Introduction
Policies say one thing. Configurations say another. Vendors handle ePHI under agreements nobody can find, and access lists drift from reality.
Many healthcare organizations struggle to tell whether their HIPAA controls work in practice.
A HIPAA gap analysis compares your current safeguards and evidence against the requirements that apply to you. It is useful, but it is not the enterprise-wide risk analysis the Security Rule requires.
Enforcement shows why this matters. OCR's April 2026 announcement marked 13 completed investigations in its Risk Analysis Initiative.
This guide covers what a gap analysis is, how it works step by step, and how to turn findings into action.
Key Takeaways
- A gap analysis finds missing, incomplete, or undocumented safeguards.
- It complements the Security Rule risk analysis and never replaces it.
- Coverage spans Security, Privacy, and Breach Notification obligations plus vendors.
- Findings need owners, validation evidence, and reassessment after major changes.
What Is a HIPAA Gap Analysis and Assessment?
What a HIPAA Gap Analysis Is
A gap analysis is a structured comparison between your current privacy and security controls and the HIPAA requirements that apply to your operations, systems, workforce, and vendors. HIPAA does not define a standalone requirement by that name. It is a working label for a practical exercise.
Each control should land in one status:
- Implemented
- Partially implemented
- Missing
- Unsupported by evidence
- Inconsistent with actual practice
How It Differs From a HIPAA Risk Analysis
A gap analysis asks whether safeguards are in place. A risk analysis evaluates threats, vulnerabilities, likelihood, and impact to the confidentiality, integrity, and availability of ePHI. Under 45 CFR 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an "accurate and thorough assessment" of those risks.
A checklist cannot substitute for that analysis. The two should inform each other: gap findings point to weak controls the risk analysis should weigh, and risk results help rank which gaps to fix first. Section 164.308(a)(8) also requires a separate periodic evaluation of whether your policies and procedures meet the Security Rule.
Who and What the Assessment Covers
Both covered entities and business associates fall under the Security Rule. HHS says all ePHI an organization creates, receives, maintains, or transmits is in scope. That reaches connected systems, facilities, workforce members, subcontractors, and vendors.
The Security Rule covers administrative, physical, and technical safeguards. A complete HIPAA assessment also reviews Privacy Rule and Breach Notification Rule obligations.
Understanding Required and Addressable Specifications
"Addressable" does not mean optional. Under 45 CFR 164.306(d), you must assess whether the safeguard is reasonable and appropriate. If it is, implement it. If not, document why and implement an equivalent alternative where reasonable.
Required documentation must be kept for six years from creation or last effective date, whichever is later (45 CFR 164.316). HHS proposed Security Rule changes in a January 2025 NPRM, but the current rule remains in effect. Check the status before relying on any proposed requirement.
When to Perform a HIPAA Gap Analysis
Establish a baseline, then reassess periodically and after material change. Triggers include:
- Cloud migrations or new applications
- New vendors, mergers, or ownership changes
- Security incidents
- Major workforce or key management turnover
HHS does not prescribe a fixed interval for risk analysis and describes it as ongoing. An annual review works as an operating cadence, but it should never be the only trigger.
Why HIPAA Gap Analysis Is Critical for Healthcare Organizations
Visibility into control weaknesses supports patient data protection, operational resilience, audit readiness, and smarter security spending.
Policy versus reality. A policy may require encryption while laptops, backups, or cloud storage stay inconsistently protected. A gap assessment surfaces that difference before an incident or auditor does.
Better budget decisions. Prioritized findings let leadership direct money and engineering time toward the weaknesses that could most seriously affect ePHI, patient care, or operations.
Audit readiness. A documented assessment and remediation plan identifies the evidence you need to show controls are designed, implemented, operating, and reviewed.
Common Gaps to Investigate
- Incomplete or outdated risk analysis
- Excessive access or accounts for terminated users
- Weak authentication
- Insufficient audit-log review
- Missing business associate agreements
- Outdated policies
- Untested contingency plans
- Inadequate workforce training
- Incomplete incident response
What Enforcement Shows
The first gap on that list is the one OCR cites most. In a February 2026 resolution, Top of the World Ranch Treatment Center paid $103,000 after OCR found it failed to conduct an accurate and thorough risk analysis, and it accepted a two-year corrective action plan. Those gaps show up at scale. HHS reported 663 breaches affecting 500 or more individuals in 2024, touching roughly 242.9 million people.
How a HIPAA Gap Analysis Works – Step by Step
The process runs from scope to evidence review, control mapping, risk-informed prioritization, remediation, and validation. A completed questionnaire is not the finish line.
Common mistakes to avoid:
- Overlooking third-party systems
- Treating policies as proof that controls operate
- Treating addressable specifications as optional
- Failing to document decisions
- Closing findings without retesting
Step 1 – Define the Objective and Scope
State the purpose, the applicable HIPAA rules, and your role as covered entity or business associate. Include in scope:
- ePHI data flows
- Systems, applications, and devices
- Facilities and workforce members
- Vendors and subcontractors
Also record what is excluded and why. Leadership should know whether the result is a Security Rule review, a broader HIPAA assessment, or a targeted review of one system or process.
