# Practice Risk Assessment-or I formally admit defeat

**URL:** <https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073>\
**Category:** Miscellaneous and Personal Stuff I Must Share\
**Created:** [May 2, 2015, 5:16am UTC](https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073 "2015-05-02T05:16:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![psychobunny](https://avatars.discourse-cdn.com/v4/letter/p/54ee81/32.png) [@psychobunny](https://boards.straightdope.com/u/psychobunny)\
**Post date:** [May 2, 2015, 5:16am UTC](https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073/1 "2015-05-02T05:16:51Z")

</div>

As part of that wonderful thing known as meaningful use (in order to get money from the government for my medical practice transitioning to an electronic record), I am required to do a security assessment and I decided to use the government’s handy tool to help me. I can deal with questions about how I prevent theft of medical information, unauthorized logging on to computers and keeping patients from seeing reports of other patients. But then I came to this question:

_Does your practice implement procedures for identifying and assessing the criticality of its information system applications and the storage of data containing ePHI that would be accessed through the implementation of its contingency plans?_

and I give up. I don’t even want to try to unpack that question. Yes? No? Maybe? HELP ME!!!

---

<div class="post-metadata">

**Author:** ![Iggy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/iggy/32/3364_2.png) [@Iggy](https://boards.straightdope.com/u/Iggy)\
**Post date:** [May 2, 2015, 7:08am UTC](https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073/2 "2015-05-02T07:08:51Z")

</div>

My non-expert effort at translating Government-ese to English

_Does your practice implement procedures for identifying and assessing the criticality of its information system applications and the storage of data containing ePHI that would be accessed through the implementation of its contingency plans?_

Do you have a way to determine which computer programs that you use to access and store electronic patient records are critical programs? What is your contingency plan for accessing that information if the normal ways fail?

Or more simply… do you back up your records?

Others may chime in with a better interpretation.

---

<div class="post-metadata">

**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\
**Post date:** [May 2, 2015, 8:33am UTC](https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073/3 "2015-05-02T08:33:24Z")

</div>

Yes, it’s asking: how important are your electronic records, what would happen if they failed, and what steps are you taking to soften the blow if that happens.

---

<div class="post-metadata">

**Author:** ![Quartz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quartz/32/267_2.png) [@Quartz](https://boards.straightdope.com/u/Quartz)\
**Post date:** [May 2, 2015, 4:56pm UTC](https://boards.straightdope.com/t/practice-risk-assessment-or-i-formally-admit-defeat/719073/4 "2015-05-02T16:56:26Z")

</div>

More than that, it’s also asking about disaster recovery, data integrity assurance, and data security.