As ONC works to advance the development and use of health IT, we know that you play an important and equal role in maintaining the public’s confidence and trust. The privacy and security of health information is always at the forefront of our work and your organization’s business practices. In the spirit of National Cyber Security Awareness Month (NCSAM), we want to highlight the HHS Security Risk Assessment (SRA) Tool, which you can use to assess your organization’s security risks.

Twenty-two years ago this month, the U.S. Congress enacted the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The federal Privacy, Security, and Breach Notification Rules implemented under HIPAA, and administered and enforced by the HHS Office for Civil Rights (OCR), continue to serve as the national foundation of protections for individually identifiable health information, and of individuals’ rights with respect to their information, including the right to see and obtain copies of their health information from their healthcare providers and health plans.