HHS Security Risk Assessment Tool
Free Security Risk Assessment Tool from HHS for small and medium healthcare practices, available as a Windows application or an Excel workbook.
HHS SRA Tool and HIPAA at a glance
HHS SRA Tool helps organizations complete and document the HIPAA security risk analysis. It covers guided questionnaire covering assets, threats, vulnerabilities and safeguards, with a summary report; version 3.7 (September 2026) adds questions on assessment scope across all locations and on remote access and telework; available as a Windows application or an Excel workbook; all information entered is stored locally on your computer. Pricing: Free. Software guides the assessment, but the answers, decisions and follow-up are yours — no tool makes a risk analysis complete or compliant on its own. Facts checked against HHS (ASTP/ONC and OCR)'s own pages on 2026-10-06.
Choosing a tool is one part of HIPAA. See everything you need to have in place → · Managing several vendors? Free Vendor & BAA Register →
What it does for HIPAA
- Guided questionnaire covering assets, threats, vulnerabilities and safeguards, with a summary report. source
- Version 3.7 (September 2026) adds questions on assessment scope across all locations and on remote access and telework. source
- Available as a Windows application or an Excel workbook. source
- All information entered is stored locally on your computer. source
Pricing
Free.
Source: HealthIT.gov — Security Risk Assessment Tool · checked
Limitations
- HHS states that using the tool is neither required by nor guarantees compliance with federal, state or local laws. source
- Desktop software: no shared workspace, remediation tracking or support team. source
Against our criteria
| Risk assessment | Yes — Built for the Security Rule risk analysis. | HealthIT.gov — Security Risk Assessment Tool |
|---|---|---|
| HIPAA policies | No | HealthIT.gov — Security Risk Assessment Tool |
| Vendor and BAA tracking | Partial — Asks about vendors as part of the assessment; not a tracking tool. | HealthIT.gov — Security Risk Assessment Tool |
| Staff training included | No | HealthIT.gov — Security Risk Assessment Tool |
| Published pricing | Yes — Free. | HealthIT.gov — Security Risk Assessment Tool |