HIPAA Security Risk Assessment: What It Is, Who Needs One, and What OCR Expects
Almost every HIPAA enforcement action involving a security failure points to the same gap: no accurate, thorough risk analysis. Here is what a Security Risk Assessment actually is, who needs one, and how to tell a real one from a checklist.
The short version: A HIPAA Security Risk Assessment (SRA) is the required analysis of risks to the confidentiality, integrity, and availability of the electronic protected health information (ePHI) your organization holds. Every covered entity and business associate must do one, and it must be kept current. This article is general information, not legal advice.
What the rule requires
The HIPAA Security Rule requires covered entities and business associates to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of ePHI (45 CFR 164.308(a)(1)(ii)(A)). It also requires you to implement security measures sufficient to reduce those risks to a reasonable and appropriate level. The risk analysis is the foundation: every other safeguard is supposed to be chosen in response to what it finds.
Who needs one
Every covered entity (health care providers who bill electronically, health plans, and clearinghouses) and every business associate that handles ePHI. Size does not exempt you: a solo dental or therapy practice has the same obligation as a hospital, scaled to its environment. Vendors that handle ePHI for you, such as billing companies, IT providers, and AI or automation vendors, have their own obligation as business associates.
What a real assessment includes
HHS guidance describes the elements. In practice a defensible SRA covers:
- Scope. All the places ePHI is created, received, stored, or transmitted: the EHR, email, laptops and phones, backups, cloud services, fax, texting tools, and vendors.
- Data flow. How ePHI moves between those places and who or what touches it.
- Threats and vulnerabilities. What could go wrong at each point, such as lost devices, phishing, misconfigured cloud storage, former staff with access, or a vendor breach.
- Current controls. What you already have in place: access controls, encryption, backups, training, policies, and logging.
- Likelihood and impact. How likely each risk is and how bad it would be, so you can rank them.
- Risk level and a plan. A documented rating for each risk and a remediation plan with owners and dates.
- Documentation. A written record. HIPAA requires you to keep required documentation for six years.
How often
The rule calls for ongoing risk management, and HHS guidance treats the analysis as something to review and update, not a one-time event. Update it when your environment changes: a new EHR, a move to the cloud, new vendors, a new location, or the addition of automation or AI tools that handle ePHI. Many organizations do a full review annually and update it whenever there is a significant change.
SRA, vulnerability scan, and penetration test are different things
This is the most common point of confusion, and it is why a clean scan report does not satisfy the requirement.
- Security Risk Assessment: an organization-wide analysis of risk across people, process, and technology. It produces a prioritized risk register and plan.
- Vulnerability scan: an automated check of systems for known technical weaknesses. It informs the SRA but covers only part of it.
- Penetration test: a simulated attack by a tester to see whether weaknesses can actually be exploited.
Scans and penetration tests are useful evidence. A proposed update to the Security Rule published in early 2025 would make some of these activities explicit requirements; check the current status of that rulemaking with your counsel. Either way, a scan alone is not a risk analysis.
What regulators look for
The HHS Office for Civil Rights has repeatedly cited the absence of an accurate and thorough risk analysis in its settlements and penalties, and has run an enforcement initiative focused on it. When OCR or an insurer asks for your risk analysis, they are generally looking for:
- A complete inventory of where ePHI lives, not just the main system.
- Evidence the analysis is specific to your organization, not a generic template with the name swapped in.
- Risks that are rated and tied to a remediation plan with real owners and dates.
- Proof that the plan is actually being worked and the analysis is kept up to date.
Free tools and when to bring in help
HHS and the Office of the National Coordinator publish a free Security Risk Assessment Tool aimed at small and medium practices. It is a reasonable starting point if you have someone with the time and expertise to complete it thoroughly. Many practices bring in outside help because the hard parts are knowing what to look for, rating risk consistently, and producing documentation that holds up. If you want a quick read on where you stand first, try our free HIPAA SRA readiness checker.
Why it matters more when you add AI or automation
New tools change where ePHI goes. A chatbot, an AI scribe, or an automated intake workflow adds vendors, data flows, and failure modes that your existing analysis does not cover. Update the assessment before you deploy, not after. Our HIPAA-compliant automation checklist and our guide to HIPAA obligations when your practice uses AI explain what to cover.
Where Truvaldi fits
We deliver fixed-price, written HIPAA Security Risk Assessments for small and mid-sized practices, led by a CISSP-certified practitioner, delivered as a document you can hand to an auditor or insurer. We do not provide legal advice, so have your compliance officer or counsel review how the findings apply to you.
Elija leads security and compliance strategy at Truvaldi. As a CISSP-certified practitioner, he architects HIPAA-aware AI systems for medical, aesthetics, and financial practices — and delivers the Security Risk Assessments that keep them audit-ready.
Frequently asked questions
What is a HIPAA Security Risk Assessment?
It is a required analysis of the risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information an organization holds. It identifies where ePHI lives, what threatens it, what controls exist, and what to fix first.
Is a HIPAA risk assessment required by law?
Yes. The Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to implement measures that reduce identified risks to a reasonable and appropriate level.
How often should a risk assessment be done?
The rule calls for ongoing risk management rather than a single event. A common practice is a full review at least annually, plus an update whenever your environment changes significantly, such as a new EHR, new vendors, or new AI tools.
Is a vulnerability scan the same as a risk assessment?
No. A scan is an automated technical check for known weaknesses and is one input to a risk assessment. The assessment covers people, processes, and technology across the whole organization and produces a prioritized remediation plan.
Can we do our own risk assessment?
Yes. HHS and ONC offer a free Security Risk Assessment Tool for small and medium practices. It works when someone has the time and expertise to complete it thoroughly and document the results. Many practices bring in outside help for consistency and defensible documentation.
What happens if we do not have one?
The absence of an accurate and thorough risk analysis is one of the most common findings in HHS Office for Civil Rights enforcement actions, and insurers increasingly ask for one. Beyond penalties, you cannot know which safeguards to prioritize without it.
Not sure where your practice stands?
We deliver written, fixed-price Security Risk Assessments led by a CISSP-certified practitioner.