By Chuck Weiselberg, Founder, One Guy Consulting. Published .
Chuck Weiselberg, Founder, One Guy Consulting: experience with HIPAA risk assessments for outpatient practices. Certified HIPAA Professional (CHP); 10 years of HIPAA compliance experience. Full author bio
A HIPAA risk assessment (a systematic process to identify risks to electronic protected health information) for a small clinic identifies where ePHI (electronic protected health information: PHI created, stored, or transmitted electronically) is vulnerable, ranks risks, and prescribes focused controls to reduce exposure. Use this step-by-step guide to complete your first assessment and document results for OCR readiness.
Yes, small clinics must do a security risk assessment too (45 CFR 164.308(a)(1)(ii)(A)). The rule covers every HIPAA covered entity and business associate, whatever its size. When the assessment finds gaps, rank them by risk. Give each one an owner and a deadline. Then put fixes in place, write everything down, and redo the assessment regularly.
How One Guy Consulting Helps Small Practices Close HIPAA Gaps
In January 2025, OCR (the Office for Civil Rights, the federal office that enforces HIPAA) settled with Elgon Information Systems for $80,000 after a ransomware attack. Elgon is a Massachusetts company that provides medical record and billing services to health care providers. The core problem OCR named: no thorough risk assessment.
In October 2024, an Oklahoma EMS provider paid $90,000 for the same gap. The EMS provider was a covered entity, which means a health care provider that HIPAA covers directly. Elgon was a business associate, which means a vendor that handles patient data for providers. Neither was large, and being small did not keep either one off OCR's radar.
If your small clinic still does not have a HIPAA risk assessment or written policies, you are not alone. Many small practices have never completed a formal security risk analysis. But the rule applies no matter how small your staff is. OCR announced its Risk Analysis Initiative in late 2024. It focuses enforcement on organizations that skipped this step.
This article answers two questions: do you actually need a risk assessment (yes), and what happens after it reveals the gaps you already suspect are there.
Yes, Your Clinic Needs a Security Risk Assessment
The requirement is unambiguous. 45 CFR 164.308(a)(1)(ii)(A) requires every covered entity and business associate to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). The Health Insurance Portability and Accountability Act does not exempt small practices. A two-provider dental office has the same obligation as a hospital system.
The scope should be proportional. A small clinic does not need a 200-page report. But it does need a documented risk assessment process that identifies where ePHI lives, what threats exist, what safeguards are in place, and where gaps remain. The process is about finding the risks to the patient data your practice holds. Without that baseline, every other compliance task (policies, training, vendor management) is built on guesswork rather than evidence.
Many small clinics that contact One Guy Consulting have never completed one. That is not shameful. It is the starting point.
What the Assessment Typically Finds
The gaps at small healthcare practices are predictable. Clinics, therapy practices, and specialty offices that work through their assessments turn up the same findings again and again:
- No written HIPAA policies: the practice operates on informal rules that have never been documented. Without written policies, there is nothing to train against, nothing to audit against, and nothing to show a regulator.
- No Business Associate Agreements: vendors that handle PHI (EHR platforms, IT support, billing services, cloud storage) have no signed BAA. A BAA is a written contract in which the vendor promises to protect your patient data. Missing one is a violation by itself, under both the Privacy Rule and the Security Rule (45 CFR 164.502(e) and 164.308(b)).
- No training documentation: staff may have received verbal instructions at some point, but there are no records showing who was trained, when, and on what topics.
- No encryption on portable devices: laptops, tablets, and phones that access or store patient data are unencrypted. If one is lost, the law presumes it is a reportable breach. That holds unless you can show a low chance the data was compromised.
- No incident response plan: if a breach happens tomorrow, nobody knows who to call, what to document, or how to notify affected patients. The law says to notify them without unreasonable delay, and no later than 60 days after you discover the breach.
These are not edge cases. They are the standard starting position for a small practice that has been focused on patient care rather than regulatory compliance. The risk assessment makes them visible so they can be addressed in order of severity. For a broader look at what these gaps mean in enforcement terms, see the guide on what small clinics risk without a risk assessment or HIPAA policies.
Step-by-step: how to do a HIPAA risk assessment for a small clinic
HHS OCR's guidance on risk analysis sets out the elements an assessment needs, and NIST SP 800-66 Rev. 2 walks through each one. For a small clinic, the work looks like this:
- Identify ePHI flows. List every device, system and vendor that creates, receives, stores or sends patient data: the EHR, practice management, email, the scanner, laptops, phones, backups, the billing service.
- List threats and vulnerabilities. For each item: phishing, a lost laptop, ransomware, a former employee's login that still works, a vendor breach.
- Record current controls. What is already in place: passwords, MFA, encryption, locked records room, backups.
