Introduction
Many healthcare organizations struggle to confirm they can protect electronic protected health information (ePHI) from reasonably anticipated threats. A HIPAA security risk assessment answers that question and shapes where your limited security budget goes.
Regulators are watching this requirement closely. On April 23, 2026, HHS announced four ransomware settlements, each tied to a deficient risk analysis.
OCR states that implementing the Security Rule before a breach or investigation is required by law. That step offers the best chance to prevent or reduce the harm of a cyberattack.
This guide covers what the assessment is, how to run one, and how a realistic scenario plays out.
Key Takeaways
- A risk assessment documents threats to ePHI, weighs likelihood and impact, and ranks fixes.
- The Security Rule requires an accurate and thorough analysis from covered entities and business associates.
- Strong reviews span all three safeguard types, plus vendors, cloud, devices, and data flows.
- Checklists and tools organize evidence. They don't replace judgment or remediation.
What Is HIPAA Security Risk Assessment and Analysis, and Why Is It Critical?
A HIPAA security risk assessment and analysis identifies risks to the confidentiality, integrity, and availability of ePHI that your organization creates, receives, maintains, or transmits. It applies to covered entities (health plans, clearinghouses, and providers) and to business associates, including qualifying subcontractors.
What the Regulation Requires
Under 45 CFR 164.308(a)(1)(ii)(A), you must "conduct an accurate and thorough assessment of the potential risks and vulnerabilities" to ePHI. Section 164.308(a)(1)(ii)(B) separately requires risk management: security measures sufficient to reduce those risks to a reasonable and appropriate level.
Section 164.306 sets the general rules, including protection against reasonably anticipated threats.
Assessment and analysis are often used interchangeably, and the regulatory sources don't define separate procedures for them. In practice, think of the assessment as scoping and identifying risks, and the analysis as evaluating likelihood, impact, and priority.
The assessment should cover:
- Applications, endpoints, and cloud environments
- Remote work and mobile devices
- Physical records and facilities
- Workforce members
- Business associates, subcontractors, and external data exchanges
- Administrative, physical, and technical safeguards
Why It Matters Beyond Compliance
- Audit readiness: you preserve evidence of scope, findings, decisions, and remediation.
- Budget focus: leaders direct scarce staff and money at the highest-impact risks.
- Resilience: findings feed access management, incident response, backup, disaster recovery, and continuity planning.
What It Is Not
It isn't a one-time certification or a generic internet template. Answering every checklist question doesn't prove compliance.
The HHS ONC/OCR Security Risk Assessment (SRA) Tool, currently version 3.7, can help, though it's aimed at small and medium providers. Its own disclaimer states that use of the tool "is neither required by nor guarantees compliance."
NIST SP 800-30 Rev. 1 guides risk assessment, and NIST SP 800-66 Rev. 2 maps Security Rule standards to NIST controls. Neither modifies HIPAA law.
How to Conduct a HIPAA Security Risk Assessment and Analysis
Treat this as an evidence-based workflow. Common failures include:
- Confining the review to IT
- Overlooking business associates
- Assigning risk scores nobody can explain
- Never confirming that fixes worked
OCR's guidance expects you to:
- Locate ePHI
- Document threats and vulnerabilities
- Record existing measures
- Estimate likelihood and impact
- Assign risk levels
- Document corrective actions
Define Scope and Assign Ownership
Set organizational boundaries: your covered entity or business associate status, facilities, systems, workforce groups, vendors, and ePHI repositories. Name one accountable owner from security, privacy, compliance, or the executive team. Write down your methodology before collecting findings.
Map ePHI Locations and Data Flows
Inventory where ePHI is created, received, stored, accessed, transmitted, backed up, printed, and destroyed. That includes EHRs, file shares, email, cloud platforms, mobile devices, remote access, interfaces, and business associates.
Validate the inventory through interviews, architecture documents, and system evidence. Assumptions miss shadow systems.
Identify Threats and Vulnerabilities
Pair each threat with a specific vulnerability and the evidence behind it. Examples:
- Phishing against staff with weak authentication
- Insider misuse enabled by excessive access
- Misconfigured or unsupported systems
- Lost or stolen devices
- Vendor failures
- Natural disasters and facility risks
Evaluate Safeguards and Analyze Risk
Review policies, training, access controls, encryption, audit logging, workstation security, facility controls, incident response, backups, and disaster recovery. Apply a documented likelihood-and-impact method. Show how existing controls move a risk from inherent to residual.
Prioritize Findings and Document the Plan
Keep a risk register with these fields:
- Affected ePHI or system
- Threat and vulnerability
- Risk rationale and priority
- Owner, corrective action, and target date
- Risk decision (mitigate, accept, or transfer)
- Supporting evidence
"Addressable" does not mean optional. Under 164.306(d), you must assess whether each addressable specification is reasonable and appropriate. If not, document why and implement an equivalent alternative measure where reasonable. Keep documentation for six years from creation or last effective date, whichever is later.
