Sharing SRA evidence: agree on scope, access and redaction

A Security Risk Analysis (SRA) can involve policy documents, system inventories and conversations with people who know how work happens. Some supporting material can reveal more than an assessor needs: patient information in a screenshot, a password in a configuration export, or details about another organization on a shared report.

Agreeing on an evidence-sharing process helps the assessment team get useful information while keeping control of sensitive material. The starting question is what the assessor needs to establish, rather than how many files your team can upload.

Connect each request to the assessment

HHS describes risk analysis as an assessment of risks and vulnerabilities to electronic protected health information across the organization. Its guidance discusses gathering information through interviews and existing documentation, as well as identifying where that information is handled. It does not prescribe one file collection method for every organization.

When a request arrives, ask which system, location or safeguard it concerns. A request for evidence of account removal might be answered by a documented procedure and an appropriately limited example. A question about whether the procedure actually works may need additional evidence. The assessor should explain what the material will help verify.

Keep a short request register. Record the question, the responsible person, the proposed evidence and any restriction on sharing it. Mark an unanswered request as open. A missing file should not quietly become evidence that a safeguard exists.

Source: HHS guidance on risk analysis.

Review the material before sending it

Have someone who understands the document check what it contains. Screenshots can include patient names outside the area being discussed. Reports may contain network details, employee information or confidential terms. A policy attachment may belong to an older version of the policy.

Remove information that is unnecessary for the agreed purpose, using a method appropriate to the file. Covering text with a visible box may leave the underlying text in the document. Check the finished copy rather than assuming that an editing step removed it.

Keep the original in its approved location. Give the shared copy a date and a clear description of what was withheld. Redaction should protect information without making the evidence misleading. If the omitted detail is needed to assess a safeguard, agree on a more suitable review method with the assessor.

Choose a sharing method deliberately

Confirm the recipients and the approved transfer location. Ask who can access uploaded material, whether another organization will handle it, and how long copies will remain available. Avoid putting passwords or other secrets into an evidence register or ordinary email thread.

NIST's security testing guide treats assessment data as sensitive and discusses planning its handling and transmission. The same planning question is useful here: how will your team protect the supporting material while it is being reviewed? Your organization's requirements and the actual engagement should determine the answer.

Source: NIST SP 800-115, section 7.4.

Make the handoff traceable

For a multi-site organization, identify which location each example represents. Evidence from one clinic should not be presented as proof that every location follows the same process. If a central policy applies everywhere but local implementation differs, make that distinction visible.

After transfer, record what was shared and ask whether it answered the assessment question. Keep any clarification with the request. When the engagement closes, confirm the agreed handling of copies and remaining access; do not assume that closing a project automatically removes an assessor's access.

A useful request record might read: “Account removal process, reviewed November 6, example from Clinic A, unnecessary personal details removed, shared with the named assessor through the approved location.” This is an illustrative format, not a required HIPAA form.

Keep the assessment and follow-up connected

Evidence collection is one part of an SRA. The findings still need review and appropriate follow-up. Our guide to turning healthcare security findings into a remediation plan explains how to connect a finding with an action and evidence of its result.

If your team needs help organizing its Security Risk Analysis, explore Medcurity's SRA services and discuss the scope and evidence process for your organization.