A HIPAA security risk analysis guide for independent practices

HIPAA-covered entities, including small practices, must document an ongoing Security Rule risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information (e-PHI) they create, receive, maintain, or transmit. [2][4][5]

The scope includes e-PHI in every electronic form and location, including information handled by a practice’s systems and outside vendors. [2][4][5]

Risk analysis is the first step in Security Rule compliance. It helps a practice decide what safeguards and follow-up are needed; completing an analysis is not the whole compliance program. [2][5]

HHS’s Office for Civil Rights (OCR) links to the free Security Risk Assessment (SRA) Tool developed by the Office of the National Coordinator for Health IT (ONC) with OCR. The current resource offers a Windows application and an Excel workbook. [1][3][7]

The Windows tool uses a wizard with multiple-choice questions, threat and vulnerability assessments, and asset and vendor management. It provides references and guidance along the way, and reports that users can save and print. [1][3]

The SRA Tool v3.7 User Guide includes FAQs and installation help. ONC also provides webinar materials for Tool 3.7. HHS risk-analysis guidance points to NIST Special Publication 800-66 as a reference for sample questions. [3][7]

Treat the tool as a starting aid: ONC notes that the survey alone may not identify every risk in an organization. [1][3]

The sequence below describes one practical way to work through the tool. It is not a workflow mandated by HHS; the Security Rule allows methods to vary with an organization’s size, complexity, and capabilities. [1][3][4][5]

1. Identify the systems, devices, data stores, locations, and vendors that create, receive, maintain, or transmit e-PHI. [1][3][4]
2. Review the tool’s questions and consider threats and vulnerabilities in the context of the practice and its vendors. [1][3][4]
3. Evaluate current safeguards and document relevant findings, including the risks that need follow-up. [1][3][4][5]
4. Generate the report, then review it with the people responsible for security and decide how findings will be addressed. [1][3][6]

The Security Rule requires a documented risk analysis but does not require a particular format. HHS does not prescribe one analysis method, and the Security Rule does not itself define “threat,” “vulnerability,” or “risk.” [4][5]

As a practical recordkeeping recommendation—not a required format—retain the report, findings, remediation plans, and evidence that planned safeguards were implemented. These records help connect analysis to risk management and related Security Rule duties. [4][5][6]

Risk analysis is one part of a wider set of safeguards. The Security Rule also calls for a designated security official; appropriate authorization, supervision, and role-based workforce access; procedures to identify and respond to security incidents, mitigate harmful effects, and document incidents and outcomes; and periodic technical and non-technical evaluations. Business associate agreements must require reporting of security incidents, including breaches of unsecured PHI. [6]

HHS describes risk analysis as an ongoing process. It does not set a single review interval; analysis should continue as needed and account for relevant changes in technology, operations, or the practice environment. [2][4][5]

Planning estimate, not an HHS requirement: a practice might allow 4–8 weeks for an initial assessment with 1–2 staff members contributing part-time. A review at least annually and after significant changes is a practical recommendation, not a required HIPAA schedule. [2][4][5]