HIPAA Security Risk Assessment
Every healthcare practice that handles patient data must do a Security Risk Assessment (SRA: the process to identify threats to electronic patient data, rate their impact and likelihood, and document controls under 164.308). It is required under 45 CFR §164.308(a)(1)(ii)(A). The SRA finds threats to your electronic health records and forms the base of HIPAA Security Rule compliance.
Deliverables & Audit Evidence
Records detailed enough for OCR review and practical enough for your team to use.
Documented Risk Analysis
Risk inventory mapped to your specific environment, not a generic template output. Our HIPAA risk assessment template guide explains the structure and documentation standards we follow.
Examples: a shared front-desk login on the EHR, rated high risk; an unencrypted backup drive kept in the office, rated medium; a former employee's email account that is still active, flagged for removal.
Prioritized Remediation Roadmap
Clear owners, sequenced actions, and measurable outcomes tied to each finding.
Examples: turn on multifactor authentication for the EHR and email, owned by the office manager, due in 30 days; sign a BAA with the answering service, owned by the practice administrator; replace a Windows 10 workstation that no longer receives security updates.
Executive Summary
Leadership-ready briefing for compliance stakeholders, payers, and board review.
Examples: a one-page count of findings by risk level; the three highest risks in plain language; the owner and target date for each of them.
Implementation Guidance
Practical direction for converting each finding into a completed control improvement.
Examples: which safeguard standard (164.308, 164.310 or 164.312) each finding falls under; which policy or procedure each finding connects to; how to record a fix as done, with the date and proof such as a screenshot.
Audit Evidence Support
Framing and documentation structure designed for audit, contract, and due diligence use.
Examples: the dated SRA report, kept for 6 years under 164.316(b)(2)(i); a remediation log with completion dates; answers ready for a payer or partner security questionnaire.
Part of Full-Scope
The SRA comes with Full-Scope, along with 4 hours a month of 1:1 implementation calls with Chuck.
See pricing →
What Is a HIPAA Security Risk Assessment?
A HIPAA Security Risk Assessment (SRA) is required by 45 CFR §164.308(a)(1)(ii)(A). An SRA finds risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI: individually identifiable health data created, received, maintained, or transmitted electronically).
OCR audits and enforcement often cite missing or inadequate SRAs. Skipping a proper SRA increases audit risk and potential penalties.
45 CFR 164.308 establishes the Administrative Safeguards of the HIPAA Security Rule. The risk analysis requirement at 164.308(a)(1)(ii)(A) is the first and most frequently cited standard in OCR enforcement.
Organizations that skip or shortcut their 45 CFR 164.308 compliance expose themselves to the highest penalty tiers and the most preventable audit failures.
What the HIPAA Security Rule Requires in a Risk Assessment
The HIPAA Security Rule (45 CFR Part 164, Subpart C) does not require one set SRA method. However, OCR's Guidance on Risk Analysis and its enforcement actions set clear expectations.
NIST SP 800-30 (Guide for Conducting Risk Assessments) and NIST SP 800-66 (Implementing the HIPAA Security Rule) offer accepted frameworks to meet this requirement. Key elements include:
- Scope. Identify all ePHI the organization creates, receives, keeps, or sends. Include data at rest and data in transit across systems, devices, and locations.
- Threat identification. Record expected threats to ePHI. Examples include natural disasters, human error, insider threats, malware, ransomware, and unauthorized access. Organizations that do not have a documented incident response and management program are more exposed when a threat occurs.
- Vulnerability assessment. Identify gaps in administrative safeguards (§164.308), physical safeguards (§164.310), and technical safeguards (§164.312). SRA work often finds weak physical safeguard controls and missing device and IT audit records.
- Likelihood and impact analysis. Rate how likely each threat is to exploit a gap. Then rate the impact on ePHI confidentiality, integrity, and availability.
- Risk rating. Assign risk levels to each threat and gap pair. Use those ratings to set remediation priority.
