A HIPAA security risk analysis is the required, documented assessment of risks and vulnerabilities to the confidentiality, integrity and availability of all electronic protected health information (ePHI) you create, receive, maintain or transmit (45 CFR 164.308(a)(1)(ii)(A)). It must cover every system that touches ePHI, rate each risk by likelihood and impact, and feed a risk management plan you actually carry out. Missing or incomplete risk analyses are among the most common findings in HHS Office for Civil Rights (OCR) enforcement.
General guidance, not legal advice. HHS proposed significant updates to the HIPAA Security Rule in January 2025. Check the current status of the rule before relying on specific requirements.
Why it matters now
OCR has run a Risk Analysis Initiative focused specifically on this requirement, announcing a series of settlements in which the core failure was not conducting an accurate and thorough risk analysis. A risk analysis is also the foundation of everything else: you can't justify safeguards you haven't linked to risks. See also why HIPAA compliance alone isn't cybersecurity.
The 7 steps
1. Define the scope: every place ePHI lives
EHR and practice-management systems, imaging, billing, email, file shares, cloud storage, laptops and phones, backups, medical devices, and business associates' systems. Missing systems is the most common failure.
2. Gather data and map flows
Document how ePHI enters, moves, is stored and leaves, including integrations, exports and personal devices.
3. Identify threats and vulnerabilities
Ransomware, phishing, lost devices, insider misuse, misconfigured cloud storage, unpatched systems, vendor compromise, power and facility failures. Use technical evidence (vulnerability scans, configuration reviews, penetration tests) as well as interviews.
4. Assess current controls
For each threat, record what protects you today (MFA, EDR, encryption, backups, access reviews, training) and how well it works.
5. Rate likelihood and impact
Use a consistent scale (e.g. 1โ5 ร 1โ5) and record your reasoning. Regulators look for a method, not just a colour-coded chart.
6. Determine and document the risk level
Produce a risk register: asset, threat, vulnerability, existing controls, likelihood, impact, risk rating, owner.
7. Act on it and keep it current
Turn high risks into a risk management plan with owners and dates. Review the analysis at least annually and whenever something significant changes: a new EHR, a merger, a cloud migration, or an incident.
What a defensible SRA document contains
- Scope statement and system inventory
- Methodology (scales, definitions, who participated)
- Risk register with ratings and rationale
- Risk management plan with remediation dates
- Evidence of review and approval by leadership
- Version history showing it's maintained
Common mistakes
- Using a generic checklist and calling it a risk analysis.
- Leaving out business associates, cloud apps or medical devices.
- Finding risks but never remediating them.
- Doing it once and never updating it.
Example risk register entries
| Asset | Threat / vulnerability | Existing controls | L ร I | Rating | Action |
|---|---|---|---|---|---|
| Microsoft 365 mailboxes | Phishing โ account takeover; MFA not enforced for 12 users | Spam filtering | 4 ร 4 | High | Enforce MFA for all users in 14 days |
| Clinician laptops | Theft or loss; 3 devices unencrypted | MDM on most devices | 3 ร 4 | High | Encrypt all; enforce via MDM policy |
| EHR (cloud) | Excess user privileges after role changes | Role-based access | 3 ร 3 | Medium | Quarterly access review |
| Backups | Ransomware encrypting backups on the same network | Nightly backups | 3 ร 5 | High | Immutable off-site copy; restore test |
Illustrative entries. Your register should reflect your actual systems and evidence.
Risk analysis and risk management: the HIPAA pair
HIPAA pairs the risk analysis (finding and rating risks) with risk management (implementing security measures to reduce them to a reasonable and appropriate level). OCR looks for both: a thorough analysis and proof you acted on it. A remediation plan with dates, owners and completion evidence turns an analysis into compliance.
Who should be involved
- A security lead or vCISO to run the method and own the register
- IT or your managed provider for the technical evidence
- Clinical and operations leaders, who know where ePHI actually flows
- Compliance or privacy officer, and leadership to accept the residual risk
Frequently Asked Questions
How often is a HIPAA risk analysis required?
The Security Rule requires it to be accurate and thorough, and updated as needed. Annual review, plus review after significant changes, is standard practice.
Is the HHS SRA Tool enough?
The free HHS Security Risk Assessment Tool can help small practices structure the work, but it doesn't replace technical testing or a complete inventory.
Is a HIPAA risk analysis the same as a risk assessment?
The terms are often used interchangeably. HIPAA's text says "risk analysis", followed by "risk management" to reduce the risks found.
Do business associates need a risk analysis?
Yes. Business associates that handle ePHI are directly subject to the Security Rule, including the risk analysis requirement.
Need a HIPAA risk analysis that holds up? Defensible performs HIPAA security risk analyses, builds the remediation plan and provides vCISO oversight for healthcare providers and health-tech companies. Talk to a Healthcare Security Expert.
