(786) 808-8288Book a consultation
ENES
An IT professional checks a tablet beside glass-enclosed server racks

HIPAA compliance

HIPAA security risk assessment for medical and mental health practices

A HIPAA security risk assessment (the Security Rule calls it a risk analysis) is required of every practice HIPAA covers and every business associate holding its electronic patient information, and it must be accurate, thorough and written. OCR announced ten settlements in 2026 over a risk analysis that was missing or not accurate and thorough: $10,000 to $800,000 each, plus two or three years of OCR monitoring.

Book a consultationCall (786) 808-8288

The short answer

What is a HIPAA security risk assessment?

The written risk analysis the Security Rule marks “Required”: every location, device, system and vendor touching ePHI, their threats and vulnerabilities, current measures and a risk level for each, kept 6 years. Analyze again after a security incident or a change in ownership, and before adding technology to make operations more efficient. The Advixor Group conducts risk assessments and assists with corrective action plans.

Sources45 CFR 164.30845 CFR 164.316OCR Guidance on Risk AnalysisOCR Audit Protocol

An IT specialist in glasses works intently on a laptop at a bright desk

Required

Is a HIPAA security risk assessment mandatory?

Yes. 45 CFR 164.308(a)(1)(ii)(A) marks the risk analysis “Required”; only “addressable” specifications allow a documented, equivalent alternative (164.306(d)), and the analysis decides those choices, such as whether and how to encrypt (HHS).

In OCR’s 2016–2017 audits of 166 covered entities and 41 business associates, only 14% and 17% were “substantially fulfilling” their risk analysis duties (90 FR 915).

Scope

What a HIPAA IT risk assessment has to cover

All the electronic protected health information (ePHI) you create, receive, maintain or transmit, “in all forms of electronic media”, from one workstation to networks across locations (HHS).

  • Every location. Version 3.7 of HHS’s Security Risk Assessment (SRA) Tool added a scope question for each one.
  • Every device and system. NIST adds remote access, teleworkers, laptops, phones, removable media and medical devices; for a solo therapy practice, that can be one laptop, one phone, the telehealth platform and the cloud records system.
  • An asset inventory. HHS: “Under the current Security Rule, we consider the technology asset inventory to be a component of the standard for risk analysis.” The SRA Tool records each asset’s type, ePHI access, encryption, person responsible and location.
  • Vendors. List each one that handles ePHI for you and whether a business associate agreement covers it, plus any tracking tool that sends ePHI from a patient-portal or booking page to its vendor: HHS’s tracking guidance puts those in the risk analysis (marketing compliance).

Six Steps

How to conduct a HIPAA risk assessment: the checklist

HHS endorses no single method, but every risk analysis must include these elements.

Step What to produce What OCR’s auditor checks
Scope Every location, system, device and vendor that touches ePHI “A defined scope that identifies all of its systems”
Data collection Where ePHI is created, received, kept and sent, with the asset inventory Part of the defined scope
Threats and vulnerabilities Reasonably anticipated natural, human and environmental threats, and the weaknesses they could exploit “Details of identified threats and vulnerabilities”
Current measures What is in place, and whether it is configured and used properly “Assessment of current security measures”
Likelihood and impact A rating for each threat and vulnerability pair “Impact and likelihood analysis”
Risk level A level for every pair (one way: average the two ratings), with a list of corrective actions “Risk rating”

Sources HHS-OCR, Guidance on Risk Analysis (Aug 12, 2026); OCR Audit Protocol, 164.308(a)(1)(ii)(A).

The auditor also reads your risk analysis policy (purpose, scope, roles, management involvement, review frequency) and the previous analysis, or its two latest updates, or an explanation of why there are none.

SRA Tool

The HHS HIPAA security risk assessment tool, and its limits

The SRA Tool, version 3.7 (updated Sept 18, 2026), is a Windows application or an Excel workbook. Answers stay on your computer: HHS “does not collect, view, store, or transmit” them. It was built for “medium and small providers”.

7sections

The questionnaire’s sections:

  • SRA basics
  • Policies and documentation
  • Workforce
  • Data
  • Physical security
  • Vendors and business associate agreements
  • Contingency planning

Source ASTP/ONC, SRA Tool page and v3.7 User Guide.

The tool’s own text sets the limits: using it “is neither required by nor guarantees compliance”, and risks the survey doesn’t list still have to be identified, assessed and documented. NIST pairs the questionnaire with vulnerability scanning.

Risk Management

From the HIPAA security risk analysis to a risk management plan

Risk management is “Required” too: measures “sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level” (164.308(a)(1)(ii)(B)). It is the step that fails most.

  • 94%of the audited covered entities had not implemented appropriate risk management.
  • 88%of the audited business associates, too.

Source 90 FR 915 (OCR’s 2016–2017 audits).

The auditor reads your risk management policy for “what is considered an acceptable level of risk based on management approval” and how often risks are reviewed, then checks that the measures answer the threats “according to the risk rating”.

Medicare’s MIPS program checks both: from the 2026 performance period, clinicians reporting Promoting Interoperability attest “Yes” to each within the calendar year, and for risk management CMS accepts “a risk management plan and a good faith effort”. Small practices (15 or fewer clinicians) have the category reweighted to zero unless they submit its data (42 CFR 414.1380(c)(2)(i)(C)).

