Security risk analysis report and risk management plan

Granite City Family Dental — Risk analysis dated October 20, 2026 — Policy set version 1.0 — Binder edition 2026

Authority: 45 CFR 164.308(a)(1)(ii)(A) (risk analysis) and (B) (risk management); HHS Guidance on Risk Analysis Requirements under the HIPAA Security Rule; NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments; NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule.

Prepared for Dr. Maria Lindqvist, Owner and Dentist. Security Officer: Janelle Okafor, Office Manager. Analysis performed by Janelle Okafor with CRU Technologies.

Section 1 — Executive summary

Granite City Family Dental, P.A., doing business as Granite City Family Dental, is a Dental practice acting as a covered entity (health care provider) under HIPAA. It relies on electronic systems for scheduling, clinical documentation, billing and communication, and nearly all of that work involves electronic protected health information (ePHI). This report records the practice's risk analysis: where ePHI lives, what threatens it, what controls are in place, how large each remaining risk is, and what the practice is doing about each one. It is the document HHS asks for first in any investigation, and the risk management plan in Section 7 is the proof that identified risks are being reduced, not merely listed.

Scope. This risk analysis covers all electronic protected health information created, received, maintained or transmitted by the practice at every location listed in the practice profile, in every system in the ePHI inventory, on every device in the device inventory, and in paper form where paper is used.

Who, when. The analysis was performed by Janelle Okafor with CRU Technologies on October 20, 2026. This is the first documented risk analysis for the practice; there is no prior analysis to compare against, and the closed-items table in Section 7 will be populated from the next cycle onward. The HHS Security Risk Assessment Tool (version 3.7) was also completed: Yes. Its export is filed in this binder as supporting evidence.

Headline results. The control review in Section 5 examined 40 controls and found 4 gaps requiring treatment. The risk register in Section 6 holds 5 risks: 0 rated Critical, 3 High, 2 Medium and 0 Low; 4 open or in progress, 1 closed and 0 accepted as residual risk.

Locations covered

Methodology

The analysis follows the process in NIST SP 800-30 Rev. 1 as adapted for small organizations by HHS and NIST SP 800-66 Rev. 2:

The analysis is repeated at least once a year and whenever the practice changes in a way that affects ePHI: a new system, vendor, location, device class or service line, or after an incident.

Section 2 — Areas of focus for every small practice

The Health Industry Cybersecurity Practices (HICP, the HHS 405(d) program) identify the threats that cause most harm to small health care organizations. They are not specific to Granite City Family Dental, but each one is checked against the practice's controls in Section 5.

Email phishing. A message that tricks a person into entering a password or opening an attachment is the most common beginning of a reported breach, and a single compromised mailbox has led to HHS settlements against practices of this size. The defenses are training, simulated phishing, MFA on every mailbox and a culture where reporting a click is praised, not punished.

Ransomware. Malware that encrypts the EHR, the server or the backups and demands payment, now usually paired with theft of the data first. HHS treats an encryption event as a presumed breach. The defenses are patching, endpoint protection, MFA, no exposed remote desktop, and above all a backup copy that ransomware cannot reach and that has been restored in a test.

Loss or theft of equipment. Laptops, phones, tablets, USB drives and backup drives leave the building and get lost. If the device was encrypted the event is not a reportable breach; if it was not, every record on it is presumed breached. The defenses are encryption of every portable device, an accurate inventory, remote wipe and keeping ePHI off portable media in the first place.

Insider accidental or intentional data loss. A staff member who looks up a neighbor's chart, emails a spreadsheet to a personal account, or simply sends a fax to the wrong number. The defenses are unique logins, role-based access, audit logs that someone actually reviews, a same-day termination checklist and a sanction policy that is applied.

Attacks against connected devices and vendors. Imaging systems, network-connected medical devices and the vendors that host the EHR, email, backups and billing all hold or reach ePHI, and a weakness in any of them becomes the practice's breach. The defenses are a complete business associate register with signed agreements, network segmentation, vendor security questions before purchase and removing devices that can no longer be patched.

