| Course | HI575 Protection of Health Information |
|---|---|
| Unit | Unit 4 |
| Paper type | Risk analysis matrix |
| Length | About 920 words, 6 pages double-spaced |
| Format | APA 7 student paper |
| School | Purdue University Global |
| Program | MS in Health Informatics |
| Updated | October 2026 |
Free sample paper for HI575 Unit 4
No Score Without a Sentence: A Unit 4 Risk Analysis Matrix Rating Twenty-Two Exposures by Likelihood and Impact
[Student Name]
Purdue University Global
HI575: Protection of Health Information
Unit 4 Risk Analysis Matrix
[Instructor Name]
[Date]
Tollbridge Orthopedic Group, its exposures and every score are composite; the framework and sources cited are real.
The Scales
Likelihood, judged over the next three years at Tollbridge:
1. Not expected within five years.
2. Possible within five years.
3. Expected within three years.
4. Expected about once a year.
5. Expected more than once a year.
Impact, judged by records affected and care disrupted:
1. A handful of records, no disruption to care.
2. Up to 100 records or a few hours of inconvenience.
3. Up to 1,000 records or one clinic day disrupted.
4. Up to 10,000 records or several days of disruption at one site.
5. The whole patient base exposed, or surgery canceled across the practice.
These definitions follow the semi-quantitative approach in the federal risk assessment guide, which recommends that each value be tied to criteria an assessor can check (Joint Task Force Transformation Initiative, 2012).
The Matrix
Each row gives the exposure, likelihood with its basis, impact with its basis, and the product.
1. Imaging archive, ransomware through vendor access. Likelihood 4: unpatched system with an always-open connection, and practices of this size report ransomware attempts yearly. Impact 5: 310,000 studies and surgery planning stop. Score 20.
2. Imaging archive, disk failure. Likelihood 2: array is six years old with a spare. Impact 4: archive down for days until restore. Score 8.
3. Email takeover by phishing. Likelihood 4: no second factor and two phishing reports last year. Impact 4: mailboxes hold referrals and claim attachments for thousands of patients. Score 16.
4. Silent external forwarding. Likelihood 3: forwarding is allowed for everyone but requires a compromised account first. Impact 4: as above. Score 12.
5. Unencrypted surgeon laptops. Likelihood 3: laptops travel between sites daily. Impact 5: exported schedules and notes for thousands of patients. Score 15.
6. Active account of a departed therapist. Likelihood 3: account works remotely. Impact 4: full record access. Score 12.
7. Curious staff access. Likelihood 4: common in practices without log review. Impact 2: individual records. Score 8.
8. Shared front desk account. Likelihood 5: daily. Impact 2: changes cannot be attributed. Score 10.
9. Screen viewed by waiting patients. Likelihood 4. Impact 1. Score 4.
10. Copier drives returned with leases. Likelihood 2: two leases end next year. Impact 4: years of scanned pages. Score 8.
11. Spoiled discs in trash. Likelihood 2. Impact 2. Score 4.
12. Workers' compensation spreadsheet to the wrong adjuster. Likelihood 3. Impact 3: about 600 rows. Score 9.
13. Texting vendor misuse. Likelihood 2. Impact 3. Score 6.
14. Misdirected fax. Likelihood 4. Impact 1. Score 4.
15. Portal account takeover. Likelihood 3. Impact 2. Score 6.
16. Backups failing unnoticed. Likelihood 3: alerts unread. Impact 4: recovery impossible after an outage. Score 12.
17. Insider export of claims. Likelihood 2. Impact 4. Score 8.
18. Intake forms read at the counter. Likelihood 2. Impact 1. Score 2.
19. Network closet without generator power. Likelihood 2. Impact 3. Score 6.
20. Closet door propped open. Likelihood 2. Impact 3. Score 6.
21. Wrong patient in the therapy app. Likelihood 2. Impact 2. Score 4.
22. Hosted record vendor outage. Likelihood 3. Impact 3. Score 9.
Three exposures reach the high band, and all three concern remote or portable access to large stores of data, not the front desk.
Bands
A product of 15 or more places a row in the high band; products from 8 through 14 are moderate; anything under 8 is low. High: the imaging archive (20), email takeover (16) and unencrypted laptops (15). Moderate: ten rows, from the departed therapist's account and silent forwarding at 12 to curious access and copier drives at 8. Low: nine rows. Federal guidance expects the assessment to assign a risk level to each combination of threat and vulnerability and to document how it was reached (Office for Civil Rights [OCR], 2010).
The Script
A thirty-line Python script handles only arithmetic and ordering. It reads the twenty-two pairs from a small comma-separated file with columns for identifier, asset, likelihood and impact; multiplies likelihood by impact; sorts rows in descending order of score, breaking ties by impact; assigns the band using the thresholds above; and writes a sorted table. It makes no judgments. Every number it uses was entered by hand from the evidence column.
Recomputed Rows
Three rows were recalculated on paper to confirm the script. The archive: 4 times 5 is 20, high, first in the sort. Curious access: 4 times 2 is 8, which sits exactly on the boundary and is correctly banded moderate. The texting vendor: 2 times 3 is 6, low. All three match the script's output.
