During the risk assessment phase of the project the CISO discovered that a college within the University is collecting Protected Health Information (PHI) data via an application that was developed in-

Documenting the system as high risk is inappropriate because the college is fully HIPAA-compliant; classifying a compliant system as high risk would misrepresent the actual risk posture and skew the overall risk register.

Performing a vulnerability assessment is a more invasive and resource-intensive action that is not warranted at this stage simply because PHI is involved, especially when compliance has already been confirmed.

A quantitative threat assessment attempts to assign numerical values to threats and losses, which is an unnecessary level of effort for a system that is already demonstrated to be compliant with the governing regulation.

Since the college is already fully aware of HIPAA requirements and is fully compliant, no immediate remediation or escalation is needed. The CISO should document/notate the existence of PHI data collection and its compliant status in the risk assessment record, then continue assessing other areas. Escalating a compliant system consumes resources better directed at actual risks.