| Course | HI575 Protection of Health Information |
|---|---|
| Unit | Unit 3 |
| Paper type | Threat and vulnerability analysis |
| Length | About 950 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Health Informatics |
| Updated | October 2026 |
Free sample paper for HI575 Unit 3
Every Pairing Tied to a Fact: A Unit 3 Threat and Vulnerability Analysis of Twenty-Two Exposures at an Orthopedic Practice
[Student Name]
Purdue University Global
HI575: Protection of Health Information
Unit 3 Threat and Vulnerability Analysis
[Instructor Name]
[Date]
Tollbridge Orthopedic Group, its systems and every finding are composite; the framework and sources cited are real.
Definitions
A threat is something that could act against the practice's information: a person, an event or a failure. A vulnerability is a condition at this practice that would let that threat succeed. The distinction follows the risk assessment guide most health care organizations use, which treats a threat source, a threat event and a vulnerability as separate elements that combine to produce risk (Joint Task Force Transformation Initiative, 2012). Once the columns blur, a table of threats becomes a list of worries. Threat sources here are grouped as intentional human, accidental human, technical failure or environmental.
Method
Rows follow the inventory's order so each can be traced back to its location. Every vulnerability is written as an observable fact, a setting, a missing record or a physical arrangement, never as a category such as weak passwords in general. Evidence came from three places: interviews with location owners, the IT contractor's monthly patch report, and the site visits recorded in the inventory. Existing controls are recorded without judging them, because judging belongs to the risk matrix that follows. Grounding each row in evidence is how this analysis meets the Security Rule's demand that the risk assessment be accurate and thorough (45 C.F.R. § 164.308, 2024).
The Pairings
Each row gives the asset, threat source and event, the vulnerability with its evidence, and any existing control.
1. Imaging archive: intentional human, ransomware entering through remote access; operating system past vendor support with no patches since 2023 (patch report), equipment vendor's remote connection always open with no log of who uses it (vendor interview); control: nightly backup.
2. Imaging archive: technical failure, disk failure; single storage array with one spare drive (walk-through); control: nightly backup.
3. Email: intentional human, phishing leading to mailbox takeover; no multifactor sign-in for email (contractor settings report); control: spam filter.
4. Email: intentional human, silent forwarding of mail to an outside address; external forwarding rules allowed for all users (settings report); control: none.
5. Surgeon laptops: accidental human, loss or theft; four of eleven laptops without full-disk encryption (contractor inventory); control: password on sign-in.
6. Hosted record: intentional human, access by a former employee; departed therapist's account still active five months after leaving (access report); control: termination checklist that omits two systems.
7. Hosted record: accidental human, curious access by staff; audit logs kept but never reviewed (privacy officer interview); control: annual training.
8. Front desk workstation: accidental human, wrong person changes or views records; shared account at main clinic check-in (walk-through); control: none effective.
9. Front desk: accidental human, waiting patients read screens; monitor angled toward the waiting area (walk-through); control: none.
10. Copier fleet: accidental human, disclosure when leased devices return; internal drives never wiped (office manager interview); control: none.
11. MRI disc burner: accidental human, spoiled discs leave the building in trash; no disposal procedure for discs (imaging interview); control: none.
12. Workers' compensation spreadsheet: accidental human, sent to the wrong adjuster; spreadsheet attached whole rather than filtered (billing interview); control: none.
13. Texting vendor: intentional or accidental human at the vendor, misuse of exported data; no business associate agreement and unknown retention (front desk lead); control: none.
14. Fax server: accidental human, misdirected fax; outside numbers typed manually (front desk interview); control: cover sheet.
15. Portal: intentional human, account takeover with a reused password; portal allows sign-in without a second factor (vendor documentation); control: lockout after five attempts.
16. Backup service: technical failure, backups failing unnoticed; failure alerts sent to a shared mailbox no one is assigned to read (contractor interview); control: alerts exist.
17. Billing platform: intentional human, insider exporting claims data; export permission held by all eight billing staff (role report); control: confidentiality agreement.
18. Paper intake tray: accidental human, forms taken or read; tray on an open counter until scanned (walk-through); control: daily scanning.
19. Surgery center: environmental, power failure during cases; generator covers clinical power, not the network closet (facilities interview); control: battery backup of fifteen minutes.
20. Main clinic server closet: intentional human, physical access; closet door propped open for cooling (walk-through); control: lock when closed.
21. Therapy app: accidental human, wrong patient assigned a plan; app matches by name only (therapy lead); control: therapist review.
22. Hosted record vendor: technical failure, vendor outage; practice has no downtime procedure for clinics (front desk interview); control: vendor service agreement.
Seven of the twenty-two rows have no working control at all, and four of those seven sit at locations the IT list did not include.
Patterns
Three patterns stand out. First, remote access by outsiders, the archive vendor, a departed employee and potential email attackers, recurs in the rows most likely to matter. Second, the locations added by the inventory's interviews account for most of the uncontrolled rows. Third, several controls exist but are not operated: audit logs nobody reads, backup alerts nobody receives. A control that runs without anyone watching it should not be counted as protection, a point the national cybersecurity practices for health care stress repeatedly (Health Sector Coordinating Council, 2023).
