What Is Healthcare Risk Assessment?

Managing risk in the hospital setting is a difficult but vital practice. On any given day, the risks are enormous: Situations ranging from data breaches to medical errors and hazardous conditions can arise, jeopardizing human safety, compliance and finances, reputations, and more. 

While quality and risk managers are ultimately responsible for continually assessing and minimizing an untold number of risks to patients, staff, and the public in today’s healthcare organizations, every healthcare participant has a role to play. Understanding the risks and learning how effective risk assessment is conducted is a great place for everyone to start.

Why is healthcare risk assessment important?

As a healthcare administrative professional, you understand the importance of mitigating risk to foster patient safety and shore up revenue that can be lost due to noncompliance. You’ve read the health-industry articles on it, and perhaps even attended hot-topic sessions about risk mitigation provided by your professional organization. 

Increasingly, your quality and risk managers or hospital administration may be offering education and training about how the facility performs and mitigates risk. But who, exactly, requires risk assessment, why is it necessary, and how can your organization better manage an effective program of risk assessment?

Every healthcare organization employee, administrator, and governing board member should know that risk assessment is mandated through the laws and guidelines of regulatory bodies. The U.S. Department of Health and Human Services (HHS) is perhaps the most widely known entity that requires and monitors risk compliance. Its Health Insurance Portability and Accountability Act (HIPAA) outlines breach and security rules that surround protected health information (PHI). 

The HIPAA Security rule requires a covered entity or business associate to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.” The Security Rule also requires the maintenance of a written record of the action, activity, or assessment, which may be electronic. 

To comply with these HIPAA requirements, a hospital must perform a risk assessment of any potential breach to determine the probability of compromise of PHI, and it must perform a written risk assessment as to the vulnerabilities of electronic PHI.

In addition to the HIPAA requirements, other government programs and regulations address the need for risk assessment. Among them are:

• The Office of the Inspector General (OIG)
• The Department of Justice (DOJ)
• The Centers for Medicare & Medicaid Services (CMS), 
• The Environmental Protection Agency 
• The Occupational Safety and Health Administration (OSHA)

Healthcare compliance is serious business with significant fiscal consequences. Penalties for regulatory noncompliance are steep in terms of monetary fines, exclusion from participation in federal healthcare programs, prison time, and reputational damage. Consider that:

• In 2020, the U.S. Department of Health & Human Services’ Office of Inspector General (OIG) reported 624 criminal actions against individuals or entities that engaged in crimes impacting HHS programs and 791 civil actions (e.g., false claims lawsuits and civil monetary penalty settlements). 
• The OIG excluded 2,148 individuals and entities from participating in federal healthcare programs, including Medicare and Medicaid.

Avoiding or mitigating legal breaches and monetary penalties is, of course, a huge incentive for including risk assessment in your healthcare compliance program. But besides the legal requirements and economics fueling its importance, there are other reasons to undertake the process. When issues are identified proactively through risk assessment and amended through the corrective action plan (CAP) process, patient safety and the provision of quality care are positively impacted. 

Finally, regular risk assessment increases your healthcare organization’s ability to defend against allegations of noncompliance or wrongdoing, and potentially reduce the number and severity of malpractice lawsuits filed. All of this leads to positive public perception and a more favorable reputation, which is crucial in today’s competitive healthcare market: Patients have a great deal of choice in where they obtain their healthcare.

Leading practices in healthcare risk assessment 

Information is power. Understanding and being able to communicate the underlying reasons your organization conducts risk assessment is often half the battle. 

The following are leading practices your organization may be employing when conducting effective risk assessment. No matter your role, do your homework: Tap into resources such as CMS and OIG to understand risk. If your role requires participation in risk assessment, identify the risk areas most crucial to your compliance program.

1. Provide ongoing education for everyone—from senior leaders and the governing board to front-line clinicians and support staff—on the “why” of risk assessment to get their buy-in and support.
2. Define a manageable scope for any risk assessment program, and involve the necessary department managers and staff as stakeholders in the process.
3. Identify a useful process for conducting risk assessment, and use a rating system for the risks encountered.
4. Develop a meaningful CAP process, with specific measures such as education, policy and procedure review, and additional auditing and monitoring.
5. Report risk assessment  results back to senior leaders, the governing board, and other stakeholders to promote education about risks and to create a culture of compliance.
6. Use modern, integrated software to continually assess your regulatory compliance stance and uncover areas of risk, and to better manage the remediation process enterprise wide. 
7. House risk data in one location and move beyond manual import of risk management and claims data to eliminate errors and to ensure information is current and accurate.
8. Provide the tools for any employee to do their part in mitigating risks, including the ability to report (near) incidents; answer investigations, surveys, or audits; and obtain on-the-spot education or reference.
9. Allow process managers and executives to access real-time data by role to support strategic decision making along the entire governance, risk, and compliance continuum.

With everyone working together on mitigating risk, your organization will be better positioned to support a complete culture of compliance and safety.

Check out symplr Compliance’s risk assessment resources

• Access a recording of our recent risk assessment webinar, “How to Build an Effective Risk Assessment Strategy.”
• Download our new risk assessment eBook, “A Guide to Risk Assessment.”
• Learn about how one solution—symplr Compliance—is designed to support the seven elements of an effective compliance program, as defined by the HHS Office of the Inspector General. It provides compliance officers, risk managers, and executives with a single source of truth to view your organization’s entire compliance landscape using powerful, built-in IBM Cognos dashboards and customizable reporting.