Improper disposal. A retired computer, copier or phone sold or discarded with its drive intact, or paper charts in a dumpster. The defenses are a documented destruction method that meets NIST SP 800-88, certificates of destruction, locked shred consoles and a disposal log.

Section 3 — ePHI inventory and data flows

Authority: 45 CFR 164.308(a)(1)(ii)(A); HHS Guidance on Risk Analysis (scope must include all ePHI, wherever it is).

3.1 Inventory of ePHI repositories

3 repositories are not confirmed encrypted (Open Dental database server, Digital x-ray sensors and imaging PC, Paper charts pre-2019). Each is carried in the risk register until encryption is confirmed or the reason it is not reasonable is documented.

2 repositories are not confirmed backed up (Front desk and operatory workstations (7), Paper charts pre-2019). Each is carried in the risk register until a backup is confirmed.

3.2 Systems named in the practice profile

Every system in this table must also appear in the ePHI inventory above and, where a vendor holds or reaches ePHI, in the business associate register (document 19).

3.3 Data flows

How ePHI moves in and out of Granite City Family Dental: Patients → front desk (phone, portal, paper forms) → EHR. EHR → clearinghouse → payers. EHR → referral partners via fax / Direct messaging. Lab results → EHR interface. Backups → vendor cloud.

Patient communication channels in use: Phone, Text message (SMS), Email and Mail. Each channel is governed by document 11; each transmission path is a point where ePHI can be misdirected or intercepted and is considered in the threat list below.

Section 4 — Threats considered

The following threat sources and events were considered for every repository in Section 3. A threat not listed here was not analyzed and should be added at the next cycle if it applies.

• Ransomware
• Phishing / credential theft
• Insider snooping or misuse
• Lost or stolen laptop / phone / media
• Misdirected fax, email or mail
• Vendor / business associate breach
• Improper disposal of devices or paper
• Fire, flood, power loss
• Unpatched software exploited
• Weak or shared passwords
• Unencrypted device
• Unauthorized physical access

Section 5 — Current controls summary

Authority: 45 CFR 164.308(a)(1)(ii)(A) (assessment of current security measures). Status is the practice's own answer; Finding is the analyst's conclusion. Every row marked as a gap is carried into the risk register in Section 6 with an owner and a due date; every row marked not answered is confirmed before this report is signed. "Addressable" specifications are not optional: where a control is not implemented the practice documents why and what equivalent measure is in place (45 CFR 164.306(d)(3)).

Summary: 4 gaps, 0 not answered, 36 adequate.

Section 6 — Risk register

Authority: 45 CFR 164.308(a)(1)(ii)(A) (likelihood, impact and level of risk).

Rating key

Likelihood and impact are each rated Low, Medium or High given the controls that exist today. The risk level is read from the matrix:

Critical and High risks must be mitigated, transferred or avoided with an owner and a due date inside 90 days; Medium risks inside the year; Low risks may be accepted by Dr. Maria Lindqvist, Owner with the reason recorded. "Transfer" (cyber insurance or a vendor contract) reduces the financial impact only; the HIPAA duty stays with the practice.

Register

Risk levels from the key: 0 Critical, 3 High, 2 Medium, 0 Low.

Critical and High risks requiring action inside 90 days:

• Phishing of staff mailbox — Mitigate; owner Janelle Okafor; due January 31, 2027; status Open.
• Open Dental has no MFA; a stolen password gives full chart access — Mitigate; owner Janelle Okafor; due December 31, 2026; status Open.

Section 7 — Risk management plan

Authority: 45 CFR 164.308(a)(1)(ii)(B) (security measures sufficient to reduce risks to a reasonable and appropriate level).

7.1 Open and in-progress items

These are the practice's commitments. Janelle Okafor reviews them each quarter, records progress, and reports the status at the annual review meeting (document 24). An item past its due date is re-dated with the reason written down, not quietly dropped.

