What a HIPAA risk analysis actually is
A risk analysis is a structured look at every place your practice creates, receives, stores or sends electronic protected health information, and at what could go wrong in each place. It is required by 45 CFR 164.308(a)(1)(ii)(A). It is not a checklist you download, and it is not the same as a vulnerability scan. A good one tells you which risks are real for your practice, how likely they are, how much harm they would cause and what you are going to do about them.
The rule does not tell you how often to repeat it. HHS guidance says to review it regularly and whenever your environment changes: a new EHR, a new location, a move to the cloud, a merger or a security incident. In practice, that means at least once a year for most practices.
Why it matters more than any other document
When OCR opens an investigation, whether after a breach, a patient complaint or a news story, it almost always asks for your risk analysis and your risk management plan. Since 2024 OCR has run a Risk Analysis Initiative focused on exactly this requirement, and its settlements with practices of every size repeat the same finding: no risk analysis, or one too narrow to count. An honest, current analysis is the single best piece of evidence that you took your obligations seriously.
What we look at
- Where ePHI lives: your EHR and practice management system, imaging and X-ray software, email, scanners, fax-to-email, patient portals, billing exports, spreadsheets on desktops and files in personal cloud accounts.
- Who can reach it: user accounts, shared logins, former staff who still have access, remote access tools and vendor accounts.
- How it is protected: passwords and multifactor authentication, encryption on laptops and mobile devices, patching, endpoint protection, firewall rules, Wi-Fi separation and email security.
- Whether you could recover: backups, how fast you could restore them and whether anyone has tested that.
- Your paperwork: policies, training records, business associate agreements, access reviews and incident procedures.
What you get
- A written risk analysis that follows the structure HHS describes in its guidance: scope, data flows, threats and vulnerabilities, current safeguards, likelihood, impact and a risk rating for each item.
- A risk management plan that lists each fix, who owns it and a target date. This satisfies the companion requirement at 164.308(a)(1)(ii)(B) to reduce risks to a reasonable level.
- A plain-English summary for the owner or physician partners, so decisions about budget and priority are easy to make.
- A gap list for your policies and procedures, mapped to the Security Rule's administrative, physical and technical safeguards.
- A fixed-price proposal to close the technical gaps, if you want us to do the work.
Ongoing compliance support
A risk analysis goes stale the day something changes. If you choose ongoing support, we keep the record current: an annual review, updates when you add a location or system, quarterly access reviews, security awareness training for staff with completion records, and help writing or updating policies. The Security Rule requires you to keep this documentation for six years, and we organize it so it's easy to hand over if OCR or a payer asks.
Business associate agreements
Because our team can access systems that hold patient data, we are your business associate under HIPAA. We sign a business associate agreement with every healthcare client before work starts. We also help you inventory your other vendors, such as your EHR host, billing company, answering service, shredding company and cloud backup provider, and check that each one has a current agreement on file.
How it runs
We start with a working session with your practice manager or compliance lead. We then collect configuration details from your systems (read-only, with your permission), walk the office to see workstations, the network closet and how staff work, and interview a few people. For most practices with one to three locations, the analysis is finished within a few weeks and ends with a walkthrough of the results in person.
Questions about hipaa risk analysis
Is the free risk assessment tool from HHS enough?
The HHS and ONC Security Risk Assessment Tool is a useful starting point, and some small practices use it well. It only works if the answers are accurate and the findings lead to fixes. Many practices fill it out once and never act on it. We can use it as a framework or build the analysis independently, whichever suits you.
How often should we redo the risk analysis?
HHS expects you to review it regularly and update it when your environment changes. For most practices that means a full review once a year, plus updates for new systems, new locations or any security incident.
