Risk Management Plan for the Health Network

RISK MANAGEMENT PLAN FOR THE HEALTH NETWORK 1
Risk Management Plan for the Health Network

RISK MANAGEMENT PLAN FOR THE HEALTH NETWORK 2
Risk Management Plan for the Health Network
Introduction
The Health Network (HN) is a medical services provider, offering services for secure
messaging from medical facilities to patients, a safe payment plan for medical billing, and an
information services portal to help patients access various medical services at a suitable location
and cost. The company is therefore at risk of data breaches, given the advanced methods and
technologies that hackers and other malicious users have, and the sensitivity of the information it
handles, including sensitive doctor/ care-giver to client messaging and billing information that takes
in client details as well as those of medical facilities. The purpose of this risk management plan is to
be able to identify possible problems (threats) before they are experienced so that activities aimed at
handling the identified risks are planned well before hand and be invoked as required across the
organization and its IT resources so as to mitigate and managed adverse effects that can potentially
affect the organization. Risk management is a process that is continuous, forward-looking and is
important in the business and technical management processes at HN. The purpose of this risk
management plan is also to address issues that can endanger the possibility of HN achieving its
business and performance objectives as well as continued service delivery to its clients, while
maintaining its revenues and business standing in the industry. A risk management plan is important
to any organization, including HN because it enables the company be aware of possible risks; being
aware sets into motion steps aimed at mitigating and possibly preventing the identified risks from
being experienced. His is important for ensuring the company’s operations remain efficient and
consistent (Marine Agency Insurance, 2019). It also ensures that the company’s customers remain
happy and satisfied and ensures a healthy business and financial performance, for instance, due to
reduced interruptions of services. This risk management plan is for the management of the Health
network (HN) and it discusses the scope and method used for creating the plan, a detailed risk
assessment, the regulations and compliance laws that HN must adhere to to effectively manage IT
and information risks, a plan for mitigating the risks identified and assessed, as well as a definition
of the relevant roles and responsibilities of the various departments and individuals responsible for
managing risk at HN. The risk assessment is undertaken in a systematic manner, following the set
steps for the identification and assessment of risks
Scope and Methodology
The scope of this risk management plan entails the identification, characterization,
assessment, and development of mitigation measures for risks related to the HN Information and
Communications technology infrastructure for all its operations (secure messaging, billing, and
information services) across all the company’s physical and enterprise operations and locations that

RISK MANAGEMENT PLAN FOR THE HEALTH NETWORK 3
include Minneapolis, Portland, and Arlington. It includes a risk assessment for all its servers,
network infrastructure, operational procedures, IT assets including all devices, network access
points, and servers, and staff risks (internal risks are some of the most sinister and potentially
damaging). The method used for undertaking the risk management plan follows the following
systematic approach;
 Identification of the hazards, threats, and risks
 Determination of what specific assets or systems may be damaged as well as the entities/
parties that may be harmed
 an evaluation of the identified risks (risk assessment) and determining what precautions and
measures to be undertaken
 Recording these (documentation)
 A review of the risk assessment and the development of a comprehensive risk management
plan for HN
The risk management plan incorporates both qualitative and quantitative approaches to
managing risks
Compliance Laws and Regulations
Being a company handling numerous personal as well as corporate information pertaining to
individuals health, financial, and personal information, HN must comply with existing regulations
concerning personal data, IT enterprises, and financial information laws and regulations.
HN must be complaint with the Data protection 2019 laws and regulations of the USA. There is
actually no singly principle data protection law in the US, but a collection of several laws at both
State and Federal level aimed at protecting personal data of US residents. The company also has to
comply with the various state laws for Minnesota, Oregon, and Virginia given its operations in these
states. FDASIA (the Food and Drug Administration Safety Innovation Act) of 2012 that is targeted
at the Health IT framework to enable the management of of health information across various
multiple electronic devices and systems including wireless medial devices, communications
infrastructure, hospital information systems, and EHR (electronic health records). These laws are
mandated to the Federal Communications Commission (the FCC), the Office of the National
Coordinator for Health IT (the ONC), and the Federal Drug Administration (the FDA).
The HN must also comply with the 21st Cetury Cures Act (the Cures Act) that is aimed at
improving the exchange and flow of electronic health information. The ONC is in charge of
actualizing those pieces of Title IV, conveyance, identified with propelling interoperability,
restricting data blocking, and improving the ease of use, openness, and protection and security of
health IT. ONC attempts to guarantee that all people, their families and their social insurance