Risk management is a crucial element for understanding information and privacy security. This domain sets the foundation for the entire course and provides a high-level glimpse of the essential concepts of risk management. In the healthcare industry, risk management is crucial due to the sensitive nature of information, where data sharing can be a matter of life and death while still requiring privacy protection. The healthcare industry relies on technology to improve operations and patient care, which comes with associated risks that must be considered alongside unique regulatory and business requirements.

Skills you'll gain

This course includes:

This module focuses on maintaining the confidentiality, integrity, and availability (CIA) of assets as the basis of information security. It covers the CIA triad framework for assessing security policies, processes, and tools. The module explains enterprise risk management concepts including information asset identification, asset valuation, threats, vulnerabilities, exposure, likelihood, consequence, risk, controls, and residual risk. Emphasis is placed on protecting personally identifiable information (PII) and protected health information (PHI) in different forms and through various data processes.

Skills you'll gain

This course includes:

This module covers risk management frameworks that provide security practitioners with guidelines and best practices to reduce organizational exposure to compromises. It explains how frameworks allow organizations to assess security posture, create auditable systems for managing information assets, and protect confidentiality, integrity, and availability. The module explores frameworks including NIST Risk Management Framework, ISO 27000 series, and ITIL, with special attention to healthcare-specific frameworks like ISO 27799:2016. It also covers information risk management processes, lifecycle/continuous monitoring, tools and techniques, risk assessment approaches, gap analysis, and the role of internal/external audits.

Skills you'll gain

This course includes:

This module focuses on the implementation of controls after risk assessment. It explains how different organizations have varied needs, requirements, and resources for addressing risk assessment findings, and how control choices can vary based on geographic location, staffing levels, and contractual requirements. The module provides insight into control selection processes and explores the advantages and characteristics of control frameworks, along with specific control assessment procedures.

Skills you'll gain

This course includes:

This module examines the four general approaches to respond to risk in the risk management process. It covers mitigating actions, control utilization to mitigate risk, control categories, control types, Defense in Depth (DiD), and the Information Security Continuous Monitoring (ISCM) Framework and frequency. The module focuses on how these approaches are used to protect the business by identifying and addressing risks effectively.

Skills you'll gain

This course includes:

This module serves as the conclusion to the Risk Management and Risk Assessment in a Healthcare Setting course. It includes a final assessment that evaluates understanding of the key concepts covered throughout the course, including principles of enterprise risk management, information risk management frameworks and processes, control assessment procedures, and risk response approaches.

Skills you'll gain

This course includes: