HIPAA Gap Analysis Services
Your business's HIPAA compliance plan begins with a security risk assessment (SRA). Gap analysis follows the SRA. It shows what needs fixing. Your SRA results help find gaps and build a clear remediation plan.
Driven by 45 CFR 164.308(a)(1)(ii)(B)
What Is HIPAA Gap Analysis?
Definition
A HIPAA gap analysis is a systematic comparison of a business's existing safeguards against the requirements of the HIPAA Security Rule (45 CFR Part 164, Subpart C) and Privacy Rule (45 CFR Part 164, Subpart E). It identifies where current controls fall short of regulatory standards and produces a prioritized list of findings for remediation.
Regulatory Basis
The requirement to "implement security measures sufficient to reduce risks and vulnerabilities" (45 CFR Section 164.308(a)(1)(ii)(B)) creates the practical need for a gap analysis. While HIPAA does not use the term "gap analysis" in the regulation, the process is the standard method for identifying where controls do not meet the Security Rule's administrative, physical, and technical safeguard requirements.
What It Finds
- Controls that exist on paper but are not followed in practice
- Required safeguards that have no records (see the full list of required HIPAA written policies)
- Outdated policies that no longer reflect current systems or workflows
- Missing incident response procedures or untested contingency plans
- Vendor relationships without executed BAAs or access controls
A gap analysis shows what is strong, what is incomplete, and what creates the most risk if left unresolved. For a deeper look at the process and what to expect, see the complete HIPAA gap analysis guide.
Who Needs This
Any business that creates, receives, maintains, or transmits PHI may need a gap analysis. This is particularly important if controls have not been evaluated in the past 12 months. Common scenarios include:
- Growing practices adding locations, staff, or systems faster than controls can keep up.
- Organizations with recurring findings that keep seeing the same gaps return in successive assessments.
- Business associates that need compliance evidence before onboarding larger covered entity clients.
Gap Analysis vs. Security Risk Assessment
A Security Risk Assessment (SRA) and a gap analysis serve different purposes:
- SRA identifies threats and vulnerabilities to ePHI and evaluates the likelihood and impact of each risk. It is required under 45 CFR 164.308(a)(1)(ii)(A).
- Gap analysis compares existing controls against the full set of HIPAA regulatory requirements and identifies where the business does not meet the standard.
In practice, the SRA often runs first. Its findings feed directly into the gap analysis, which then produces the remediation plan. Together they make up step 2 of the eight-step HIPAA compliance process.
From SRA to Gap Analysis
A HIPAA gap analysis follows five steps. Each step has defined inputs and outputs to keep the process structured and auditable.
- 01
Complete a Security Risk Assessment (SRA)
Start with a documented Security Risk Assessment.
InputCurrent system inventory, workforce roster, vendor list, existing policies.OutputRisk register documenting identified threats, vulnerabilities, likelihood, and impact for each ePHI asset. - 02
Map current controls to HIPAA requirements
Record what you already have in place for each requirement.
InputSRA results, existing policies and procedures, evidence artifacts.OutputControl matrix showing which HIPAA safeguards (administrative, physical, technical) are met, partially met, or unmet. - 03
Identify and categorize gaps
Classify every finding so it can be ranked.
InputControl matrix, interview notes, evidence review findings.OutputGap register with each finding classified by safeguard type, severity (critical, high, medium, low), and affected CFR section. - 04
Build a risk-ranked remediation plan
Turn the gap register into a remediation plan.
InputGap register with severity classifications.OutputPrioritized remediation roadmap with assigned owners, due dates, evidence targets, and estimated effort for each finding. - 05
Track progress and maintain compliance
Keep the program from drifting after cleanup.
InputRemediation plan, monthly progress data.OutputCompliance dashboard showing fix rate, evidence completion status, and schedule for annual or trigger-based follow-up reviews.
For One Guy Consulting clients, steps 2 through 4 are not done by hand. The platform maps your SRA answers to HIPAA requirements using policy-mapping checks built on current best practice. Your gap register and remediation plan are generated automatically the moment your assessment is complete. See how the gap analysis and remediation plan work together as one deliverable.
The SRA and gap analysis are complementary processes. The SRA identifies risks to ePHI. The gap analysis measures how well the business's controls address those risks relative to HIPAA's regulatory requirements.
Gap Distribution & Maturity Benchmarks
Common gaps we see before a structured review. Your results will match your own setup.