- Assess likelihood and impact. This is the risk analysis (the step of identifying threats, vulnerabilities, likelihood, and impact). Rate each risk high, medium or low on both.
- Set the risk level by combining likelihood and impact, and rank the list.
- Document and plan. Write it up, then build the remediation plan below. Risk management, reducing risks "to a reasonable and appropriate level," is its own requirement (164.308(a)(1)(ii)(B)).
Tools and templates for a small clinic
- HHS/ONC Security Risk Assessment Tool: free, built for small and medium-sized practices.
- CMS: HIPAA Basics for Providers: a short CMS fact sheet on the Privacy, Security and Breach Notification Rules for staff orientation.
- NIST SP 800-66 Rev. 2: the federal implementation guide, with questions to ask for each safeguard.
- One Guy Consulting portal: a 63-question security risk assessment that feeds an automated gap analysis and remediation plan.
Documentation examples
Keep each of these, dated, for six years from creation or last effective date (45 CFR 164.316(b)(2)(i)):
- The ePHI inventory: system, owner, location, encrypted yes or no.
- The risk register: each threat, likelihood, impact, risk level and current control.
- The signed, dated SRA report.
- The remediation plan: finding, fix, owner, due date, status.
- Evidence of each fix: the encryption setting, the signed BAA, the training log.
The Remediation Lifecycle
Finding gaps is the easy part. What separates a functional compliance program from a binder collecting dust is what happens next. The remediation lifecycle has five stages, and each one requires action, not just awareness.
Step 1: Prioritize by level of risk. Each gap gets ranked by two factors: how likely the threat is and how much damage it would cause. A clinic with no encryption on laptops that leave the building faces a high-likelihood, high-impact risk. A missing policy document that covers an area your practice does not engage in is low on both scales. Critical items that create direct PHI exposure get fixed first.
This ranking is built for your own practice, not taken from a generic checklist.
Step 2: Assign owners and deadlines. Every gap needs a person responsible for closing it and a target date. In a small clinic, one person often owns most items, typically the office manager or practice administrator. That is fine. What matters is that the assignment exists and someone is accountable. A remediation plan without ownership is a wish list.
Step 3: Implement controls. This is where the actual work happens.
Written policies get drafted and distributed. Staff complete HIPAA training with documented completion records. BAAs get signed with every vendor that touches PHI. Technical fixes (encryption, access controls, audit logging) get set up. Each risk gets a matching safeguard.
Step 4: Document everything. Auditors want to trace a line from the finding to the fix. Save the dated SRA report, the prioritized remediation plan, updated policies, training records, and signed BAAs. Documentation is proof that the program is real and not just a one-time exercise. The Department of Health and Human Services (HHS) expects this security work to keep going. A one-time snapshot is not enough.
Step 5: Re-assess annually. The Security Rule requires periodic review. Your practice changes: new vendors, new staff, new technology, new state law requirements. The risk assessment is not a one-time event. Redoing it every year keeps the program current and catches new gaps before they become incidents.
Typical Timeline for a Small Clinic
With guided support, many small practices can move from no risk assessment to a documented compliance program in weeks, not months:
- First: Assessment: inventory ePHI, evaluate current controls, identify gaps, produce the SRA report.
- Next: Remediation planning: prioritize findings, assign owners, draft missing policies, initiate BAA collection.
- Then: Implementation: distribute policies, complete initial workforce training, deploy technical fixes, and write down how your practice handles PHI.
After that, the program shifts to maintenance mode: annual reassessment, periodic training refreshers, vendor reviews, and incident response drills.
FAQs
What is a HIPAA risk assessment for a small clinic?
A process to find where ePHI is at risk, rank threats, and pick mitigations.
How often should a small clinic perform a risk assessment?
At least annually and after major changes to systems or workflows.
What are the core steps in the assessment?
Identify ePHI flows, list threats/vulnerabilities, assess likelihood and impact, and document mitigations.
One Guy Consulting helps small healthcare practices and business associates conduct HIPAA security risk assessments and build practical remediation plans that close compliance gaps. Book a free 30-minute intro to talk through your situation and figure out where to start.
This content is for educational and informational purposes only and should not be construed as legal advice.
Sources
- 45 CFR 164.308: Administrative Safeguards (eCFR)
- HHS Guidance on Risk Analysis Requirements
- HHS OCR Resolution Agreements and Civil Money Penalties
- 45 CFR 160.103: Definitions (Covered Entity, Business Associate)
- HHS/ONC Security Risk Assessment Tool
- CMS MLN909001: HIPAA Basics for Providers (PDF)
- NIST SP 800-66 Rev. 2
- 45 CFR 164.316: Documentation
Related Reading
Try three One Guy Consulting 3D staff training courses free →