- Remediation plan. Record security steps that reduce risks to a reasonable and appropriate level under §164.306(b). OGC builds HIPAA remediation plans with phases, owners, and evidence checkpoints.
- Documentation. Keep the SRA and all supporting records for at least six years under §164.316(b)(2)(i).
Seven-Phase Methodology (Scoping to Remediation)
Each phase includes practical checkpoints so the process does not drift into theory. Clear owners and target dates from the first week.
- 01
Scoping and Discovery
Confirm legal entity structure, service lines, locations, systems in scope, vendor dependencies, and where ePHI actually flows.
Examples: a second office location that shares the EHR; the billing company and answering service that see patient data; a personal phone a provider uses to text patients.
§164.308(a)(1)(ii)(A)NIST SP 800-30 §3.1OCR expectsIdentify all ePHI the organization creates, receives, maintains, or transmits. - 02
Data Flow and Asset Mapping
Document data entry points, repositories, integrations, endpoints, and admin pathways that affect confidentiality, integrity, and availability.
Examples: intake forms that go from a website form into the EHR; lab results that arrive by fax and are scanned in; nightly backups copied to a cloud service.
§164.312(e)(1)NIST SP 800-66 §4.1OCR expectsDocument data at rest and in transit across all systems, devices, and locations. - 03
Safeguard Review
Record your administrative, physical, and technical controls, and whether each one works in your environment. This phase often finds the same gaps as a HIPAA gap analysis.
Examples: whether screens lock after a few minutes of inactivity; whether the server closet is locked; whether every staff member finished HIPAA training this year.
- 04
Threat and Vulnerability Analysis
Evaluate realistic failure scenarios including access control failures, vendor issues, endpoint exposure, and process gaps.
Examples: a phishing email that steals an EHR password; a stolen laptop without full-disk encryption; a vendor breach that exposes your patients' records.
§164.308(a)(1)(ii)(A)NIST SP 800-30 §§3.2–3.3OCR expectsIdentify expected threats and vulnerabilities to ePHI. - 05
Risk Scoring and Prioritization
Each finding is rated for likelihood and impact so leadership can see what must be addressed first, ranked, not listed.
Examples: a shared EHR admin password, likely and severe, ranked first; an unlocked paper chart room, likely with moderate impact; a flood in a ground-floor server closet, unlikely but severe.
§164.306(b)NIST SP 800-30 §3.4OCR expectsAssess likelihood and impact. Assign risk levels. - 06
Remediation Planning
Turn findings into a phased work plan. Include owners, effort, dependencies, and work order.
Examples: phase 1, the first 30 days: multifactor authentication and removing old accounts; phase 2: encrypting laptops and backups; phase 3: updating policies and retraining staff.
§164.308(a)(1)(ii)(B)NIST SP 800-30 §3.5OCR expectsDocument steps to reduce risks. - 07
Executive Readout
Deliver an audit-ready package and decision briefing so leaders can approve and fund the right next steps quickly.
Examples: a walkthrough of the top risks with the practice owner; a sign-off page showing who approved the plan and when; the date set for the next annual reassessment.
§164.316(b)(2)(i)NIST SP 800-30 §3.6OCR expectsKeep all SRA records for at least six years. Share findings with leadership.
SRA Phase to Regulatory Crosswalk
Each phase of the SRA methodology links to specific HIPAA Security Rule provisions, OCR guidance, and NIST framework references. This mapping shows how each deliverable meets regulatory requirements.
