Yes, small clinics must do a security risk assessment too (45 CFR 164.308(a)(1)(ii)(A)). The rule covers every HIPAA covered entity and business associate, whatever its size. When the assessment finds gaps, rank them by risk. Give each one an owner and a deadline. Then put fixes in place, write everything down, and redo the assessment regularly.
How One Guy Consulting Helps Small Practices Close HIPAA Gaps
In January 2025, OCR (the Office for Civil Rights, the federal office that enforces HIPAA) settled with Elgon Information Systems for $80,000 after a ransomware attack. Elgon is a Massachusetts company that provides medical record and billing services to health care providers. The core problem OCR named: no thorough risk assessment.
In October 2024, an Oklahoma EMS provider paid $90,000 for the same gap. The EMS provider was a covered entity, which means a health care provider that HIPAA covers directly. Elgon was a business associate, which means a vendor that handles patient data for providers. Neither was large, and being small did not keep either one off OCR's radar.
If your small clinic still does not have a HIPAA risk assessment or written policies, you are not alone. Many small practices have never completed a formal security risk analysis. But the rule applies no matter how small your staff is. OCR announced its Risk Analysis Initiative in late 2024. It focuses enforcement on organizations that skipped this step.
This article answers two questions: do you actually need a risk assessment (yes), and what happens after it reveals the gaps you already suspect are there.
Yes, Your Clinic Needs a Security Risk Assessment
The requirement is unambiguous. 45 CFR 164.308(a)(1)(ii)(A) requires every covered entity and business associate to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). The Health Insurance Portability and Accountability Act does not exempt small practices. A two-provider dental office has the same obligation as a hospital system.
The scope should be proportional. A small clinic does not need a 200-page report. But it does need a documented risk assessment process that identifies where ePHI lives, what threats exist, what safeguards are in place, and where gaps remain. The process is about finding the risks to the patient data your practice holds. Without that baseline, every other compliance task (policies, training, vendor management) is built on guesswork rather than evidence.
Many small clinics that contact One Guy Consulting have never completed one. That is not shameful. It is the starting point.
What the Assessment Typically Finds
The gaps at small healthcare practices are predictable. After helping clinics, therapy practices, and specialty offices work through their assessments, we see the same findings again and again:
- No written HIPAA policies: the practice operates on informal rules that have never been documented. Without written policies, there is nothing to train against, nothing to audit against, and nothing to show a regulator.
- No Business Associate Agreements: vendors that handle PHI (EHR platforms, IT support, billing services, cloud storage) have no signed BAA. A BAA is a written contract in which the vendor promises to protect your patient data. Missing one is a violation by itself, under both the Privacy Rule and the Security Rule (45 CFR 164.502(e) and 164.308(b)).
- No training documentation: staff may have received verbal instructions at some point, but there are no records showing who was trained, when, and on what topics.
- No encryption on portable devices: laptops, tablets, and phones that access or store patient data are unencrypted. If one is lost, the law presumes it is a reportable breach. That holds unless you can show a low chance the data was compromised.
- No incident response plan: if a breach happens tomorrow, nobody knows who to call, what to document, or how to notify affected patients. The law says to notify them without unreasonable delay, and no later than 60 days after you discover the breach.
These are not edge cases. They are the standard starting position for a small practice that has been focused on patient care rather than regulatory compliance. The risk assessment makes them visible so they can be addressed in order of severity. For a broader look at what these gaps mean in enforcement terms, see our guide on what small clinics risk without a risk assessment or HIPAA policies.
The Remediation Lifecycle
Finding gaps is the easy part. What separates a functional compliance program from a binder collecting dust is what happens next. The remediation lifecycle has five stages, and each one requires action, not just awareness.
Step 1: Prioritize by level of risk. Each gap gets ranked by two factors: how likely the threat is and how much damage it would cause. A clinic with no encryption on laptops that leave the building faces a high-likelihood, high-impact risk. A missing policy document that covers an area your practice does not engage in is low on both scales. Critical items that create direct PHI exposure get fixed first.
This ranking is built for your own practice, not taken from a generic checklist.