Limits of the Method
Multiplying two ordinal scales is a convention, not true arithmetic: a score of 16 is not exactly twice as risky as 8. The method is used because it ranks consistently and is easy to explain, and the federal guide accepts semi-quantitative scoring for that purpose. The resource guide for the Security Rule also notes that scores should be revisited when circumstances change (Marron, 2024). One judgment deserves a flag: silent forwarding was rated moderate because it requires a compromised account first, which makes it partly dependent on email takeover. If the second factor is not added, both rows should be reconsidered together.
References
Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30, Revision 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
Marron, J. A. (2024). Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A cybersecurity resource guide (NIST Special Publication 800-66r2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-66r2
Office for Civil Rights. (2010). Guidance on risk analysis requirements under the HIPAA Security Rule. U.S. Department of Health and Human Services.
The Purdue Global HI575 Unit 4 instructions
Unit 4 typically asks you to rate the likelihood and impact of each threat and vulnerability pair and produce a ranked matrix. Expect scale definitions, a table of scores with justification, risk levels or bands, and a short discussion of method. Five pages with an appendix is common. Define each level of each scale in terms another person could check, such as frequency or records affected. Give the evidence behind every score in the next column. If you use a spreadsheet or script, say exactly what it does and verify a few rows by hand. State your band thresholds. Discuss the limits of multiplying ordinal scales, and flag any rows whose scores depend on each other.
How this HI575 Unit 4 example is built
Two scale tables define likelihood from not expected within five years to more than once a year, and impact from a handful of records to the whole patient base or canceled surgery. The matrix lists twenty-two pairs with likelihood, impact, the evidence for each and the product, and the highlighted sentence notes that all three high scores concern remote or portable access. A bands section states the thresholds and counts, citing OCR guidance on documenting risk levels. The script is described step by step without judgment in its code. Three recomputed rows, including a boundary case, confirm the output. A limits section explains the ordinal convention and flags silent forwarding's dependency on email takeover.
Reading the HI575 Unit 4 grading rubric
Risk matrices are commonly marked on clear scale definitions, justified scores, accurate calculation, appropriate banding and reflection on method. Justified scores usually carry the largest share, since a number without evidence is treated as unsupported. Scale definitions earn credit when two readers could apply them alike. Calculation accuracy is checked, and verifying a sample by hand is rewarded where software is used. Banding should state thresholds. A discussion of method limits, such as ordinal multiplication, shows maturity. Tables and correct citations complete the rubric. Matrices that assign scores without explanation, or that use undefined labels such as medium, tend to lose points. Some instructors also check that the highest-ranked rows match the threats the case itself emphasizes, which is a quick test of judgment.
HI575 Unit 4 help: mistakes that cost points
The most frequent weakness here is scores with no stated basis. Another is vague scale levels that different readers would apply differently. Some students rely on a spreadsheet without checking it. Bands are often unexplained. A few treat the product as a precise measurement rather than a ranking. Dependencies between rows are rarely noticed. Where your matrix needs different scales, perhaps dollar impact or patient safety weighting, tell us how your course defines them and the scoring will follow those definitions row by row. Watch for scales that crowd every row into the middle values, since a matrix where everything scores nine ranks nothing.
Get an HI575 Unit 4 example written to your instructions
The pairs your own analysis produced are what a custom matrix should score. Share them with the Unit 4 prompt and the rubric; the sample then defines the scales, cites a basis for each rating and ranks the results, by spreadsheet, hand or script as your section prefers. The first sample is free and ready within 24-48h. The paper above is an original model document written by our desk, not a submitted student paper and not an official Purdue University Global document.
More HI575 papers and MS in Health Informatics samples
- HI575 Unit 1: Discussion Board Post
- HI575 Unit 2: Data Inventory
- HI575 Unit 3: Threat and Vulnerability Analysis
- HI575 Unit 5: Access Control Policy
- HI575 Unit 6: Technical Safeguards Brief
- HI575 Unit 7: Incident Response Plan
- HI575 Unit 8: Seminar Reflection
- HI575 Unit 9: Contingency and Recovery Plan
- HI575 Unit 10: Security Risk Assessment Report
- HI570 Unit 4: E-Discovery Memo
- HI560 Unit 4: Data Quality Assessment
- HI501 Unit 4: Decision Support Rule Design
- HI555 Unit 4: Charge Capture Review
HI575 Unit 4 questions, answered
Do I have to use a script to build the matrix?
No. Most sections accept a spreadsheet or a table worked by hand, and rubrics look at the reasoning rather than the tool. The example uses a short script because twenty-two rows invite arithmetic slips and the code makes the banding rule explicit. Whatever the method, state the thresholds and show at least a few rows recomputed independently.
Is multiplying likelihood by impact mathematically valid?
Not strictly, since both scales are ordinal rankings rather than measurements, and a 4 is not twice a 2. The practice is common in health care risk work because it produces a usable ordering. The example acknowledges the limitation in one sentence and uses the product only to sort and band, never to claim that one risk is a precise multiple of another.
How should impact be scored for a health care organization?
Beyond the number of records exposed, many sections expect care disruption and data integrity to count. The example's impact scale combines records affected with whether clinics or the surgery center would stop, so an archive outage scores high even if nothing leaves the building. A scale built on confidentiality alone tends to underrate ransomware and plain system failure.
Where can I find a free HI575 Unit 4 sample paper?
The full Unit 4 matrix is on this page, with defined scales, evidence for every score, the banding and three hand-checked rows.
Why should every risk score carry a sentence of evidence?
Because a bare number cannot be checked or challenged. The evidence lets reviewers debate the basis, and it shows the rating was not guessed.