Which statement best describes the purpose of a risk assessment in healthcare information?

• A. To schedule patient appointments
• B. To train staff
• C. To audit finances
• D. To identify vulnerabilities and threats

Answer: (D)

Risk assessment in healthcare information is about locating weaknesses and potential threats to information systems and patient data. It identifies vulnerabilities and threats, estimates how likely they are to occur and how severe their impact could be, and then guides where to put safeguards to protect confidentiality, integrity, and availability of ePHI. While training staff, scheduling appointments, and auditing finances are important activities in a healthcare setting, they aren’t the primary purpose of a risk assessment—the goal here is to uncover and prioritize risks so appropriate controls can be implemented.