Overview

A regulated entity must perform an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Conducting this risk analysis inherently requires maintaining an inventory of assets that handle ePHI.