HIPAA COW is pleased to provide you with this HIPAA COW Risk Analysis & Risk Management Toolkit (Toolkit). Please note that this Toolkit is a work in progress. More documents will be added to further assist organizations in their efforts to complete a Risk Analysis, Risk Assessment, and their Risk Management strategy. Please contact us with any recommendations, questions, or special requests.

The following Toolkit documents are currently available:

Start Here

This Guide provides a summary of all the tools in this Toolkit (listed below) as well as ideas on how to use them to complete a risk analysis, risk assessment, and develop and implement a risk management strategy. It also includes a list of references reviewed and used while developing this Toolkit.

NIST Risk Assessment Steps

HIPAA COW Risk Assessment Template

January 2024 updates: Updated Risk Toolkit! The HIPAA COW Risk Management Networking Group (RMNG) completed its review and incorporation of the NIST CSF v1.1. into the HIPAA COW Risk Assessment Template.  

This document contains several worksheets, including:

• HIPAA COW Disclaimer
• Example Security P&P List
• Security Questions
• Current Threat List
• Inventory Asset List
• Risk Mitigation Implementation Plan
• Office Use Only

NIST Threat Overview

Network Diagram Example

NIST Risk Definitions & Calculations

NIST Risk Mitigation Activities

HIPAA COW Risk Analysis Report Template

Risk Management Policy

This may be used by your organization as a template to create a Risk Management Policy. The policy was updated on 1/16/13 to better align with the HIPAA COW Risk Analysis & Risk Management toolkit.

OCR Phase 2 Audit Protocol

This is simply a copy/paste of the OCR Phase 2 Audit Protocol that was posted in April 2016 HERE.

OCR HIPAA COW OCR Audit Protocol

June 2012 – This OCR HIPAA Audit Protocol, with the last column added by HIPAA COW on the Security and Privacy & Breach worksheets, includes the question numbers that currently are believed to cover some or all of the audit protocol requirements for each specific item. The HIPAA COW Risk Management Networking Group reviewed the established performance criteria and audit procedures in the OCR HIPAA Audit Program and enhance the HIPAA Security questions and recommended controls on the HIPAA COW Risk Assessment Template spreadsheet. This project was completed in August of 2013.

OCR Audit Protocol

June 2012: 2012 Cross Reference to the HIPAA COW Risk Assessment Changes Made

NIST CSF HIPAA COW Crosswalk

This document includes the NIST Cybersecurity Framework v1.1. For Subcategories ID.AM-1 through RS.CO-3, the Risk Management Networking Group (RMNG) included the question numbers from the Security Questions worksheet of the HIPAA Security Risk Assessment Toolkit Excel document, that are believed to cover some or all of the audit protocol requirements. The RMNG is continuing to work through the remainder of the of the controls and will post an update when completed. There is also a Maturity Definitions tab in this document, which are based off the NIST CSF Framework Implementation Tiers.

NIST SP 800-30 v2002

This Toolkit is based on many of the methodologies described in this document.