Short answer: The HIPAA Security Rule requires every covered entity and business associate to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability” of the electronic protected health information (ePHI) it holds (45 CFR 164.308(a)(1)(ii)(A)). In practice, that means: find everywhere ePHI is created, received, stored, or transmitted; identify realistic threats and vulnerabilities; evaluate your current safeguards; rate likelihood and impact; and document the results with a plan to reduce the risks. Then repeat it regularly and whenever your environment changes. A completed checklist isn’t enough. HHS expects an organization-wide analysis you can show on request.
What does the HIPAA Security Rule require?
Two linked requirements sit at the start of the Security Rule’s administrative safeguards, and both are required, not “addressable”:
| Requirement | Citation | What it means |
|---|---|---|
| Risk analysis | 45 CFR 164.308(a)(1)(ii)(A) | An accurate and thorough assessment of risks and vulnerabilities to ePHI |
| Risk management | 45 CFR 164.308(a)(1)(ii)(B) | Security measures that reduce those risks to a reasonable and appropriate level |
The risk analysis drives everything else. Decisions about “addressable” safeguards, such as encryption, should trace back to it, and documentation of those decisions must be retained for six years (45 CFR 164.316).
The rule applies to covered entities (health plans, health care clearinghouses, and providers who conduct standard electronic transactions) and to business associates: IT providers, billing companies, software vendors, consultants, and others that handle ePHI on their behalf.
How do you conduct a HIPAA security risk assessment?
HHS’s Guidance on Risk Analysis doesn’t mandate a single method, but it describes the elements a compliant analysis should include. A practical sequence:
- Define the scope. Include all ePHI in every form of electronic media: EHR and practice management systems, email, file shares, cloud apps, laptops, phones, backups, medical devices, and vendors’ systems.
- Inventory where ePHI lives and flows. List systems, locations, and data flows, including who has access and which business associates touch the data.
- Identify threats and vulnerabilities. Consider ransomware, phishing, lost or stolen devices, insider misuse, misconfigured cloud storage, unpatched systems, vendor compromise, and natural or environmental events.
- Assess current security measures. Document the administrative, physical, and technical safeguards in place, such as access controls, MFA, encryption, logging, backups, and training, and whether they’re configured and used properly.
- Determine likelihood. Estimate how likely each threat is to exploit each vulnerability, given your current safeguards.
- Determine impact. Estimate the harm to patients and the organization if it happens: data exposure, downtime, patient safety, and regulatory and financial consequences.
- Assign a risk level. Combine likelihood and impact, using a simple high / medium / low matrix.
- Document the analysis. Record scope, method, findings, risk levels, and dates.
- Plan and track risk management. Assign each significant risk an owner, a treatment, and a target date. A risk register works well for this.
- Review and update. Revisit the analysis periodically and after significant changes, such as new systems, moves, mergers, or security incidents.
What should the risk analysis document include?
| Section | Contents |
|---|---|
| Scope and method | Systems, locations, and vendors covered; the rating method used |
| ePHI inventory | Where ePHI is created, received, maintained, or transmitted |
| Threats and vulnerabilities | The realistic threats and weaknesses identified for each asset or process |
| Current safeguards | What’s in place and how well it works |
| Risk ratings | Likelihood, impact, and overall risk for each finding |
| Risk management plan | Owners, actions, target dates, and accepted risks with sign-off |
| Approval and history | Who reviewed and approved it, and a record of updates |
What mistakes do organizations make?
HHS’s Office for Civil Rights (OCR) has repeatedly cited missing or inadequate risk analyses in its enforcement actions. Common problems:
- Too narrow. Only the EHR is assessed, while email, laptops, backups, and cloud apps are skipped.
- A checklist instead of an analysis. Answering yes/no questions without identifying threats, rating risk, or planning fixes.
- Never updated. The analysis is several years old and doesn’t reflect current systems or vendors.
- No follow-through. Risks are identified but never assigned, treated, or tracked, so the risk management requirement isn’t met.
- Vendor blind spots. Business associates aren’t identified, and business associate agreements are missing.
What tools and frameworks can help?
- HHS Security Risk Assessment (SRA) Tool. A free tool from HHS (ONC and OCR) designed for small and medium-sized providers. It’s a useful structure, though using it doesn’t by itself make you compliant.
- NIST SP 800-66 Rev. 2. NIST’s resource guide for implementing the HIPAA Security Rule, including risk assessment and risk management considerations.
- NIST SP 800-30. NIST’s general guide to conducting risk assessments, referenced in HHS’s risk analysis guidance.
HHS has also proposed significant updates to the Security Rule, published as a notice of proposed rulemaking on January 6, 2025. Proposals aren’t binding until finalized, so check HHS for the current status. The existing risk analysis requirement applies regardless.
Frequently Asked Questions
How often should a HIPAA risk assessment be done?
The Security Rule requires ongoing review rather than a fixed interval. Many organizations update the analysis annually, and it should also be updated when the environment changes: new systems, new locations, new vendors, or after a security incident.
Are business associates required to do a risk analysis?
Yes. Business associates are directly subject to the Security Rule’s requirements, including risk analysis and risk management for the ePHI they handle.
Is a HIPAA risk assessment the same as a HIPAA audit?
No. A risk analysis is something you perform on your own environment to identify and manage risk. An audit or investigation is performed by someone else, such as OCR, to check compliance. A documented, current risk analysis is one of the first things requested in an OCR investigation.
Can we use the free HHS SRA Tool instead of hiring someone?
Many small practices do, and it’s a reasonable start. The tool is only as good as the inputs: an incomplete ePHI inventory or untracked follow-up produces an incomplete analysis. Outside help is most useful for scoping, rating risks consistently, and turning results into a realistic risk management plan.
How USCIBER can help
USCIBER’s Security & Risk Assessment can be scoped to the HIPAA Security Rule: an ePHI inventory, threat and vulnerability analysis, risk ratings, and a prioritized risk management plan documented for your records. There is no official HIPAA certification; the goal is a defensible analysis and a plan you can show when customers, partners, or OCR ask. From $6,500. For ongoing risk management and policy upkeep, see our vCISO service, and for how HIPAA fits with other frameworks, see frameworks we support.
Sources
- 45 CFR 164.308 — Administrative safeguards (risk analysis and risk management)
- 45 CFR 164.316 — Policies and procedures and documentation requirements
- HHS — Guidance on Risk Analysis
- HHS — Security Risk Assessment Tool
- NIST SP 800-66 Rev. 2 — Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide
- Federal Register — HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, January 6, 2025)
This article is general information, not legal advice.