System · Risk Intelligence
An assessment tells you what is true. This tells you what it means.
Likelihood against impact, item by item, so a 331-question assessment comes back as a ranked list rather than a document.
HIPAA mapping
Where this fits in the Security Rule.
4 provisions this capability contributes to, each with the specific Risk Intelligence behavior behind it. The obligation stays with your practice — the mapping shows which part of the work the platform carries.
§164.308(a)(1)(ii)(A)Risk analysis
The risk analysis is your practice's act, and the Security Risk Assessment is where it is conducted and retained. Risk Intelligence reads what that assessment produced. It is the interpretation layer, not the analysis itself, and it cannot stand in for an assessment you have not completed.
§164.308(a)(1)(ii)(B)Risk management
Requires security measures sufficient to reduce risk to a reasonable and appropriate level. Reasonable and appropriate is a judgement about which risks matter most, and a ranked list of findings by likelihood and impact is the input that judgement needs.
§164.308(a)(7)(ii)(E)Applications and data criticality analysis
An addressable specification asking which applications and data are critical. High-impact items are separated from the rest here, which is the same question asked from the risk side.
§164.316(b)(1)Documentation
The assessment and its interpretation are retained in the platform rather than in a spreadsheet on one person's laptop. The written policies and procedures the standard also requires remain your practice's to author.
What it does
The assessment is the hard part. The list is the useful part.
A practice finishes a security risk assessment and is left holding several hundred answers. Some describe controls that are in place. Some describe gaps. A few describe gaps that would end the practice. Nothing in the document itself tells you which is which, and the honest response of most owners — put it in a drawer and feel vaguely worse — is a rational response to an unranked list.
Risk Intelligence is the layer that reads the assessment back. Each item carries a likelihood and an impact, and the pairing produces a risk level rather than a yes or no: low, medium, high. The high-impact findings are pulled out separately, because a low-likelihood item that would expose every record in the practice is not the same kind of problem as a high-likelihood item that would expose a fax cover sheet, and a single ordered list flattens that difference.
It is worth being plain about where the picture comes from: today it is derived from the assessment. It moves when the assessment moves — when you answer an item, revise an answer, or close a finding. It is not a monitor watching your network, and it does not silently absorb every change elsewhere in the platform. What it does is turn work you have already done into an order of operations.
How it works
5 mechanisms keep Risk Intelligence working.
Likelihood against impact, not a single number.
Each assessment item is scored on how likely the exposure is and how bad it would be, and the two together place it on the matrix. This is the method NIST SP 800-30 describes and the one an OCR investigator recognises, which matters because the alternative — a single opaque percentage — cannot be defended when someone asks how you decided what to fix first.
Item-level risk, so the ranking is inspectable.
Risk is carried at the level of the individual assessment item, not only in a total. You can open any finding and see the two judgements behind its level rather than being handed a number to trust. A ranking nobody can take apart is a ranking nobody can argue with, which sounds like a strength until an auditor disagrees with it.
High-impact findings, separated.
Items whose impact is severe are surfaced apart from the general list, regardless of how likely they are. Practices with limited time work this list first. It is the difference between working through findings in the order the questionnaire happened to ask them and working through them in the order that reduces exposure.
Findings that carry through to work.
A finding is not a dead end. Compliance Advice items reference the specific assessment item behind them — the identifier is visible on the item — and carry their own severity, so the ranking here and the queue you actually work are looking at the same thing. Interpretation that does not connect to work is just a second document.
Category coverage, so gaps in the assessment are visible.
An assessment that is 40 percent answered produces an interpretation that is 40 percent informed, and the honest way to present that is to show which areas have been covered and which have not. Unanswered sections read as unknown rather than quietly counting as fine, which is the failure mode that makes self-assessment scores worthless.
Who this is for
Built for the practices that need it most.
Practices holding a finished assessment and no plan.
The assessment is the deliverable most consultants leave behind, and it is the point at which most practices stop. If you already have several hundred answers and no idea which twelve of them matter, the interpretation is the missing half of the work.
Practices with more findings than hours.
Nobody closes everything. An independent practice has a few hours a month for compliance, and the entire question is whether those hours go to the findings that reduce real exposure. Ranking is not a nicety here; it is the whole intervention.
Practices who have to explain a decision.
When an investigator asks why one gap was addressed in March and another is still open, “these were ranked higher by likelihood and impact” is an answer. “We got to them in order” is not.
What you get
5 outcomes you’ll feel in week one.
A ranked list, not a document.
Several hundred answers come back in an order you can act on.
Likelihood and impact kept apart.
The two judgements stay visible instead of collapsing into one number.
High-impact findings surfaced.
Severity is separated from probability, because they are different problems.
Item-level, so it is inspectable.
Open any finding and see what produced its level.
Unanswered reads as unknown.
Coverage is shown, so a thin assessment cannot look like a clean one.
What does Risk Intelligence actually read?
How is this different from the Patient Protect Score?
Is this the risk analysis HIPAA requires?
What if my assessment is only partly finished?
Can I change how items are weighted?
How often does the picture change?
What it does not do.
- A different job from the Patient Protect Score: this interprets risk, the score reports standing
- No claim that it ingests every possible live state change
Continue exploring
Related features in the platform.
System layer
Security Risk Assessment
The assessment is where the analysis is conducted; this is where its output is interpreted. Without the assessment there is nothing here to read.
Learn moreSystem
Autonomous Compliance Engine
Your practice state produces the next thing worth doing — from the assessment, but also from a lapsing BAA, a policy change, a new workforce member. Work closes when its conditions are met, and closing it changes the state.
Learn moreSystem layer
Patient Protect Score
A different question. This one asks how bad the exposure is; the Score asks where the practice stands overall.
Learn moreSeveral hundred answers, in the order that reduces exposure.
The assessment is the work. The ranking is what makes the work survivable for a practice with a few hours a month.