How to Do a HIPAA Security Risk Assessment: A Step-by-Step Guide for Practices

If your practice had a ransomware attack tomorrow, one of the first documents the HHS Office for Civil Rights (OCR) would ask to see is your risk analysis. Not your antivirus invoice or your privacy notice. Your written, current assessment of the risks to your patients’ electronic health information.

For many small practices, that document is either missing, years out of date or a vendor checklist nobody has read. That’s a real problem: OCR’s enforcement actions keep pointing to the same failure, an inadequate risk analysis. The good news is that a solid HIPAA security risk assessment is very doable for a small practice in a few focused weeks.

This guide walks through a step-by-step process based on HHS guidance. It’s general information for compliance planning, not legal advice.

What the HIPAA Security Rule actually requires

The HIPAA Security Rule requires covered entities and business associates to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability” of electronic protected health information (ePHI). That’s the risk analysis requirement at 45 CFR 164.308(a)(1)(ii)(A).

It comes paired with a second requirement: risk management, which means implementing security measures that reduce those risks to a reasonable and appropriate level.

A few points practices often miss:

• There’s no required method. HHS doesn’t prescribe a specific methodology, because practices differ in size and complexity. Your process just has to be accurate, thorough and documented.
• It isn’t a one-time event. HHS expects you to review and update the analysis periodically and when your environment changes, such as a new EHR, a new office or a move to the cloud.
• Documentation must be kept. The Security Rule requires you to retain required documentation for 6 years from its creation or when it was last in effect, whichever is later.
• Business associates must do one too. Your billing company, IT provider and cloud vendors handling ePHI have their own Security Rule obligations.

Key takeaway: A risk analysis isn’t a form you fill in once. It’s a living record of where patient data lives, what could go wrong and what you’re doing about it. If it doesn’t reflect your current systems, it won’t hold up.

Risk analysis vs risk assessment vs audit

People use these terms loosely, so here’s how they fit together.

Term	What it means	Who does it
Risk analysis	The Security Rule’s required assessment of risks to ePHI	Your practice, often with IT help
Security risk assessment (SRA)	Common name for the same thing, also used in tool names	Your practice or a consultant
Risk management plan	Your documented plan to reduce identified risks	Your practice
Gap assessment	A checklist comparing your controls to the Security Rule’s standards	Often a consultant or tool
Penetration test	Technical testing that tries to exploit weaknesses	Specialized security firm

A gap checklist on its own isn’t a risk analysis. OCR looks for an assessment of risks: threats, vulnerabilities, likelihood and impact across all your ePHI.

The 9-step risk assessment process

HHS guidance describes the elements a risk analysis should include. Here they are as 9 practical steps.

Step 1: Define the scope

HHS guidance says the analysis should cover all ePHI your organization creates, receives, maintains or transmits, regardless of the electronic media. That includes:

• Your EHR or practice management system, whether on-site or cloud-hosted
• Workstations, laptops, tablets and phones, including personal devices used for work
• Email, patient messaging and texting apps
• Imaging equipment, lab devices and other connected medical devices
• Backups, external drives and USB media
• Cloud storage, billing platforms and patient portals
• Fax servers, scanners and copiers with hard drives

Don’t scope out a system because a vendor runs it. If ePHI flows through it, it belongs in your analysis.

Step 2: Inventory where ePHI lives and moves

Build a simple inventory, even a spreadsheet works. For each system or device, record:

• What ePHI it holds or transmits
• Where it’s located (on-site, cloud, at home)
• Who uses it and how they log in
• Who the vendor is and whether you have a business associate agreement
• How it’s backed up

Then sketch how data flows: from intake forms to the EHR, from the EHR to the clearinghouse, from the portal to the patient. Data in motion is often where the surprises are, such as staff texting images or forwarding records to personal email. Our guide to HIPAA-compliant texting covers one common gap.

Step 3: Identify threats and vulnerabilities

For each system, list realistic threats and the weaknesses they could exploit.

Common threats for small practices:

• Phishing and business email compromise
• Ransomware
• Lost or stolen laptops and phones
• Former employees who still have access
• Vendor or business associate breaches
• Power outages, fire or flooding
• Staff snooping in records without a work reason

Common vulnerabilities:

• No multi-factor authentication on email or remote access
• Shared logins at the front desk
• Unpatched or unsupported operating systems
• Unencrypted laptops or backups
• Backups that are never tested, or that sit on the same network as production systems
• No audit log review

Step 4: Assess your current security measures

Document what’s already in place for each risk: technical safeguards such as encryption, MFA and endpoint protection, administrative safeguards such as policies, training and access reviews, and physical safeguards such as locked server closets. Be honest about whether each measure is actually configured and used, not just purchased.

