Protect Patient Health Information

Last updated
Save as PDF

Updated: 08/16/2022
Views: 1129

You must conduct or review a security risk analysis on your 2015 Edition CEHRT functionality on an annual basis, within the calendar year of the performance period. And, starting in 2022, you must also conduct an annual self-assessment using the High Priority Practices Guide (a part of the SAFER Guides), within the calendar year of the MIPS performance period. The SAFER guides help identify recommended /best practices to optimize the safety and safe use of EHRs and further enable the electronic exchange of health information.

Security Risk Analysis

Protect electronic protected health information (ePHI) created or maintained by the CEHRT through the implementation of appropriate technical, administrative, and physical safeguards. For auditing purposes, keep a copy of your security risk analysis in your MIPS Audit Folder.

Security Risk Analysis Measure:	Conduct or review a security risk analysis in accordance with the requirements in 45 CFR 164.308(a)(1), including addressing the security (to include encryption) of ePHI data created or maintained by certified electronic health record technology (CEHRT) in accordance with requirements in 45 CFR 164.312(a)(2)(iv) and 45 CFR 164.306(d)(3), implement security updates as necessary, and correct identified security deficiencies as part of the MIPS eligible clinician’s risk management process. To meet this measure, MIPS eligible clinicians must attest YES to conducting or reviewing a security risk analysis and implementing security updates as necessary and correcting identified security deficiencies. There are several options to complete this measure, including: You may complete the Security Risk Assessment Tool (SRA Tool) found on the HealthIT website. You may hire a vendor You may do the research and complete the security risk analysis on your own; making sure that it meets the requirements described in the measure specification
Attestation:	Yes / No
Performance Score Weight:	Zero points. This measure will not be scored, but it is mandatory.
Additional Information:	Failure to perform the security risk analysis will result in a total score of 0 points for the Promoting Interoperability performance category.

SAFER Guide Review

The High Priority Practice Guide identifies high risk and high priority recommended safety practices, intended to optimize the safety and safe use of EHRs. MIPS eligible clinicians must attest to conducting an annual assessment of the High Priority Guide of the Safety Assurance Factors for EHR Resilience (SAFER) Guides.

The MIPS eligible clinicians must attest YES or NO to conducting an annual self-assessment of the High Priority Practices Guide of the SAFER Guides the 2022 performance period.

To Get Started:	Go to: https://www.healthit.gov/topic/safety/safer-guides Complete the activities required by the Security Risk Analysis and High Priority Practices SAFER Guide, submit their complete numerator and denominator or Yes/No data for all required measures, and attest to the Actions to limit or restrict compatibility or interoperability of CEHRT statement. To complete the High Priority Practices Guide self-assessment, MIPS eligible clinicians are expected to fill out the checklist and practice worksheet at the beginning of the guide.
Attestation:	Yes / No
Performance Score Weight:	Zero points. This measure will not be scored, but it is mandatory.
Additional Information:	The SAFER Guide measure is not scored and does not contribute any points to the MIPS eligible clinician’s total score.