HIPAA risk assessment

The rule itself is short: conduct “an accurate and thorough assessment of the potential risks and vulnerabilities” to the electronic PHI you hold, then implement measures that reduce them to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(A)–(B)). The security risk analysis page covers the requirement; this page is about doing it.

Step by step

HHS’s risk analysis guidance describes the elements an assessment should have. In practice, for a small practice or company:

1. Set the scope. Every place ePHI is created, received, stored or sent: EHR or practice management system, email, texting, telehealth, file storage, laptops and phones, backups, and vendors that hold data for you. Include remote work and home devices.
2. List the data and where it flows. For each system: what PHI, who has access, which vendor, whether there is a BAA.
3. Identify threats and vulnerabilities. Lost or stolen devices, phishing, ransomware, misdirected email, shared logins, former staff with access, a vendor breach, fire or flood.
4. Note your current safeguards. Encryption, access control, MFA, backups, training, logging.
5. Rate likelihood and impact of each threat with the current safeguards in place — a simple high/medium/low scale is fine.
6. Decide the risk level and which risks you will reduce first.
7. Write the risk management plan: what you’ll do, who owns it, by when. The plan is required too (164.308(a)(1)(ii)(B)).
8. Document and keep it for six years (164.316), and update it when things change.

What the finished document should contain

The rule requires an accurate and thorough analysis, risk management measures, and documentation kept for six years (164.308(a)(1), 164.316); it doesn’t prescribe a format. The structure below is our recommendation:

• The scope and date, and who did the assessment.
• An inventory of systems and vendors holding ePHI.
• Threats, vulnerabilities, current safeguards, likelihood, impact and risk level for each.
• The risk management plan with owners and dates.
• Evidence of follow-up: what was fixed and when.

OCR’s enforcement actions often cite a risk analysis that was missing, out of date or limited to part of the organization — for example, covering the EHR but not email or laptops.

How often

HIPAA sets no fixed frequency; the analysis must stay current. We recommend reviewing it every year and whenever you add a system or vendor, move offices, start remote work or have an incident. MIPS eligible clinicians who report the Promoting Interoperability category also attest to one each year — see HIPAA security risk assessment for MIPS. For the free HHS tool, see the HHS SRA Tool.