What are Vulnerability Scans?

DISCLAIMER: The information provided in this article, other knowledge base articles, and the Compliancy Group website do not, and are not intended to, constitute legal advice. All information, content, and materials in the Knowledge Base and on the Compliancy Group website are for general informational purposes only.

Electronic information systems may contain vulnerabilities. Vulnerabilities are weaknesses that, if triggered or exploited by a threat (e.g., malware, or a virus), create a risk of improper access to or disclosure of electronic protected health information (ePHI). 

Vulnerability scans are scans designed to identify vulnerabilities, or weaknesses, in an information system that have the potential to cause a security incident.

What is a HIPAA Security Incident?
Under the HIPAA Security Rule, a security incident is defined as:

1. The attempted or successful unauthorized access, use, disclosure, modification, or destruction of information in an information system; or

2. The attempted or successful unauthorized access, use, disclosure, modification, or interference with system operations in an information system. 

In plain English, a HIPAA security incident occurs when there is an attempt (which can be successful or not successful) to do something unauthorized. The “something” that is unauthorized, is an unauthorized access, use, disclosure, modification, destruction, or interference. 

A HIPAA security incident may occur when there is an unauthorized attempt to access, use, disclose, modify, destroy, or interfere with, an organization’s information system or information systems operations.

What are Some Examples of HIPAA Security Incidents?
Examples of HIPAA security incidents include:

1. Theft of passwords that are used to access electronic protected health information (ePHI).

2. Viruses, malware, or hacking attacks that interfere with the operations of information systems with ePHI.

3. Failure to terminate the account of a former employee that is then used by an unauthorized user to access information systems with ePHI.

4. Providing media with ePHI, such as a PC hard drive or laptop, to another user who is not authorized to access the ePHI prior to removing the ePHI stored on the media.

How Do Vulnerability Scans Identify Weaknesses?
HIPAA vulnerability scans test for holes and flaws in information systems, and for incorrect system implementation and configuration. Common flaws that can be revealed through a vulnerability scan include:

1. Flaws in software. Such flaws can be found in computer operating systems, such as Microsoft Windows 11. Such flaws can also be found in software programs, such as Microsoft Office, Google Chrome, or Internet Explorer. 

2. Flaws in hardware. Vulnerability scans can reveal vulnerabilities that exist on hardware devices. Hardware devices include network firewalls, printers, or routers.  

If a vulnerability scan identifies a vulnerability, the vulnerability may be remediated if the software or network vendor at issue has released a security patch. Installation of the patch may eliminate the security weakness.