/hybrid-cloud/)
- [EHR Hosting](http://netgainhosting.com/cloud-services/ehr-hosting/)
- [HIPAA Compliant Hosting](http://netgainhosting.com/cloud-services/hipaa-compliant-hosting/)
- [SSAE 16](http://netgainhosting.com/cloud-services/ssae-16/)

## [On-Site Services](http://netgainhosting.com/on-site-services/)

- [PremiseCloud](http://netgainhosting.com/on-site-services/premisecloud/)
- [Managed Services](http://netgainhosting.com/on-site-services/managed-services/)

## [Professional Services](http://netgainhosting.com/professional-services/)

## [Products](http://netgainhosting.com/products/)

- [Web Content Filtering](http://netgainhosting.com/products/web-content-filtering/)
- [Online Data Backup](http://netgainhosting.com/products/online-data-backup/)
- [Office 365](http://netgainhosting.com/products/office-365/)
- [Hosted Email](http://netgainhosting.com/products/hosted-email/)
- [Endpoint Encryption](http://netgainhosting.com/products/endpoint-encryption/)
- [Email Encryption](http://netgainhosting.com/products/email-encryption/)

## [For Client](http://my.netgainhosting.com)

- [Client Login](https://my.netgainhosting.com/)
- [Downloads](http://netgainhosting.com/download/)

## [Partner Program](http://netgainhosting.com/partner-program/)

- [Referral Program](http://netgainhosting.com/partner-program/referral-program/)
- [Reseller Program](http://netgainhosting.com/partner-program/reseller-program/)
- [White-Label Partner Program](http://netgainhosting.com/partner-program/white-label-partner-program/)

- © Copyright 2016 Netgain /
- [Privacy Policy](http://netgainhosting.com/privacy-policy/) /
- [Terms and Conditions](http://netgainhosting.com/terms-and-conditions/) /
- [Site Map](http://netgainhosting.com/site-map/)