Your HIPAA security risk assessment, step by step

The short answer

The HIPAA Security Rule requires every covered entity and business associate to conduct an “accurate and thorough” assessment of the risks and vulnerabilities to the electronic protected health information (ePHI) it holds, and then to reduce those risks to a reasonable level. For a small practice, that means: list every place ePHI lives, identify realistic threats to each, rate the likelihood and impact, document the safeguards you have, and write a plan with owners and dates for the gaps.

The free HHS Security Risk Assessment (SRA) Tool, version 3.7 as of September 2026, walks small and medium providers through the process. Repeat the assessment at least yearly and after major changes. This is general information, not legal advice; confirm your obligations with a healthcare attorney or compliance advisor.

Why it matters more in 2026

Risk analysis failures come up again and again in enforcement by OCR, the HHS office that enforces HIPAA. OCR runs a Risk Analysis Initiative, and a June 2026 law firm analysis of four ransomware settlements OCR announced in April 2026 found that all four included a failure to conduct an accurate and thorough risk analysis before the breach.

HHS also proposed a major update to the Security Rule in January 2025 that would make risk analysis more specific, including a written asset inventory and network map. As of October 2026, that rule is still a proposal and has not been finalized. The current rule, including the existing risk analysis requirement, is fully in force. Doing a thorough analysis now prepares you for either outcome. If the rule is finalized as proposed, practices would have 240 days from publication to comply, and an up-to-date inventory is the slowest piece to build.

The steps, following HHS guidance

1. Define the scope. All ePHI, in every form and location: EHR, practice management system, email, scanners, workstations, laptops, phones, backups, patient portal, billing company, cloud apps. Scope includes business associates’ handling of your data.
2. Collect the data. Walk the office and interview staff. Where is ePHI created, received, stored and sent? Who can reach it?
3. Identify threats and vulnerabilities. Realistic threats include phishing, ransomware, stolen laptops, a former employee who still has access, a misdirected email and a failed server. Vulnerabilities are the gaps that let them succeed, such as no MFA or unencrypted devices.
4. Assess current security measures. Record what is in place: MFA, encryption, endpoint protection, backups, access controls, training.
5. Determine likelihood and impact. For each threat and vulnerability pair, rate how likely it is and how bad it would be. A simple high, medium, low scale is acceptable.
6. Assign a risk level. Combine likelihood and impact so the worst risks rise to the top.
7. Document everything. The written analysis is the evidence. Keep it for at least six years, as HIPAA documentation rules require.
8. Review periodically. At least yearly, and after a new EHR, new office, new IT provider or a security incident.

Using the HHS SRA Tool

The SRA Tool was built by ONC with the HHS Office for Civil Rights for small and medium providers. It comes as a Windows desktop application and as an Excel workbook. The desktop version walks you through multiple-choice questions, threat and vulnerability ratings, and asset and vendor lists, stores data locally on your computer and produces a report.

• Good for: structure, coverage of the Security Rule’s standards and a printable report.
• Limits: HHS states that using the tool is not required by law and does not by itself mean you are compliant. It only knows what you tell it, so vague answers produce a vague report.
• Tip: complete the asset and vendor sections fully before answering the questions. Most weak risk analyses fail because the inventory was incomplete.

Practices that participate in Medicare’s Promoting Interoperability program are also asked to attest that they have done a security risk analysis, so the same work serves both purposes.

Who should do it

The practice’s designated security official owns the risk analysis, even when someone else does the legwork. In a small practice that is often the practice manager. Three people should be in the room: the security official, whoever runs IT (in-house or your IT provider, who knows how systems are really configured) and a clinician or front-desk lead, who knows how staff actually handle records day to day.

Outside help is worth it when nobody internally knows the technical setup, when you have had an incident, or when a payer, hospital partner or insurer asks for evidence. Whoever does it, the practice must understand and agree with the ratings, because the practice carries the obligation.

Want an outside view of your practice’s IT risks before you start? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, backups and business continuity as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.

The gaps small practices miss most often

• Incomplete inventory. Forgetting the scanner that emails PDFs, the doctor’s personal phone, the old server in the closet or the billing company’s portal.
• A checklist instead of an analysis. Answering yes or no to safeguards without rating threats, likelihood and impact.
• No risk management plan. The Security Rule requires you to act on what you find. A risk analysis with no follow-up plan is a common OCR finding.
• Copied from last year. Same document, new date, even though the practice switched EHRs.
• Vendors ignored. No list of business associates or signed business associate agreements.
• Unencrypted devices. Laptops and phones with ePHI that are not encrypted.
• Untested backups. Backups that exist but have never been restored, which matters most after ransomware.
• Accounts left open. Former staff who can still log in to email or the EHR.

What a finished risk analysis looks like

A useful finished package for a 5 to 50 person practice usually includes:

• A scope statement and asset inventory listing every system holding ePHI
• A threat and vulnerability list with likelihood, impact and risk rating
• A summary of current safeguards
• A risk management plan: each high and medium risk with an action, an owner and a target date
• A list of business associates with BAA status
• Sign-off by the practice’s security official and the date of the next review

Most of the fixes are standard IT work: MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security and monitored backups with tested restores. Our cybersecurity services cover that work. For the broader picture, see our guide to HIPAA IT requirements for small medical practices.

Keep reading

• HIPAA compliant email: what it takes with Microsoft 365, Google Workspace and Gmail
• PCI DSS compliance for small business: SAQ types and how to shrink your scope
• CIS Controls Implementation Group 1: the 56 safeguards, explained and prioritized
• Cyber insurance requirements in 2026: what insurers commonly ask for

Related services

• HIPAA IT requirements for small medical practices
• Cybersecurity services
• Free Technology Health Assessment