HIPAA Glossary · Security Rule concepts
Risk management
The follow-through to risk analysis: implementing measures that reduce identified risks to a reasonable and appropriate level.
Context
Required by §164.308(a)(1)(ii)(B). The treatment side of risk analysis — a current risk analysis with no risk management plan is half the artefact. Treatment plans need owners, due dates, and completion evidence. See [Risk Treatment Plans](/platform/risk-treatment-plans/) in the platform.
Related terms
- Risk analysis — The accurate, thorough assessment of risks to all ePHI the organisation holds — the foundational Security Rule requirement.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.