Appearance
HIPAA Risk Assessment
Requirement: HIPAA Security Rule §164.308(a)(1)(ii)(A) — Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by the covered entity or business associate.
Owner: Rory (Security Officer) Review frequency: Annual (December) + any material change to environment or threat landscape Last reviewed: May 2026 Next review: December 2026
This assessment satisfies §164.308(a)(1)(ii)(A). It is intended to be read alongside the Threat Model, which provides STRIDE analysis and kill chain coverage detail. The threat model is the engineering reference; this document is the compliance-formatted risk register auditors expect.
Scope
ePHI Systems in Scope
| System | Location | ePHI Role | Tenant |
|---|---|---|---|
| DDE AVD environment + published app | Azure DDE (ciriusdde.com) | Primary PHI access plane — Medicare patients access clinical data here | DDE |
| DDE session hosts (7 AVD hosts) | Azure DDE, Billings subscription | Process ePHI during patient sessions | DDE |
| DDE Active Directory (ACTDIRAZC01, ACTDIRAZC02) | Azure DDE, Firewall subscription | Identity authority for all DDE access — compromise enables PHI access | DDE |
| Azure PROD domain controllers (ACTDIRAZP01, ACTDIRAZP02) | Azure PROD | Identity for internal staff accessing PHI-adjacent systems | PROD |
| Veeam backup store (AWS S3, Backup account) | AWS (863609217450) | Contains backup images of PHI systems | AWS |
| Azure Recovery Services Vaults | Azure PROD + DDE | Backup copies of PHI-bearing VMs | PROD + DDE |
| cirius-openai-kv-prod (Key Vault) | Azure PROD (logging subscription) | Holds secrets for SecOps platform and AI inference — SecOps processes security events that may contain PHI fragments | PROD |
| psql-secops-prod (PostgreSQL) | Azure PROD (logging subscription) | SecOps incident database — incidents may reference PHI system identifiers | PROD |
| M365 (Exchange Online, SharePoint, Teams) | Microsoft tenant | Staff communication may reference ePHI | SaaS |
| Log Analytics — cirius-logging-law-central | Azure PROD (logging subscription) | Security logs include system event data from PHI systems | PROD |
Risk Scoring Methodology
Each risk is scored on two axes:
Likelihood (1–5): How probable is this threat given current controls and threat landscape?
- 1 = Rare (once in 10+ years)
- 2 = Unlikely (once in 5–10 years)
- 3 = Possible (once in 2–5 years)
- 4 = Likely (once in 1–2 years)
- 5 = Almost certain (within the next year)
Impact (1–5): What is the harm if this threat materializes?
- 1 = Negligible (no PHI affected, minor disruption)
- 2 = Minor (limited PHI exposure, brief disruption)
- 3 = Moderate (significant PHI exposure, reportable incident)
- 4 = Significant (large PHI breach, HHS notification, major disruption)
- 5 = Catastrophic (mass PHI breach, business-threatening, regulatory penalties)
Risk Score = Likelihood × Impact (1–25)
| Score | Level | Response |
|---|---|---|
| 1–5 | Low | Accept, monitor annually |
| 6–9 | Medium | Treat within 12 months |
| 10–15 | High | Treat within 6 months |
| 16–25 | Critical | Treat immediately |
Risk Register
R-001 — Ransomware Attack (RaaS affiliate)
| Field | Value |
|---|---|
| Threat | Ransomware-as-a-Service affiliate using credential spray → lateral movement → backup destruction → encryption |
| Asset affected | All PHI systems, identity systems, backup targets |
| Vulnerability | Detective control gaps at kill chain stages 2–7 (execution, persistence, credential dump, lateral movement, exfiltration, defense evasion) |
| Likelihood (inherent) | 5 — Active attacks against healthcare SMBs; Cirius experienced an incident November 2024 |
| Impact | 5 — Full PHI breach, HHS notification, potential business failure |
| Inherent risk score | 25 — Critical |
| Current controls | Conditional Access + MFA, Twingate ZTNA, Palo Alto + DNS Security, Cortex XDR, Arctic Wolf MDR (act-first), immutable backups (Object Lock), Keeper MFA on all credentials |
| Likelihood (residual) | 3 — Controls significantly reduce probability but gaps remain |
| Impact (residual) | 3 — Immutable backups contain blast radius; DR failover limits downtime |
| Residual risk score | 9 — Medium |
| Remediation in progress | Kill chain Phase 1 (audit policy enabling EventID 4688, 4698) and Phase 2 (6 detection agents) — target completion before September 2026 audit |
| Risk owner | Rory |
R-002 — Credential Compromise / Account Takeover
| Field | Value |
|---|---|
