HHS Updates Security Risk Assessment Tool With New Cyber Guidance

The US Department of Health and Human Services’ Office for Civil Rights (OCR) and Office of the National Coordinator for Health IT (ONC) have released version 3.7 of the Security Risk Assessment (SRA) Tool. The tool is intended to support security risk assessments, although the supplied announcement does not identify a specific incident, vulnerability or confirmed exploitation linked to the update.

The release adds or revises guidance on assessment coverage and scope, remote access and telework, and system activity logging. It also expands examples of assets to cover newer technologies, updates software libraries to address bug and vulnerability fixes, and revises reports so they can record additional details and comments. ONC and OCR said they will hold live demonstrations and question-and-answer webinars on 15 September at noon ET and 16 September at 3pm ET. Organisations using the tool can download SRA Tool version 3.7 from the HHS health IT website.