HI575 Unit 10 Security Risk Assessment Report Example

Course	HI575 Protection of Health Information
Unit	Unit 10
Paper type	Security risk assessment report
Length	About 1,140 words, 7 pages double-spaced
Format	APA 7 student paper
School	Purdue University Global
Program	MS in Health Informatics
Updated	October 2026

Free sample paper for HI575 Unit 10

Twenty-Two Exposures, One Decision Each: A Unit 10 Security Risk Assessment Report for an Orthopedic Practice's Managing Partners

[Student Name]

Purdue University Global

HI575: Protection of Health Information

Unit 10 Security Risk Assessment Report

[Instructor Name]

[Date]

Tollbridge Orthopedic Group, its partners, exposures and costs are composite; the regulations and sources cited are real.

What this part is doingStating the decision requested on the first page respects partners who will stop reading after the summary.

Cover Memo

To the managing partners: this report completes the security risk assessment the practice must perform and keep current under the Security Rule. It asks for two decisions: fund four controls this year, and accept two residual risks in writing.

Executive Summary

The assessment was carried out from March to September of this year across six clinics and the surgery center. It found seventeen locations where patient information is created, stored, sent or destroyed, four of them unknown to the practice's IT contractor. Twenty-two exposures were rated by likelihood and impact. Three were high: the imaging archive, which runs an unsupported operating system reachable through an always-open vendor connection; email accounts without multifactor sign-in; and four unencrypted surgeon laptops. A mailbox takeover in June, which exposed information about 1,180 patients, confirmed the email rating and raised one moderate exposure, silent forwarding, to high.

Decision requested: fund archive replacement and isolation, multifactor sign-in, laptop encryption and badge sign-in at the front desk, at an estimated 58,000 to 83,000 dollars in the first year; and accept two residual risks described below.

Scope and Method

The assessment covered every system holding electronic patient information, the paper intake and disposal processes at two clinics, and the three vendors with remote access. Excluded: anesthesia equipment at the surgery center, which the equipment vendor manages under a separate agreement, and the Eastfield clinic, which opened after fieldwork ended. Both should be assessed next year.

The method followed the federal risk assessment guide: inventory assets, pair threats and vulnerabilities with evidence, rate likelihood and impact on defined scales, and decide how to treat each risk (Joint Task Force Transformation Initiative, 2012). The Security Rule requires an accurate and thorough risk analysis and risk management measures that reduce risks to a reasonable and appropriate level (45 C.F.R. § 164.308, 2024).

Findings in Brief

The inventory, condensed to one table in Appendix A, found seventeen locations; the four new ones were copier drives, a disc burner, a workers' compensation spreadsheet and an appointment-texting vendor without a business associate agreement. The threat analysis, Appendix B, produced twenty-two pairings, seven with no working control. The matrix, summarized here and given in full in Appendix C, banded three exposures high, ten moderate and nine low. After the June incident, silent forwarding moves to high, giving four high exposures.

Risk Treatment

Each exposure receives one of four decisions: mitigate, transfer, avoid or accept. Acceptance requires a stated reason and a partner's signature.

1. Imaging archive: mitigate by replacing the server and isolating vendor access. Residual: moderate until replacement in the second quarter.

2. Email takeover and silent forwarding: mitigate with multifactor sign-in and an outside-forwarding block, the latter already in place since June. Residual: low.

3. Unencrypted laptops: mitigate with full-disk encryption. Residual: low.

4. Departed employee access: mitigate under the new access control policy, with four-hour removal and quarterly recertification. Residual: low.

5. Shared front desk account: mitigate with badge sign-in. Residual: low.

6. Backup failures unnoticed: mitigate by assigning alerts to named people with escalation. Residual: low.

7. Texting vendor: mitigate by obtaining a business associate agreement within sixty days or ending the service. Residual: low.

8. Copier drives: mitigate by adding drive destruction to lease returns. Residual: low.

9. Workers' compensation spreadsheet: mitigate by moving it into the billing platform. Residual: low.

10. Hosted record vendor outage: transfer through the vendor's service agreement, with downtime procedures in the contingency plan. Residual: moderate.

11. Network closet power at the surgery center: mitigated by the generator transfer switch. Residual: low.

12. Remaining low exposures: accept, as listed in Appendix C.

Every exposure ends with a named decision, and the only risks left moderate are those the practice has chosen, in writing, to carry for a stated time.

Residual Risks for Acceptance

Two residual risks are presented for acceptance. First, the imaging archive remains moderate until its replacement in the second quarter; the interim measure is that vendor access is limited to scheduled sessions. Second, full archive recovery takes about six hours rather than two until the faster offsite link is installed, with recent studies restored within an hour; this was demonstrated in the September restore test. Dr. Alvarez, managing partner, is asked to sign the acceptance of both, with a review date of the end of the second quarter.

What Changed Because of the Incident

The June incident was the assessment's most useful evidence. It showed that a moderate rating based on a dependency, forwarding requires a compromised account first, understated the combined risk when the first control was missing. The incident response plan worked as written: containment took under two hours, evidence was preserved, and notifications went out on day 24, well within the sixty days allowed (45 C.F.R. § 164.404, 2024).

Limits of the Report's Claims

Nothing in this report declares the practice compliant. It documents a completed assessment and the decisions taken, which is what the rule requires, and it recommends that the assessment be updated annually and after any major change. The government's resource guide treats risk assessment as continuous rather than a one-time project (Marron, 2024).

What this part is doingRefusing to call the practice compliant keeps the report within what an assessment can actually show and protects the partners from overreliance on it.

