SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/hipaa-risk-management-required

After a risk analysis, what must an organization do?

Use risk management to reduce risks to a reasonable and appropriate level.

Start playing free

  1. Reduce risks to a reasonable and appropriate level ✔
  2. Eliminate all possible risks
  3. Encrypt every email

Why: Risk management means implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

Huh, didn't know that: HIPAA does not require perfect security, but risks must be reduced to a reasonable level.

The dad joke
Why did the risk manager bring a level? To make risks reasonable and appropriate.
Like this card?
Play the game

References

Answer: Reduce risks to a reasonable and appropriate level. Risk management means implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

  1. 45 CFR 164.308(a)(1)(ii)(B) www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.308
    Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Work SkillsWhat is electronic protected health information, or ePHI?Work SkillsWho must comply with the HIPAA Security Rule?Work SkillsWhat are administrative safeguards in the HIPAA Security Rule?

That's stuff everyone should know.