Step 5: Rate likelihood and impact

For each threat-vulnerability pair, estimate:

• Likelihood: How probable is it, given your current safeguards? Use a simple scale such as low, moderate, high.
• Impact: If it happened, how bad would it be for patients and the practice? Consider data exposure, downtime, patient safety and cost.

Step 6: Determine the level of risk

Combine likelihood and impact into an overall risk level. A simple matrix works:

	Low impact	Moderate impact	High impact
High likelihood	Moderate	High	High
Moderate likelihood	Low	Moderate	High
Low likelihood	Low	Low	Moderate

Sort your list from highest to lowest risk. This ranking becomes your to-do list.

Step 7: Write the risk management plan

For each moderate or high risk, document:

• The action you’ll take, such as enabling MFA, encrypting laptops or moving backups offline
• Who owns it
• The target completion date
• The status, updated as you go

You can accept some low risks, but write down why. OCR expects to see decisions, not silence.

Step 8: Finalize and sign the documentation

Put it all in one report: scope, inventory, threats and vulnerabilities, current controls, ratings, risk levels and the management plan. Date it, note who performed it and have leadership sign off. Store it with your HIPAA records for at least 6 years.

Step 9: Review and update it

Revisit the analysis on a regular schedule your practice sets, and whenever something significant changes, such as:

• A new EHR, patient portal or billing vendor
• Moving to the cloud or opening a new location
• A security incident or near-miss
• New devices, such as tablets for patient intake

Many practices review annually, and that’s a sensible minimum for a small office, but it’s your policy to set and follow.

Tools that make it easier

You don’t need expensive software to start. HHS’s Office of the National Coordinator for Health IT (ONC), working with OCR, offers a free Security Risk Assessment (SRA) Tool designed for small and medium-sized providers. It walks through questions by section, records your answers and produces a report. According to HealthIT.gov, the information you enter is stored locally on your computer and isn’t collected by HHS. HealthIT.gov lists version 3.7 as the current release, and HHS states plainly that using the tool neither is required by nor guarantees compliance with the law.

Other options include compliance software platforms and consultants. Whatever you use, the output must reflect your actual systems. A completed questionnaire full of “yes” answers that don’t match reality is worse than useless in an investigation.

For a broader control framework to guide your fixes, our explainer on the NIST Cybersecurity Framework is a useful companion.

Common mistakes OCR keeps finding

OCR runs a Risk Analysis Initiative focused on this exact requirement, and its settlements, often following ransomware or phishing incidents, repeatedly cite the same issues:

• No risk analysis at all, or one that covered only the EHR.
• Outdated analysis that didn’t reflect new systems.
• No risk management follow-through: risks identified but never fixed.
• Missing business associate coverage of vendors handling ePHI.

Settlements typically come with corrective action plans and multi-year OCR monitoring. The fix is cheaper.

What’s changing with the Security Rule

In January 2025, HHS proposed a major update to the HIPAA Security Rule that would make many safeguards, including more specific risk analysis contents, explicitly required. As of fall 2026, it hasn’t been finalized, and the federal regulatory agenda lists final action no earlier than 2027. The current rule still applies, so focus on meeting it well now. Many proposed items, such as asset inventories and MFA, are good practice anyway.

Where to start this month

1. Assign an owner, usually your HIPAA security officer.
2. Download the SRA Tool or set up a spreadsheet template.
3. Build your inventory of systems and data flows in week 1.
4. Work through threats, controls and ratings in weeks 2 and 3.
5. Write and sign the management plan in week 4.
6. Tackle the top 3 risks immediately. For most practices, that’s MFA on email and remote access, tested offline backups and access cleanup for former staff. Our guides to ransomware protection, backing up business data and identity and access management help with each.

If you build software for healthcare clients, our HIPAA compliance guide for software teams covers the business associate side.

The bottom line

A HIPAA security risk assessment is the foundation of your entire security program and the first thing regulators check. Scope every system that touches ePHI, rank the risks honestly, document a plan with owners and dates, and keep it current. A practice that does this well is far better protected, and far better positioned if something goes wrong.

Sources

• HHS: Guidance on Risk Analysis Requirements under the HIPAA Security Rule — required elements of a risk analysis and flexibility of method
• HealthIT.gov: Security Risk Assessment Tool — free SRA Tool, current version, disclaimer and local data storage
• 45 CFR 164.308 (Cornell LII) — risk analysis and risk management implementation specifications
• 45 CFR 164.316 (Cornell LII) — 6-year documentation retention requirement
• Federal Register: HIPAA Security Rule proposed rule (January 6, 2025) — proposed Security Rule changes
• HHS: OCR settles HIPAA Security Rule investigation with Health Fitness Corporation — Risk Analysis Initiative enforcement example