Updates and Records

HIPAA risk assessment requirements: how often to update it and how long to keep it

Some organizations, HHS notes, update “annually or as needed (e.g., bi-annual or every 3 years)”. Analyze again after a security incident, a change in ownership or turnover in key staff or management, and before adding technology “to make operations more efficient” (operational efficiency), or while planning systems, as when opening a practice. When staff leave, end their access: the September 17 settlement cited no procedure for it (164.308(a)(3)(ii)(C)), a step for your HR policies.

Keep the analysis in writing (electronic is fine) for 6 years from its creation or the date it was last in effect, whichever is later, and review it periodically and after environmental or operational changes (164.316(b)).

Proposed, not law. HHS’s January 6, 2025 proposal (90 FR 898) would require a written asset inventory and network map, a written analysis with eight minimum contents and a review at least once every 12 months, with compliance due 180 days after a final rule takes effect. The federal agenda targets July 2027.

“The Security Rule does not specify how frequently to perform risk analysis as part of a comprehensive risk management process.”

HHS Office for Civil Rights, Guidance on Risk Analysis (reviewed Aug 12, 2026)

2026 Settlements

What OCR orders when the risk analysis for HIPAA compliance is missing

A phishing attack on one staff email account started the substance use program’s case. The women’s health network’s corrective action plan set this sequence:

  1. Within 30 days: the scope and method of a new risk analysis, sent to HHS.
  2. Within 180 days of HHS’s approval: the analysis, covering every facility, with a complete inventory of equipment, data systems, off-site storage and applications, vulnerability scans and penetration testing (60 days per revision).
  3. Within 90 days of HHS’s final approval of the analysis: a risk management plan, adopted within 30 days of its approval.
  4. Within 60 days of the plan’s approval: revised policies and procedures.
  5. Within 120 days of the policies’ approval: an implementation report with owner or officer attestations.
  6. Every year of the 2-year term: a new risk analysis.
OCR settlements announced in 2026 that cited a missing or inadequate risk analysis, in dollars
Patient-communication software company (business associate), about 15 million people, Mar 5$10,000
Substance use treatment program, 1,980 patients, Feb 19$103,000
Benefits administrator (business associate), 136,539 people, Apr 23$225,000
Self-funded employer health plan, 9,316 people, Apr 23$245,000
Women’s health practice network, 37,989 patients, Apr 23$320,000
Imaging and screening provider, 244,813 people, Apr 23$375,000
Employer group health plan, 10,023 people, June 18$450,000
Health system, 53,907 people, July 29$552,250
Genetic testing company, 225,370 people, Sept 17$700,000
Health network, 248,359 people, Oct 29$800,000

Sources HHS-OCR releases, Feb 19 to Oct 29, 2026 (total $3,780,250). OCR weighed the software company’s financial condition.

Our Service

Working with us on a HIPAA compliance risk assessment

We perform the security risk analysis with your IT vendor and build the plan to fix what it finds, under a business associate agreement signed before we see your systems. You receive an asset inventory, a risk register and a risk management plan, and we coordinate the vulnerability scans with your IT vendor.

Legal questions, such as whether an incident is a reportable breach, go to your own attorney; we don’t give legal advice.

HIPAA risk assessment services

For your practice, we:

  • Conduct internal compliance reviews and risk assessments to identify deficiencies and areas needing corrective action
  • Assist with audits, investigations and corrective action plans
  • Develop and update your policies and procedures
  • Coordinate HIPAA training
  • Monitor rule changes
Book a consultation

What’s included

What our HIPAA risk assessment services include

HIPAA compliance

The HIPAA program around the analysis: policies, patient notices, breach response and penalty tiers.

Learn more

HIPAA BAAs

Which vendors need a business associate agreement before they touch ePHI, and what it must say.

Learn more

HIPAA checklist

A HIPAA compliance checklist: Privacy, Security and Breach Notification items with their deadlines.

Learn more

Compliance training

Security awareness training: the four topics the Security Rule names and the training records to keep.

Learn more

Compliance

How the yearly compliance risk assessment and audit cover billing, coding and referrals.

Learn more

Consulting

When an outside consultant who works with your records becomes your business associate.

Learn more

Quick answers

HIPAA security risk assessment: vendors, breaches and cost

Your IT company, breach and privacy assessments, vendor risk and cost. Ask about your own systems in a consultation.

A consultant in a suit walks an office manager through details at her laptop
Can our IT company do the HIPAA risk assessment?
Yes, as your business associate: HHS lists an IT contractor or managed services provider supporting systems with ePHI among its examples, so a signed BAA comes first (what it must say).
Is a HIPAA breach risk assessment the same thing?
No. The four-factor test in 45 CFR 164.402 decides whether one incident is a reportable breach; it is on our HIPAA compliance page.
Is there a HIPAA privacy risk assessment too?
Not by that name. The Privacy Rule requires "appropriate administrative, technical, and physical safeguards" for protected health information in any form, paper included (45 CFR 164.530(c)).
Do we have to assess our vendors' risk?
Their ePHI is already in your scope, and each BAA must promise Security Rule safeguards and security incident reports (45 CFR 164.314(a)). The January 2025 proposal, not yet law, would add each business associate's risk to the written analysis, verified in writing at least once every 12 months.
What does a HIPAA risk assessment cost?
No government fee applies and HHS's tool is free; the cost is the work. The fee depends on the size of your practice and your systems: we go over your needs first and quote it in writing.

Talk to an advisor

You care for patients. Who’s taking care of the business?

Tell us where your practice is today. We will tell you what we would do first.

Book a consultationor call (786) 808-8288

Official sources

All read Oct 20, 2026.