What This Analysis Does Not Do
It does not rate likelihood or impact. Those ratings, and the ranking they produce, are the work of the risk matrix in Unit 4. Nor does it describe how any attack would be carried out; each row names the weakness and the threat, which is all the matrix needs.
References
45 C.F.R. § 164.308 (2024). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
Health Sector Coordinating Council. (2023). Health industry cybersecurity practices: Managing threats and protecting patients (2023 edition). U.S. Department of Health and Human Services, 405(d) Program.
Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Revision 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
The Purdue Global HI575 Unit 3 instructions
The third unit commonly asks you to identify threats and vulnerabilities for the assets in your inventory. Expect a table pairing each asset with a threat source and event, the vulnerability that would allow it, evidence and any existing control. Four pages of table plus short sections is typical. Define threat and vulnerability before the table so the columns stay distinct. Follow the inventory's order so each row traces back to an asset. Write each vulnerability as a fact about the organization, a setting or a physical arrangement, never a generic category. Say where each fact came from. Record existing controls without judging their strength, since rating belongs to the next unit. Avoid describing how attacks would be carried out.
Inside the HI575 Unit 3 example
Definitions open the analysis, separating a threat that could act from a vulnerability that lets it succeed, drawn from the federal risk assessment guide. A method section explains the evidence sources and why controls are recorded without judgment. Twenty-two numbered rows follow, from ransomware reaching the imaging archive through an always-open vendor connection to a hosted record outage with no downtime procedure. The highlighted sentence counts seven rows without any working control, four of them at locations the IT list omitted. A patterns section identifies outside remote access, inventory-added locations and controls that run unwatched. A closing section states that likelihood and impact belong to the next unit.
Where the points sit in the HI575 Unit 3 rubric
Threat and vulnerability analyses are generally scored on clarity of definitions, specificity of vulnerabilities, use of evidence, coverage of the inventory and organization. Specificity and evidence usually carry the most points: graders reward vulnerabilities written as facts about this organization with a stated source. Definitions earn credit when the two columns remain distinct throughout. Coverage is judged on whether every inventory location appears. A patterns section that draws conclusions across rows adds value. Clean tables and correct citations complete the rubric. Analyses that list generic threats such as hackers and weak passwords without tying them to the case tend to lose points. The existing controls column is expected to stay descriptive, leaving judgments of strength for the matrix that follows.
HI575 Unit 3 help from the desk
A frequent problem in this unit is blending threats and vulnerabilities, so the table repeats itself. Another is writing vulnerabilities as categories rather than observed facts. Some students skip evidence, which leaves every row open to challenge. Rows that do not trace back to the inventory break the chain the later units depend on. Describing attack techniques in detail is unnecessary and can be marked down. If your inventory came out differently, perhaps with a lab system or medical devices, bring that inventory along and the pairings will be drafted from your rows. Leaving the existing controls column blank is a smaller but common slip, since the matrix needs it to judge residual exposure.
Get an HI575 Unit 3 example written to your instructions
Send the environment described in your Unit 3 prompt, plus the rubric and any inventory you completed earlier. A custom analysis then pairs those assets with threats and weaknesses drawn from that setting's own facts, never from a stock catalog. It returns inside 24-48h, and the first one is free. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI575 papers and MS in Health Informatics samples
- HI575 Unit 1: Discussion Board Post
- HI575 Unit 2: Data Inventory
- HI575 Unit 4: Risk Analysis Matrix
- HI575 Unit 5: Access Control Policy
- HI575 Unit 6: Technical Safeguards Brief
- HI575 Unit 7: Incident Response Plan
- HI575 Unit 8: Seminar Reflection
- HI575 Unit 9: Contingency and Recovery Plan
- HI575 Unit 10: Security Risk Assessment Report
- HI570 Unit 3: Release of Information Decision
- HI560 Unit 3: Descriptive Statistics Report
- HI501 Unit 3: Structured Data Memo
- HI555 Unit 3: Front-End Process Map
HI575 Unit 3 questions, answered
Should the analysis include the likelihood of each threat?
Usually not yet, although sections differ. Many courses separate identification from rating so the reasoning behind each can be read on its own. The example stops at evidence and existing controls, leaving likelihood and impact for the matrix that follows. If your prompt asks for ratings here, add them as separate columns with a stated basis rather than folding them into the vulnerability text.
How many threat and vulnerability pairs are enough?
Enough to cover every asset in the inventory at least once, with more rows where one asset faces several credible threats. The example reaches twenty-two for seventeen locations. Graders tend to value coverage and specificity over volume, so ten well-evidenced rows usually outscore forty generic ones copied from a published threat catalog.
Can the sample describe how an attack actually works?
Only at the level a risk analysis needs, which means naming the threat and the weakness it would use. The example says a mailbox is exposed to credential phishing and records the missing control; it does not explain technique. That boundary matches what these assignments assess, and it keeps a sample focused on analysis rather than method.
Where can I find a free HI575 Unit 3 sample paper?
You can read the whole Unit 3 analysis on this page, twenty-two evidence-backed pairings from an imaging archive to a vendor outage.
Why must threats and vulnerabilities stay in separate columns?
A threat is something that could act against the information, such as ransomware or a lost laptop; a vulnerability is the condition at the organization that would let it succeed.