A risk register is where good risk analysis becomes defensible risk management. It is a living document — not a spreadsheet frozen in April — and it is the artefact that proves §164.308(a)(1)(ii)(B) risk management is happening.
What it does
- Lists every identified risk with asset, threat, likelihood, impact, score, treatment, owner, and target date.
- Preserves history: closed, accepted, and open risks remain visible so trends are provable.
- Exports to a dated, methodology-included PDF the Board, a customer, or OCR will accept.
- Alerts on overdue treatments so an accepted risk does not quietly become an ignored risk.
How it maps to HIPAA
The register is the operational output of §164.308(a)(1)(ii)(A) (risk analysis) and the running record of §164.308(a)(1)(ii)(B) (risk management). It also underpins the risk-based decisions that §164.306(d) requires for addressable specifications.
Where it fits
The register is part of the Risk Management module, is populated by the Risk Analysis Workflow, and drives the Treatment Plans. The sharable deliverable is the Risk Register Export report.