When must an Eligible Provider (EP) or Eligible Hospital (EH) complete a Security Risk Analysis (SRA)?
a) One-time only for Stage 1 and Stage 2
b) After the EHR reporting period time frame
c) During each program year for Stage 1 and Stage 2
d) My practice does not need to complete an SRA
Answer: c) During each program year for Stage 1 and Stage 2
Please visit the following to learn more about new CMS issued guidance for when to complete a security risk analysis.