DATA SERVICES · INTERFACE AND SECURITY
Security risk analysis for imaging sites
The Security Rule requires “an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information” (45 CFR 164.308(a)(1)(ii)(A)). This is that assessment, for an imaging site, written down with a ranked fix list.
Two settlements, both a PACS server
On 10 April 2025 HHS's Office for Civil Rights settled with Northeast Radiology, P.C., after unauthorized individuals accessed radiology images on its PACS server between April 2019 and January 2020; 298,532 patients were notified. OCR found the practice “had failed to conduct an accurate and thorough risk analysis”. It paid $350,000 and took on a two-year corrective action plan; HHS called it the sixth action in OCR's Risk Analysis Initiative.
On 15 May 2025 OCR settled with Vision Upright MRI, a small California provider, after a breach of an unsecured PACS server holding the medical images of 21,778 individuals. OCR found the provider “had never conducted a HIPAA risk analysis” and had not notified within 60 days. It paid $5,000 and took on a two-year corrective action plan.
One had never done a risk analysis; the other had not done an accurate and thorough one. Neither is a large health system.
What we cover
PACS and RIS exposure
What is reachable from where: the archive, the viewer, the information system, their consoles and their ports.
Remote and vendor access
Who can reach your systems from outside, how, and whether anyone still has a way in who should not.
Interfaces
The HL7 engine and its connections, encrypted or not, and the systems on the other end.
Backups
What exists, where it sits, and whether a restore has ever been tried.
Access controls
Accounts, shared logins, multi-factor sign-in, and whether access logs are kept and read.
Method: HHS OCR's guidance on risk analysis and NIST SP 800-66 Rev. 2. HHS and ONC also publish a free Security Risk Assessment Tool a site can run itself; the sources below link to it.
What you get
A written risk analysis, and a ranked fix list: what to do first, what each item takes in effort, and what it closes. The engagement is an assessment and a written plan. We change nothing on your systems under it; a business associate agreement is signed before any access to a system that holds patient data. Nothing is sold on this site.
SOURCES
- 45 CFR 164.308(a)(1)(ii)(A), Risk analysis (Cornell LII)
- HHS, "HHS Office for Civil Rights Settles HIPAA Security Rule Investigation with Northeast Radiology", 10 April 2025
- HHS, "HHS Office for Civil Rights Settles HIPAA Cybersecurity Investigation with Vision Upright MRI", 15 May 2025
- HHS OCR, Guidance on Risk Analysis Requirements under the HIPAA Security Rule
- NIST SP 800-66 Rev. 2, "Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide", February 2024
- HHS and ONC, Security Risk Assessment Tool (free)
All read 2026-11-01.
The interface check-up covers the HL7 engine in more depth.