Description should include

the nature and extent of the protected/PHI involved in the use or disclosure, including the types of identifiers and the likelihood that the PHI could be re-identified
the unauthorized person who used the PHI or to whom the disclosure was made (e.g., a sibling, a journalist)
the likelihood that any PHI was actually acquired or viewed (e.g., an audit trail would provide insights)
the extent to which the risk to the PHI has been mitigated (e.g., promptly changed encryption key).

Teacher Resource: Security Risk Assessment (SRA) Tool (https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool), Office of the National Coordinator for Health Information Technology

Process/Skill Questions:

What are three ways to ensure PHI is kept safe?
What are the various types of data protection? How do they work?
What agencies have developed a risk assessment tool?
How can HealthIT.gov’s SRA Tool assist with a case scenario? Is the tool user-friendly?
Does HealthIT.gov’s SRA Tool provide assessment at all levels of the organization? Did it assess potential solutions for now and in the future to decrease threats?