| Threat | Phishing, credential spray, or password reuse compromising a staff account with PHI access |
| Asset affected | DDE AVD environment, M365, domain controllers |
| Vulnerability | Active phishing campaign observed against Cirius identities (justinc, gregd, adrianam, paulb, sophien, lauramaeb). MFA conditional access partially in report-only mode. |
| Likelihood (inherent) | 5 — Active campaign confirmed |
| Impact | 4 — PHI access via compromised account; depends on account privilege |
| Inherent risk score | 20 — Critical |
| Current controls | Entra MFA enforced, Conditional Access policies, Twingate device posture, Arctic Wolf behavioral monitoring, Maester weekly M365 audit |
| Likelihood (residual) | 3 — MFA significantly reduces success rate |
| Impact (residual) | 3 — Twingate posture and Cortex XDR limit lateral movement post-compromise |
| Residual risk score | 9 — Medium |
| Remediation in progress | Conditional Access policies transitioning from report-only to enforce; FIDO2 hardware distribution for privileged accounts |
| Risk owner | Rory |
R-003 — Insider Threat (Unauthorized PHI Access)
| Field | Value |
|---|---|
| Threat | Authorized employee accesses PHI beyond scope of their role, or exfiltrates PHI |
| Asset affected | DDE AVD environment, M365 (SharePoint, Teams) |
| Vulnerability | Limited Data Loss Prevention enforcement (Purview DLP in report-only for most policies) |
| Likelihood (inherent) | 2 — Small workforce, relatively small attack surface |
| Impact | 4 — Intentional PHI breach triggers HHS notification |
| Inherent risk score | 8 — Medium |
| Current controls | Purview DLP (report-only transitioning to enforce), Arctic Wolf monitoring, audit logging, Conditional Access session controls, role-based access |
| Likelihood (residual) | 2 — Controls reduce opportunity but not intent |
| Impact (residual) | 3 — DLP and logging provide detection and containment |
| Residual risk score | 6 — Medium |
| Remediation in progress | Purview DLP enforce mode rollout per compliance/purview-dlp-enforce-mode-criteria.md |
| Risk owner | Rory |
R-004 — Third-Party / Supply Chain Compromise
| Field | Value |
|---|---|
| Threat | Compromise of a vendor with PHI access (Microsoft, AWS, Arctic Wolf, Palo Alto) or of a GitHub Actions dependency |
| Asset affected | All PHI systems (for vendor compromise); CI/CD pipeline (for supply chain) |
| Vulnerability | Dependency on third-party SaaS with PHI access; GitHub Actions dependencies |
| Likelihood (inherent) | 3 — Major cloud vendors are high-value targets |
| Impact | 4 — Vendor breach with PHI access is a reportable event |
| Inherent risk score | 12 — High |
| Current controls | BAAs in place for all PHI vendors; GitHub Actions SHA-pinned; supply_chain_agent monitors for un-pinned actions; vendor risk assessments (compliance/vendor-risk-inventory.md) |
| Likelihood (residual) | 2 — Vendor security programs and contractual obligations reduce probability |
| Impact (residual) | 3 — BAAs define breach notification obligations; SHA pinning limits CI/CD blast radius |
| Residual risk score | 6 — Medium |
| Remediation in progress | Ongoing SHA-pin enforcement via supply_chain_agent |
| Risk owner | Rory |
R-005 — Infrastructure Failure / Availability Loss
| Field | Value |
|---|---|
| Threat | Azure region failure, accidental infrastructure destruction, or extended outage affecting PHI system availability |
| Asset affected | DDE AVD (Medicare patient access), all Azure PROD systems |
| Vulnerability | Single Azure region (US West 2); DR failover not yet exercised for current architecture |
| Likelihood (inherent) | 2 — Azure region failures are rare but not impossible |
| Impact | 3 — PHI unavailability triggers HIPAA contingency plan requirements; DDE downtime affects Medicare patients |
| Inherent risk score | 6 — Medium |
| Current controls | Veeam DR replication (nightly) to AWS, Recovery Services Vaults with immutability, DR failover procedure documented, AWS DR environment maintained |
| Likelihood (residual) | 2 — DR capability reduces impact of any failure |
| Impact (residual) | 2 — RPO ~24h, RTO 4–8h for full DR failover |
| Residual risk score | 4 — Low |
| Remediation in progress | Q2 2026 DR test (June) — first live validation of current architecture |
| Risk owner | Rory |
R-006 — Backup Destruction (Ransomware Pre-cursor)
| Field | Value |
|---|---|