Step 2: Assign owners and deadlines. Every gap needs a person responsible for closing it and a target date. In a small clinic, one person often owns most items, typically the office manager or practice administrator. That is fine. What matters is that the assignment exists and someone is accountable. A remediation plan without ownership is a wish list.
Step 3: Implement controls. This is where the actual work happens.
Written policies get drafted and distributed. Staff complete HIPAA training with documented completion records. BAAs get signed with every vendor that touches PHI. Technical fixes (encryption, access controls, audit logging) get set up. Each risk gets a matching safeguard.
Step 4: Document everything. Auditors want to trace a line from the finding to the fix. Save the dated SRA report, the prioritized remediation plan, updated policies, training records, and signed BAAs. Documentation is proof that the program is real and not just a one-time exercise. The Department of Health and Human Services (HHS) expects this security work to keep going. A one-time snapshot is not enough.
Step 5: Re-assess annually. The Security Rule requires periodic review. Your practice changes: new vendors, new staff, new technology, new state law requirements. The risk assessment is not a one-time event. Redoing it every year keeps the program current and catches new gaps before they become incidents.
Typical Timeline for a Small Clinic
With guided support, many small practices can move from no risk assessment to a documented compliance program in weeks, not months:
- First: Assessment: inventory ePHI, evaluate current controls, identify gaps, produce the SRA report.
- Next: Remediation planning: prioritize findings, assign owners, draft missing policies, initiate BAA collection.
- Then: Implementation: distribute policies, complete initial workforce training, deploy technical fixes, and write down how your practice handles PHI.
After that, the program shifts to maintenance mode: annual reassessment, periodic training refreshers, vendor reviews, and incident response drills.
FAQs
Can a small clinic do a security risk assessment without outside help?
Yes. HHS provides a free Security Risk Assessment Tool designed for small and medium-sized practices. The challenge is not the tool itself. It is knowing how to interpret findings, assign accurate risk levels, and build a remediation plan that actually gets executed. Many small practices benefit from an experienced consultant who can identify blind spots and keep the process on track, but the requirement can technically be met internally if someone on staff understands the Security Rule's administrative, physical, and technical safeguard requirements.
What if we cannot fix every gap right away?
You do not have to. The Security Rule does not require perfection on day one. What it does require is risk management. That means putting security measures in place that lower your risks to a reasonable and appropriate level (45 CFR 164.308(a)(1)(ii)(B)).
A written plan shows that this work is happening. It lists your findings in priority order, who owns each one, and realistic deadlines. A practice that has identified its gaps, prioritized them by risk level, and is actively working through remediation is in a fundamentally different position than one that has never assessed at all. Document the timeline, track your progress, and keep moving.
How does One Guy Consulting help business associates with risk assessments?
Business associates have the same risk assessment obligation as covered entities under the HIPAA Omnibus Rule. One Guy Consulting works with IT companies, billing services, cloud platforms, and other BAs to scope their assessment appropriately, focusing on the specific ePHI they create, receive, maintain, or transmit. The process is the same (assess, prioritize, remediate, document, re-assess) but the environment and threat profile differ. For a deeper look at BA-specific requirements, see our HIPAA risk assessment guide for business associates.
How often does the security risk assessment need to be updated?
The regulation requires periodic reassessment but does not specify an exact frequency. HIPAA does not set a schedule. HHS guidance says some organizations redo it every year and others redo it as needed, depending on their situation. You should also reassess after significant changes, such as new EHR systems, office moves, major staffing changes, security incidents, or new vendor relationships. The goal is to ensure the assessment reflects your current environment, not a snapshot from two years ago.
One Guy Consulting helps small healthcare practices and business associates conduct HIPAA security risk assessments and build practical remediation plans that close compliance gaps. Book a free 30-minute intro to talk through your situation and figure out where to start.
This content is for educational and informational purposes only and should not be construed as legal advice.
Sources
- 45 CFR 164.308: Administrative Safeguards (eCFR)
- HHS Guidance on Risk Analysis Requirements
- HHS OCR Resolution Agreements and Civil Money Penalties
- 45 CFR 160.103: Definitions (Covered Entity, Business Associate)
- HHS/ONC Security Risk Assessment Tool