05 / Cyber Consulting
Healthcare Cyber Risk Assessment
A security risk analysis that satisfies HIPAA and also tells you what an attack would cost. We look at your organization the way a regulator, an insurer and a CFO would, and hand you one ranked plan.
§164.308
HIPAA requires an accurate and thorough risk analysis. A missing or stale one is the finding OCR cites most.
12+
Enforcement actions under OCR's Risk Analysis Initiative since it launched in late 2024
$1.9M/day
Average operational loss while a health system is down after a cyberattack
6 months
Vulnerability scan interval in HHS's proposed Security Rule update
Why Now
After a breach, two questions come first: did you know, and did you act?
OCR opens nearly every breach investigation by asking for your most recent risk analysis. Since late 2024 its Risk Analysis Initiative has produced a steady run of settlements, and the corrective action plans that come with them run for two years.
The bar is rising. HHS has proposed the first major update to the Security Rule since 2013, with written asset inventories, network maps, mandatory MFA and regular vulnerability scans. It is not final yet, but an assessment done now can close those gaps before they become requirements.
What Makes Ours Different
“Most risk assessments end with a list of vulnerabilities. Ours ends with what each one would cost you per day and who is fixing it by when.”
6QD comes from the revenue cycle, so we assess cyber risk from the side of the business that feels it first. Your security team gets the technical findings. Your CFO gets the financial exposure. Your board gets one page that connects them.
See what comes after the assessmentWhat We Assess
Eight areas, one ranked risk register.
HIPAA security risk analysis
An inventory of every system that creates, stores or sends ePHI, with the threats, vulnerabilities, likelihood and impact for each one. Documented the way 45 CFR 164.308(a)(1)(ii)(A) requires and the way OCR asks to see it.
Revenue cycle business impact
Which systems stop cash when they go down: the EHR, clearinghouse, eligibility and payer portals, lockbox and remittance feeds. We put a dollar figure on each day of outage so leadership can rank risks by money, not by color.
Third-party and clearinghouse dependency
The Change Healthcare attack in 2024 stopped claims and payments for weeks at organizations that were never breached themselves. We map single points of failure, check business associate agreements and confirm an alternate path for claims and remits.
Access and identity
MFA coverage, privileged accounts, offboarding speed and shared logins. Revenue cycle teams often share payer portal credentials, which is one of the easiest gaps to close and one of the most common we find.
Automation and bot accounts
Digital workers hold credentials to the EHR and to payer portals. We review how bot accounts are stored, scoped, logged and rotated. 6QD builds healthcare automation, so we know where these accounts hide.
Workforce readiness
Phishing simulation results, security awareness training and the policies behind them. Most healthcare incidents still start with one email, so we look at what your staff actually do, not only what the policy says.
Backup, downtime and recovery
Whether backups are isolated from the network, when a restore was last tested, and whether downtime procedures exist for billing and patient access. Gaps here feed straight into a Cyber Preparedness and Recovery program.
Framework alignment
Every finding maps to the HHS Cybersecurity Performance Goals (essential and enhanced), the 405(d) Health Industry Cybersecurity Practices and NIST CSF 2.0, so your IT team, auditors and cyber insurer read the same scorecard.
How We Engage
Six to ten weeks from kickoff to board summary.
Scope
We inventory systems, data flows and vendors with IT, compliance and revenue cycle leaders, and agree on what is in scope before any testing starts.
Assess
Control reviews, interviews and evidence collection across each area. We coordinate technical scanning with your security team or a testing partner.
Rate
Each risk gets a likelihood, an impact and a revenue figure. The result is one risk register ranked by what it would cost you, with no generic heat map.
Remediate
A risk management plan with named owners and dates, which HIPAA also requires. We check progress with you each quarter so the plan does not sit in a drawer.
What You Receive
Evidence you can hand to a regulator, an underwriter or your board.
Everything is written for the person who has to act on it. Technical findings go to IT with enough detail to fix. Financial exposure goes to finance in dollars. The board summary fits on one page.
A risk assessment is not a penetration test. When you need one, we scope it with your security team or a testing partner and fold the results into the same register.
- Documented HIPAA security risk analysis, ready for an OCR request
- Risk register scored by likelihood, impact and revenue at stake
- Risk management plan with owners, dates and budget ranges
- Revenue-at-risk model for a 1, 7 and 25 day outage
- HHS Cybersecurity Performance Goals scorecard
- Readiness check against the proposed Security Rule changes
- Board and executive summary in plain language
Know your exposure before someone else finds it.
Start with a 30-minute conversation about your last risk analysis, your vendors and your revenue cycle systems. We will tell you where we would look first.