The popular Security Risk Assessment (SRA) Tool, a joint effort by HHS’ Office of the National Coordinator for Health Information Technology (ONC) and the Office for Civil Rights (OCR), can help small- and medium-sized health care organizations assess their own security risks.

OCR and ONC just released version 3.3 of the tool, which includes numerous new features requested by users in a survey conducted last year.^[1] The added features include file association in Windows, which allows users to double-click a saved SRA file to open the entire tool, improved reports, bug fixes and improved stability.

At the same time, the two agencies also introduced the SRA Tool Excel Workbook, which is an alternative version of the SRA Tool in spreadsheet format. The Excel workbook contains conditional formatting and formulas to calculate and help similarly identify risk to the SRA Tool application, according to ONC, and may be a good option for users who do not have access to Microsoft Windows.

The tool contains seven sections: SRA basics (the organization’s security management process at the time of the evaluation), security policies, procedures and documentations, security and the workforce, security and data, security and the practice (physical security procedures, such as maintaining locked doors), security and vendors and contingency planning.