Implement, Validate, and Revisit
Turn findings into tracked tasks: policy or configuration changes, training, control testing, and management reporting. OCR sets no universal interval, and annual review is an example rather than a mandate. Reassess when any of these occur:
- New technology or business operations
- Security incidents
- Ownership changes
- Turnover in key staff or management
- Evolving threats
- Environmental changes that make existing measures insufficient
HIPAA Security Risk Assessment Example Case Walkthrough
Consider a regional home-health provider. A cloud scheduling application, a remote clinical workforce, and a third-party support vendor all touch ePHI. Reviewed system by system, each looks acceptable. Together, they hide a gap.
Scenario and Scope
The provider lists the ePHI involved (visit notes and patient demographics), the users and vendors with access, laptops and phones, and cloud and paper storage. The compliance director owns the assessment.
One mistake to avoid: accepting the cloud provider's security assurances as the analysis. HHS cloud guidance says customers must conduct their own risk analysis, and a cloud provider handling ePHI is a business associate that needs a signed business associate agreement.
Finding and Risk Analysis
The team documents this finding:
- Threat: credential theft through phishing
- Vulnerability: the vendor's support staff use shared logins with no multifactor authentication
- Existing safeguards: annual training, application audit logs that nobody reviews
- Impact: high, because support accounts can view full patient records
Using NIST SP 800-30's qualitative scale (Very Low to Very High), the team rates likelihood and impact on a matrix. In NIST's example matrix, high likelihood combined with high impact yields high risk. Residual risk stays high until the controls change.
| Likelihood | Impact | Resulting risk |
|---|---|---|
| High | High | High |
| Moderate | High | Moderate to high, depending on matrix |
| Low | Moderate | Low to moderate |
NIST describes these scales as exemplary and tailorable, so adapt them and document your choices.
Remediation and Validation
The provider assigns owners and dates:
- Review and remove unneeded vendor access.
- Require individual accounts with multifactor authentication.
- Collect written vendor documentation of its Security Rule controls.
- Train staff on phishing.
- Turn on and test log review.
Then it tests each control, records evidence, and updates the risk register. That register becomes the starting point for the next review.
How DeepSeas Can Help
DeepSeas is an expert-led complete cyber defense provider with close to 30 years of experience, serving nearly 1,000 organizations, including healthcare providers. It holds no government endorsement or formal HIPAA certification, yet its practitioners know the regulation well.
Its governance, risk, and compliance specialists support the full workflow:
- Scoping and stakeholder interviews
- Asset inventory development and ePHI and control review
- Threat and vulnerability analysis
- Risk prioritization and treatment planning (avoid, mitigate, transfer, or accept)
- Remediation planning, audit evidence, and board-ready reporting
The team brings HIPAA and HITRUST experience, including specialists with the ISC2 HCISPP credential and ISO Lead Auditor certifications. DeepSeas reports delivering assessment insight in days rather than the months traditional assessments take.
Findings only matter once fixed. DeepSeas can connect remediation to its broader stack: strategic advisory, offensive security, threat intelligence, managed detection and response, and CyberFusion SOC services. It can also work with the security tools you already run.
Conclusion
A sound assessment shows where ePHI is exposed, which safeguards work, which risks need action, and how leaders can demonstrate reasonable and appropriate security management.
Keep it alive. Review findings, validate remediation, and update your inventory after meaningful changes. If your team lacks capacity for an accurate and thorough analysis, bring in qualified expertise.
Frequently Asked Questions
Does HIPAA require a security risk assessment?
Yes. 45 CFR 164.308(a)(1)(ii)(A) requires covered entities and business associates to conduct an accurate and thorough assessment of risks and vulnerabilities to ePHI.
How often should HIPAA security risk assessments be conducted?
HIPAA sets no universal interval. Review and update regularly, and after significant changes, incidents, or newly identified risks.
What is a HIPAA security risk analysis?
It's the part of the process that evaluates threats, vulnerabilities, likelihood, impact, and existing safeguards. The results let you prioritize remediation.
What security measures does HIPAA require?
Administrative, physical, and technical safeguards. Required specifications must be implemented. Addressable ones must be evaluated and documented, not skipped automatically.
What is a HIPAA compliance checklist?
It organizes requirements, evidence, owners, and review status. It doesn't replace a tailored risk analysis, remediation plan, or documented management decisions.
What are the new HIPAA compliance requirements for 2026?
The Security Rule overhaul proposed in January 2025 (mandatory MFA, encryption, and a 72-hour restoration procedure, among others) remains pending as of HHS's latest materials, and the current rule stays in effect. Separately, 42 CFR Part 2 compliance became required February 16, 2026.