Costs and Timing

The four funded controls are sequenced by risk. Archive isolation, which needs only configuration, begins in the first month; the replacement server follows in the second quarter. Multifactor sign-in rolls out clinic by clinic over six weeks, starting with billing, whose mailbox was taken over. Laptop encryption takes one week, scheduled around surgeons' clinic days. Badge sign-in is installed at the main clinic first, where the shared account was found, then at the other five sites. The first-year estimate of 58,000 to 83,000 dollars includes setup, licenses and the replacement server; ongoing costs after year one fall to about 20,000 dollars a year, mostly licenses and the privacy officer's review time. Against these figures, the June incident alone cost about 31,000 dollars in staff time, mailing, credit monitoring and outside counsel, before any regulatory inquiry.

Who Owns Each Decision

The practice administrator owns the control rollout and reports progress to the partners monthly. The privacy and security officer owns the risk register and updates the matrix after each control goes live. The IT contractor owns the technical work under a revised statement of work that now includes alert ownership and quarterly restore tests.

Appendices

A: inventory table. B: threat and vulnerability pairings. C: full matrix with evidence. D: access control policy. E: technical safeguards brief. F: incident response plan with the June timeline. G: contingency plan with restore test results. H: signed acceptance form.

What this part is doingCondensing earlier documents into appendices, rather than pasting them in full, keeps the report readable while showing it rests on completed work.

References

45 C.F.R. § 164.308 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308

45 C.F.R. § 164.404 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-D/section-164.404

Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Revision 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1

Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66r2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2

HI575 Unit 10 instructions, in plain terms

The final unit typically asks for a complete security risk assessment report that integrates earlier assignments and supports decisions by leadership. Expect a cover memo, an executive summary with the decision requested, scope and method including exclusions, condensed findings, a risk treatment table, residual risk acceptance and appendices. Twelve pages under a cover memo is common. Write the summary for a reader who stops after two pages. Name what was excluded rather than implying full coverage. Condense earlier documents instead of pasting them. Give every exposure a decision, and allow acceptance only with a reason and a signature. Avoid claiming compliance; the report documents an assessment.

How the HI 575 Unit 10 example is put together

A cover memo states the two decisions requested. The executive summary gives scope, dates, the high exposures, the June incident's effect and the cost range. Scope and method name two exclusions and follow the federal risk assessment guide and the Security Rule. Findings condense the inventory, pairings and matrix with appendix references. A twelve-line treatment table assigns mitigate, transfer or accept to each exposure with residual levels, and the highlighted sentence notes that only chosen risks remain moderate. Residual risks are presented for Dr. Alvarez's signature. Sections cover the incident's lessons, the limits of the report's claims, costs and timing, decision owners and appendices.

Reading the HI575 Unit 10 grading rubric

Final risk assessment reports are commonly marked on integration of earlier work, clarity for executives, completeness of risk treatment, honesty about scope and limits, and professional presentation. Risk treatment and executive clarity usually carry the most points: every exposure needs a decision, and the summary must state what leaders are asked to do. Integration earns credit when earlier documents are condensed and referenced rather than repeated. Honesty about exclusions and the refusal to claim compliance are rewarded. Costs, timing and named owners add credit. Appendices and correct citations complete the rubric. Reports that paste earlier assignments whole or leave risks without decisions tend to lose points. Naming who owns each decision after approval, and when risks will be reviewed, shows the assessment will continue rather than end with the report.

HI575 Unit 10 help: mistakes that cost points

The most common shortfall in final reports is pasting earlier assignments rather than condensing them. Another is an executive summary that describes the method before stating the decision. Some students leave low risks without any decision, or accept risks without a signature. Exclusions are often implied rather than named. Claims of compliance overstate what an assessment shows. Costs without timing make approval harder. When your earlier units covered a hospital department or a clinic network instead of a practice, gather those submissions and we will fold them into one report built around the decisions your leaders face. Reports also lose points when residual risk levels are missing from the treatment table, leaving leaders unsure what remains after funding.

Get an HI575 Unit 10 example written to your instructions

Final reports differ in audience as much as content: a board, a compliance committee or a practice owner. Send your Unit 10 instructions and rubric with whatever earlier documents you completed, and a custom report condensing them for that reader arrives inside 24-48h. The first one is free. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.

More HI575 papers and MS in Health Informatics samples

HI575 Unit 10 questions, answered

Should the final report repeat all of my earlier assignments?

Condense them. The example gives inventory, pairings and ratings a page each and moves full versions to appendices, so a reader can follow the argument without wading through tables. Many rubrics reward synthesis over volume here, and the treatment table, which no earlier unit produced, is where most of the new analysis sits.

Who should sign off on accepted risks?

Someone with authority over the resources that would otherwise reduce the risk, usually an executive or owner rather than the security lead. The example routes acceptance to a managing partner and leaves the signature line empty for that person. Stating the reason for acceptance beside the signature is what distinguishes a decision from an unaddressed finding.

Can the report say the organization is now compliant?

It should not. A risk assessment documents exposures, decisions and residual risk at a point in time; it cannot certify an outcome. The example's limitations paragraph says what the assessment establishes and what it does not, and recommends reassessment on stated triggers. Graders in health information courses tend to treat compliance claims as overreach.

How did the mailbox incident change the HI575 risk ratings?

It showed that silent forwarding, rated moderate because it needed a compromised account first, was understated while multifactor sign-in was missing, so it moved to high.

Where can I find a free HI575 Unit 10 sample paper?

The whole Unit 10 report is on this page, from the cover memo and treatment table to the residual risks presented for signature.