Write an Executive Summary

Description

Regional integrated delivery network with 14 clinics and a shared EHR, recently completed a merger with a smaller group.

Analyst task

You inherited a half-finished HITRUST journey and a recent OCR inquiry letter. Sequence the next 60 days: which HITRUST controls do you close first, what do you send the OCR, and how do you get the post-merger combined entity onto one risk register?

Systems

• Epic EHR
• On-prem AD
• Patient portal
• HL7 feeds to a clearinghouse

Regulatory exposure

• HIPAA
• State medical record laws
• Joint Commission accreditation

Top risks

• Post-merger AD trust bloat
• Untrained staff on phishing
• Vendor (clearinghouse) breach exposure
• Unencrypted laptop theft

Audit concerns

• Risk analysis currency post-merger
• Workforce training evidence
• BAA completeness