Step 2 – Gather Policies, Records, and Technical Evidence
Collect:
- Policies, procedures, and prior risk analyses
- Asset inventories and data-flow diagrams
- Access lists and training records
- Incident records and BAAs
- Contingency-test results and vulnerability findings
- Configuration evidence and audit-log review records
Check each item's age, ownership, completeness, and relevance. A document does not prove the control behind it is operating. OCR's audit protocol asks for exactly this kind of evidence, including documents identifying business associates and their agreements.
Step 3 – Organize and Map the Requirements
Build a control matrix mapping each applicable requirement to the current control, owner, evidence, status, and required or addressable designation. Use a consistent status set:
- Implemented
- Partially implemented
- Not implemented
- Not applicable, with documented rationale
- Unable to validate
Step 4 – Apply the Assessment and Validate Controls
Combine document review, interviews, process walkthroughs, configuration checks, access reviews, vendor reviews, and technical testing to confirm controls work as described.
Validate high-impact safeguards in particular:
- Unique user identification and least-privilege access
- Authentication and encryption
- Audit controls and transmission security
- Media disposal and incident response
- Backup and emergency operations
Step 5 – Interpret Findings and Prioritize Risk
Rank findings with one consistent method. Weigh impact to ePHI, likelihood of exploitation, affected systems or populations, existing safeguards, residual risk, remediation effort, and results from your broader risk analysis.
Every finding should state:
- The condition and applicable requirement
- Evidence reviewed
- Business or patient-care impact
- Recommended action
- Owner and target completion date
Step 6 – Remediate, Retest, and Review
Turn findings into a plan with owners, milestones, resources, dependencies, and evidence requirements. Then retest to confirm the fix works in practice.
Keep the process alive. Update documentation and reassess after significant changes, so the report doesn't become a static annual file.
Example Case Walkthrough
Consider a generic regional healthcare organization. This is an illustration, not a real client.
- Scope: A Security Rule and BAA review of ePHI vendors and access controls.
- Evidence review: The team finds a billing vendor handling ePHI without a fully executed BAA, and access reviews with inconsistent records.
- Control mapping: Both issues map to business associate and access requirements, marked not implemented and partially implemented.
- Prioritization: The missing BAA ranks first because ePHI is already flowing without the required agreement.
- Remediation: Compliance owns the vendor correction. IT owns access revalidation.
- Evidence: The organization executes the agreement, completes and documents a validated access review, and records the decision.
The result is measurable management action: a completed agreement, a validated review, and a scheduled follow-up assessment.
How DeepSeas Can Help
DeepSeas is a practitioner-led cybersecurity and governance, risk, and compliance partner. It helps regulated organizations find gaps, prioritize remediation, and strengthen audit readiness while aligning security with business goals.
Relevant support includes:
- HIPAA-focused gap assessments
- Risk and control mapping
- Evidence collection and review
- Remediation planning sequenced by requirement and implementation time
- Technical validation and ongoing guidance fitted to your existing tools
The team brings approximately 30 years of cyber defense experience, specialists with HIPAA and HITRUST expertise, and ISO Lead Auditor-certified personnel. Those services can be combined to match each organization's environment and priorities.
DeepSeas GRC also connects with security operations and managed detection and response, so findings can link to advisory, offensive security, and threat intelligence within its six-layer defense stack.
Practical outcomes include fewer surprises, shorter audit cycles, clearer accountability, and measurable progress. No provider can promise certification or guaranteed audit results, and DeepSeas doesn't.
Conclusion
A HIPAA gap analysis shows the distance between regulatory expectations, written policies, implemented safeguards, and daily operations.
The strongest programs pair it with a comprehensive risk analysis, prioritized remediation, evidence-based validation, and reassessment whenever the ePHI environment changes.
Frequently Asked Questions
Can you give me an example of a risk assessment?
An organization identifies ransomware as a threat to a backup server with unpatched software. It rates likelihood and impact, accounts for existing safeguards such as segmentation, and records the residual risk. A gap analysis instead asks whether a required control exists.
What is a HIPAA gap analysis?
It compares current safeguards and evidence with applicable HIPAA requirements. The goal is to identify missing, incomplete, or undocumented controls.
Is a HIPAA gap analysis required by HIPAA?
No. HIPAA requires a comprehensive Security Rule risk analysis and periodic evaluation, not a standalone "gap analysis." Organizations still use one as a practical way to find and fix compliance shortfalls.
How is a HIPAA gap analysis different from a HIPAA risk assessment?
A gap analysis checks whether controls meet applicable requirements. A risk assessment analyzes threats, vulnerabilities, likelihood, and impact. Neither automatically replaces the other.
What areas does a HIPAA gap assessment cover?
Administrative, physical, and technical safeguards, ePHI systems and data flows, Privacy Rule and Breach Notification obligations, workforce practices, documentation, vendors, BAAs, and subcontractors where applicable.
How often should a HIPAA gap analysis be performed?
Set a baseline, review periodically, and reassess after material changes to systems, vendors, operations, workforce, or threats. HHS prescribes no fixed interval, so confirm current guidance.