| Threat | Ransomware actor destroys backups before encrypting primary systems, eliminating recovery path |
| Asset affected | Azure Recovery Services Vaults, Veeam AWS S3 store |
| Vulnerability | RSV soft delete provides 14-day protection but does not prevent a determined attacker with Azure admin credentials from initiating deletion |
| Likelihood (inherent) | 3 — Standard ransomware playbook; observed in November 2024 incident |
| Impact | 5 — Recovery becomes impossible without backups |
| Inherent risk score | 15 — High |
| Current controls | RSV soft delete (14 days) + immutability (Unlocked) on all active vaults; AWS S3 Object Lock (GOVERNANCE, 6-year); Veeam backups in separate AWS org account; break-glass accounts never in suppression rules; backup agent monitors vault health |
| Likelihood (residual) | 2 — Object Lock and S3 immutability prevent deletion even by admin accounts |
| Impact (residual) | 2 — Immutable copies survive even a full Azure compromise |
| Residual risk score | 4 — Low |
| Remediation in progress | Evaluate escalating RSV immutability from Unlocked to Locked for highest-criticality vaults |
| Risk owner | Rory |
R-007 — Unpatched Vulnerability Exploitation
| Field | Value |
|---|---|
| Threat | Exploitation of an unpatched vulnerability in a public-facing or internally accessible system |
| Asset affected | All internet-exposed endpoints, Windows VMs |
| Vulnerability | Patch lag between release and deployment; 9 public-facing endpoints in monthly scan scope |
| Likelihood (inherent) | 3 — Vulnerability exploitation is common against healthcare targets |
| Impact | 3 — Depends on the system; PHI exposure possible if DDE or identity systems affected |
| Inherent risk score | 9 — Medium |
| Current controls | Monthly Nuclei + Nmap pen testing, Cortex XDR behavioral prevention, Intune patch compliance enforcement, patch management policy (security/patch-management.md), vulnerability notification system (Lambda/SES) |
| Likelihood (residual) | 2 — Monthly scanning and enforcement reduce window |
| Impact (residual) | 2 — Cortex XDR behavioral detection catches exploitation even for unpatchable |
| Residual risk score | 4 — Low |
| Remediation in progress | Kill chain execution agent will detect post-exploitation activity |
| Risk owner | Rory |
Aggregate Risk Summary
| Risk ID | Description | Residual Score | Level |
|---|---|---|---|
| R-001 | Ransomware attack | 9 | Medium |
| R-002 | Credential compromise | 9 | Medium |
| R-003 | Insider threat | 6 | Medium |
| R-004 | Supply chain / vendor | 6 | Medium |
| R-005 | Infrastructure failure | 4 | Low |
| R-006 | Backup destruction | 4 | Low |
| R-007 | Unpatched vulnerability | 4 | Low |
Overall posture: MEDIUM — No Critical or High residual risks. All residuals are Medium or Low with active remediation on the two Medium items (kill chain completion, CA enforce mode).
Target posture after September 2026: LOW-MEDIUM across all risks, with kill chain Phase 2 and full CA enforce mode reducing R-001 and R-002 residual scores.
Risk Treatment Plan
| Risk ID | Treatment | Target Date | Owner |
|---|---|---|---|
| R-001 | Kill chain Phase 1 (audit policy) + Phase 2 (6 agents) | July 2026 | Rory |
| R-002 | Conditional Access enforce mode + FIDO2 for privileged users | July 2026 | Rory |
| R-003 | Purview DLP enforce mode rollout | Q3 2026 | Rory |
| R-004 | Continue SHA-pin enforcement; annual vendor reviews | Ongoing | Rory |
| R-005 | Q2 2026 DR test to validate current architecture | June 2026 | Rory |
| R-006 | Evaluate RSV Locked immutability for critical vaults | Q3 2026 | Rory |
| R-007 | Kill chain execution agent for post-exploit detection | July 2026 | Rory |
Acknowledgment
This risk assessment has been reviewed and approved by the Security Officer.
| Role | Name | Date |
|---|---|---|
| Security Officer | Rory | May 2026 |
| T1 Domain Admin | Kevin | (pending review) |
| T1 Domain Admin | Greg | (pending review) |
Related Documents
- Threat Model — STRIDE analysis, crown jewel inventory, threat actor profiles
- HIPAA Controls Matrix — control-by-control implementation status
- Risk Acceptance Register — individual risk acceptance decisions
- Kill Chain Coverage — detection gap analysis
Document History
| Date | Change | Author |
|---|---|---|
| May 2026 | Initial draft — seven risks with inherent/residual scoring, treatment plan, acknowledgment table. Translates threat model into HIPAA-format RA per §164.308(a)(1)(ii)(A). | Rory |