| SRA Phase | HIPAA Security Rule (45 CFR) | NIST Reference | OCR Expectation |
|---|---|---|---|
| 1. Scoping & Discovery | §164.308(a)(1)(ii)(A) | SP 800-30 §3.1 | Identify all ePHI the organization creates, receives, maintains, or transmits. |
| 2. Data Flow & Asset Mapping | §164.312(e)(1) | SP 800-66 §4.1 | Document data at rest and in transit across all systems, devices, and locations. |
| 3. Safeguard Review | §164.308, §164.310, §164.312 | SP 800-66 §§4.2–4.4 | Evaluate safeguards against regulatory intent. |
| 4. Threat & Vulnerability Analysis | §164.308(a)(1)(ii)(A) | SP 800-30 §§3.2–3.3 | Identify expected threats and vulnerabilities to ePHI. |
| 5. Risk Scoring & Prioritization | §164.306(b) | SP 800-30 §3.4 | Assess likelihood and impact. Assign risk levels. |
| 6. Remediation Planning | §164.308(a)(1)(ii)(B) | SP 800-30 §3.5 | Document steps to reduce risks. |
| 7. Executive Readout | §164.316(b)(2)(i) | SP 800-30 §3.6 | Keep all SRA records for at least six years. Share findings with leadership. |
Who Must Conduct a HIPAA Security Risk Assessment
The HIPAA Security Rule applies broadly. The following organizations are required to conduct and document a Security Risk Assessment:
- All covered entities (health plans, clearinghouses, or providers that transmit health information electronically), regardless of size.
- Solo practitioners, group practices, hospitals, health plans, and clearinghouses.
- All business associates (entities performing functions involving PHI on behalf of a covered entity) that create, receive, maintain, or transmit ePHI.
- Organizations that added new systems, telehealth workflows, or remote work setups that changed their ePHI exposure.
- Organizations preparing for OCR (Office for Civil Rights) reviews, payer credentialing, Mergers and Acquisitions due diligence, or contract security rules. Many pair this work with a HIPAA gap analysis.
OCR expects the SRA to be reviewed and updated at least annually or whenever significant changes occur in the organization's environment, operations, or technology.
SRA Enforcement and Penalties
Civil Monetary Penalties
Failure to conduct a Security Risk Assessment is the most frequently cited violation in OCR enforcement actions.
HIPAA civil monetary penalties range from $145 to $2,190,294 per violation per calendar year, per 45 CFR 160.404.
Notable OCR Settlements for SRA Failures
OCR has settled cases against organizations of all sizes for failing to conduct an adequate risk analysis. This includes solo practitioners and large health systems. The following enforcement actions show the range of exposure:
OIG Findings and Breach Notification Exposure
The HHS Office of Inspector General (OIG) has also found missing or incomplete risk assessments across healthcare. Breach notification rules under 45 CFR §§164.400–414 add more exposure when an SRA gap helps cause a reportable incident.
Authoritative Guidance References
The following federal resources define the methodology and documentation standards OCR applies when evaluating SRA compliance:
- OCR Guidance on Risk Analysis: HHS guidance on SRA scope and method.
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
- NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule.
- HHS/ONC Security Risk Assessment Tool: Free SRA tool for small and medium healthcare organizations.
From Policy on Paper to Closed Findings
A multi-location outpatient group thought their HIPAA program was in good shape. During due diligence with a larger referral partner, they were asked for a current SRA and remediation evidence. Their existing assessment was too high-level and didn't reflect a cloud migration or new remote workflows.
Inconsistent role-based access reviews, weak deprovisioning speed for departing users, and incomplete vendor due diligence for one integration path handling ePHI. No consistent process for documenting security exceptions and control compensations.
Full risk inventory, scored findings, and a 90-day remediation plan. Passed partner diligence. Gained a repeatable internal process for reassessing risk after operational changes, shifting from reactive compliance to predictable risk governance.
About the Consultant
Chuck Weiselberg is the founder of One Guy Consulting and has been consulting since 2015. On the Full-Scope plan, he guides you through answering the audit.
“One Guy Consulting is super easy to work with. I actually look forward to my implementation meetings for HIPAA.”
Samantha M.
Chuck Weiselberg. Zero client fines. Zero failed audits.
Want to see how it works?
