Part Why Risk Assessment and Analysis.- Chapter 1: Not If, But When.- Chapter 2: Meeting Regulator Expectations.- Chapter 3: Selecting Security Measures.- Part Assessing and Analyzing Risk.- Chapter 4: Inventory Your ePHI.- Chapter 5: Who Wants Health Information.- Chapter 6: Weaknesses Waiting to Be Exploited.- Chapter 7: Is It Really This Bad?.- Chapter 8: Increasing Program Maturity.- Chapter 9: Targeted Non-technical Testing.- Chapter 10: Targeted Technical Testing.- Part Applying the Results to Everyday Needs.- Chapter 11: Refreshing the Risk Register.- Chapter 12: The Cybersecurity Roadmap.- Part Continuous Improvement.- Chapter 13: Investing for Risk Reduction.- Chapter 14: Third Beyond the BAA.- Chapter 15: Social Media, BYOD, IOT and Portability.- Chapter 16: Risk Treatment and Management.- Chapter 17: Customizing the Risk Analysis.- Chapter 18: Think Offensively.- Appendix A. NIST CSF Internal Controls.- Appendix B. NIST CSF to HIPAA Crosswalk.- Appendix Risk Analysis Templates.-