THE US Department of Health and Human Services’ Office for Civil Rights (OCR) and Office of the National Coordinator for Health IT (ONC) have released version 3.7 of their Security Risk Assessment (SRA) Tool. The tool is intended to support security risk assessments, although the announcement does not identify a specific incident or confirmed exploitation linked to the update.
Version 3.7 adds or revises guidance on assessment coverage and scope, remote access and telework, and system activity logging. It also expands examples of assets to include newer technologies, updates software libraries to address bugs and vulnerabilities, and revises reports so they can capture additional details and comments. OCR and ONC are also offering live demonstrations and question-and-answer sessions through webinars on 15 September at noon Eastern Time and 16 September at 3pm Eastern Time.