SRA Considerations by Specialty
We tailor findings and the remediation plan to your practice type so the work is realistic and measurable, not copied from a generic template.
Dental Practices
Shared operatory workflows, imaging systems, and front-desk crossover access patterns.
Dental guide → BehavioralBehavioral Health
Documentation sensitivity, session privacy controls, and communication channel governance.
Behavioral health guide →Medical Practices
Multi-role access management and EHR workflow segmentation across care teams.
Pharmacies
System integration controls, dispensing-related access paths, and vendor control assurances.
Business Associates
Client-mandated evidence standards, subcontractor governance, and response SLAs.
BA guide →What Your Practice Needs to Provide
We guide you through gathering these inputs during the scoping phase. Most small practices can assemble everything within weeks, not months.
- Systems and devices inventory: every system, device, and software application that stores, transmits, or accesses ePHI (EHR, practice management software, email, cloud storage, mobile devices, fax machines, printers)
- Physical locations: all sites where ePHI is accessed or stored, including satellite offices, remote worker locations, and off-site storage
- Workforce roster with access levels: current staff list showing each person's role, which systems they access, and their level of access to ePHI
- Vendor and business associate inventory: all third parties who create, receive, maintain, or transmit ePHI on your behalf, including IT providers, billing companies, cloud vendors, shredding services, and answering services
- Existing compliance documentation: any current HIPAA policies, procedures, prior risk assessments, training records, BAAs, or incident reports you already have (even if incomplete or outdated)
- Network and data flow information: how systems connect and share data, including network diagrams if available, or a description of how patient data moves through your workflows
- Known incidents: any security incidents, breaches, near-misses, or patient complaints from the past 12 months, whether reported or not
Documentation, Retention, and Reassessment
At minimum: annually. OCR does not mandate a single fixed interval, but its enforcement guidance and corrective action plans consistently require annual review. Under 45 CFR 164.308(a)(1)(ii)(A), the risk analysis must remain current and accurate. A single point-in-time assessment does not satisfy the ongoing obligation.
Beyond the annual cycle, reassess whenever significant changes occur in your environment:
One Guy Consulting structures every SRA engagement to produce documentation that supports annual reassessment, not just a one-time report.
Data Breach Risk Calculator
Answer eight questions about your current security controls and get an instant risk score. Takes under two minutes. No email required.
This calculator provides an estimate for educational purposes only. A comprehensive Security Risk Assessment involves detailed analysis of your specific environment, workflows, and threat landscape. Scores are not a substitute for a formal HIPAA Security Risk Analysis.
The SRA is included in Full-Scope.
One plan, three ways to pay. No per-user fees. Every client gets 4 hours a month of 1:1 implementation calls with Chuck.
- The full platform: SRA, gap analysis, remediation plans
- Policy templates and staff training
- Vendor and BAA management
- 4 hours a month of 1:1 implementation calls with Chuck
- Incident response guidance
- CMS audit response support
One payment, two full years of coverage.
Flat rate per location.
Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.
Frequently Asked Questions
What do I do if my small clinic still does not have a HIPAA risk assessment or written policies?+
What inputs does a small practice need to provide for a Security Risk Assessment?+
What is the difference between an SRA and vulnerability scanning?+
How often should we perform an SRA?+
Can this include remediation execution support?+
How detailed is the final report?+
Does a software tool alone satisfy the SRA requirement?+
Can a business associate use this service too?+
What is a HIPAA security risk analysis for FQHCs?+
What does HIPAA security consulting include?+
Begin Your Security Risk Assessment
An introductory call covers scoping, expected timeline, and which plan fits your organization's size and complexity.
Deep-Dive Resources
These articles explain SRA scope, process, timing, and next steps:
Explore our other HIPAA services
Questions About Risk Assessments?
Tell us about your situation or question.
Or email us at hello@oneguyconsulting.com
Book Your Free 30-Minute Intro Call