7.2 Closed since the previous analysis

Evidence of risk reduction. Closed rows stay in the register permanently; the evidence that each was completed (screenshot, certificate, invoice, vendor confirmation) is filed in this binder.

7.3 Accepted residual risks

Risks the practice has decided to accept rather than treat further, with the controls that make the residual level tolerable. Each acceptance is signed in Section 8 by Dr. Maria Lindqvist, Owner and is reconsidered at every annual review.

7.4 How the plan is run

• Every gap found in Section 5, every incident lesson from document 16, every vendor finding from document 19 and every audit observation becomes a register row within 30 days of discovery.
• Janelle Okafor owns the register; individual actions are owned by the person named in the row, with CRU Technologies carrying the technical items under its BAA.
• Progress is reviewed quarterly and at the annual meeting; the completion evidence for each closed item is filed with this report.
• The register, this report and the SRA Tool export (where used) are retained for six years from the date they were last in effect (45 CFR 164.316(b)(2)).

Section 8 — Residual risk acceptance and sign-off

Having reviewed this analysis, the controls in place, the risk register and the management plan, the undersigned accept on behalf of Granite City Family Dental, P.A. the residual risks listed in Section 7.3 and commit the practice to the open items in Section 7.1 by their due dates. They confirm that the scope in Section 1 covers all ePHI the practice creates, receives, maintains or transmits, and that this report will be updated at least annually and on any significant change to systems, vendors, locations or operations.

Next analysis due: October 20, 2027, or sooner on significant change.

Residual risks accepted by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor, Office Manager Signature: ___________________________ Date: ______________

Owner: Dr. Maria Lindqvist, Owner and Dentist Signature: ___________________________ Date: ______________

Analysis performed by: Janelle Okafor with CRU Technologies Signature: ___________________________ Date: ______________

Appendix A — Classification of terms

• Threat: anything that could harm ePHI or the systems that hold it — a person (attacker, careless or malicious insider), a natural event (fire, flood), a failure (disk, power, software) or a vendor's breach. Threats are listed in Section 4.
• Vulnerability: a weakness in a system, process or person that a threat could exploit — an unpatched server, a shared password, a mailbox without MFA, an untrained new hire, an unlocked records room.
• Likelihood: how probable it is, given the controls in place today, that a threat exploits a vulnerability within the coming year. Rated Low, Medium or High.
• Impact: the harm if it happens — to patients (privacy, safety, identity theft), to the practice (downtime, cost, notification, penalties, reputation) and to the confidentiality, integrity or availability of ePHI. Rated Low, Medium or High.
• Risk: the combination of likelihood and impact, read from the key in Section 6 as Low, Medium, High or Critical.
• Control (safeguard): a measure that reduces likelihood or impact: administrative (policies, training, agreements), physical (locks, screens, inventories) or technical (encryption, MFA, logging, backups).
• Residual risk: the risk that remains after the planned controls are in place. It is never zero; what matters is that it is known, accepted by the owner in writing, and reconsidered every year.
• ePHI: electronic protected health information — individually identifiable health information that the practice creates, receives, maintains or transmits in electronic form, including in email, backups, portable devices and vendor systems (45 CFR 160.103).
• Required vs. addressable: Security Rule implementation specifications marked *required* must be implemented. Those marked *addressable* must be assessed; the practice implements them if reasonable and appropriate, and otherwise documents why not and implements an equivalent alternative (45 CFR 164.306(d)(3)). Addressable never means optional.
• Treatment: the decision for each risk — *mitigate* (add controls), *accept* (live with it, signed), *transfer* (insurance or contract carries the financial loss) or *avoid* (stop the activity).

Appendix B — Organizational profile

Supporting evidence filed with this report: the ePHI and device inventories, the business associate register, the training roster, the incident log, the restore test record, the HHS SRA Tool export and the completion evidence for each closed register item.