Gap Distribution by Category
Where most businesses have incomplete controls
- Policy Gaps28%
- Process Gaps24%
- Evidence Gaps22%
- Training Gaps16%
- Vendor Gaps10%
Maturity Assessment Dimensions
Average maturity score by area (0-100)
Gap Closure: Before vs. After
Typical compliance posture improvement post-engagement
Typical 6-month post-engagement result
Key HIPAA Standards Evaluated in a Gap Analysis
A HIPAA gap analysis evaluates a business's controls against three safeguard categories defined in 45 CFR Part 164, Subpart C. These categories represent the regulatory framework OCR uses during audits and enforcement actions.
Administrative Safeguards
Security management, workforce security, access management, training, incident response, contingency planning, and evaluation. These account for the largest share of HIPAA requirements and include both required and addressable implementation specifications.
Physical Safeguards
Facility access controls, workstation use, workstation security, and device and media controls. Gap analysis evaluates whether physical access to ePHI systems is restricted, monitored, and documented with disposal and reuse procedures.
Technical Safeguards
Access controls, audit controls, integrity controls, person or entity authentication, and transmission security. These standards require that electronic access to ePHI is controlled, logged, and protected during transmission.
Want to see how it works?
Gap Patterns by Healthcare Specialty
Gap patterns change by specialty. Good findings and fix plans reflect how your type of practice works.
Medical Practices
Many job roles, referral links, and systems tied together front to back.
Medical guide → BehavioralBehavioral Health
Sensitive records and strict rules for how staff share information.
Behavioral health guide → DentalDental Practices
X-ray system access, shared screens, and keeping job roles separate.
Dental guide → PharmacyPharmacies
Drug system access and locking down systems with many outside links.
Pharmacy guide → BABusiness Associates
Proof standards set by contracts and clients who expect fast fixes.
BA guide →Telehealth Providers
Platform logins, consent steps, and keeping records of remote sessions.
Gap analysis is included in both plans.
Two plans, six ways to pay. No per-user fees. Pick the level of help you want from Chuck.
- The platform on its own, no consulting time
- SRA, gap analysis, remediation plans
- Policy templates and staff training
- Vendor and BAA management
- Everything in Self-Guided
- 4 hours a month of 1:1 implementation calls with Chuck
- Incident response guidance
- CMS audit response support
One payment, two full years of coverage.
Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.
What Makes a HIPAA Gap Analysis Effective
Findings Must Be Actionable
HHS guidance on risk analysis states that businesses should document current security measures and identify where they fall short. An effective gap analysis produces findings that can be directly converted into remediation tasks. Each finding should specify:
- The affected HIPAA safeguard and CFR section
- The current state of the control
- The required state under the regulation
- An assigned owner, due date, and evidence target
Remediation often begins with updating HIPAA policies and procedures to reflect actual operations.
Gap Analysis Supports Compliance Budgeting
A structured gap analysis gives leaders clear data for budgeting. Instead of funding general compliance work, teams can fund specific fixes ranked by risk. This fits the HIPAA Security Rule's focus on addressable and required standards under §164.306(b).
Organizations that link remediation to measurable risk reduction and check progress quarterly are less likely to see the same findings repeat in future assessments. They are also less likely to face HIPAA violation penalties due to unresolved gaps.
Common Pitfalls in HIPAA Gap Analysis
Gap reviews fail for five reasons: generic checklists, no ranking, no owners, weak proof, and no follow-up schedule.
Generic checklists that do not reflect real workflows, vendors, or role duties.
Long issue lists without risk ranking.
Findings delivered without clear owners, authority, or deadlines.
Controls may exist, but proof is incomplete.
No review cadence to prevent drift after cleanup.
How to Track Progress After Gap Analysis
Monthly Metrics That Matter
Track fix rate and evidence quality. Measure the share of critical and high findings with assigned owners, approved due dates, and documented proof of completion.
Watch the Rework Rate
If teams reopen the same findings or deliver incomplete evidence, that usually signals unclear standards, missing manager follow-through, or inadequate HIPAA staff training.
Leadership Visibility
Keep a leadership view that shows trend direction, not just point-in-time status. Teams improve faster when leaders can see monthly progress.
Role-Based Reporting
Compliance, operations, and technical owners often move at different speeds. Role-based reporting gives each group the findings and progress data it needs.
Frequently Asked Questions
How is this different from a policy review?+
Can we start with one department first?+
Is post-analysis setup support available?+
What if we already had a recent assessment?+
How often should gap analysis be performed?+
Chuck Weiselberg, Certified HIPAA Professional (C.H.P.). Zero client fines. Zero failed audits.
“One Guy Consulting is super easy to work with. I actually look forward to my implementation meetings for HIPAA.”
Samantha M.
Ready to Identify and Close Your HIPAA Gaps?
A preliminary scoping call can help identify which HIPAA safeguard categories need the closest review based on your business's size, specialty, and current controls.
Deep-Dive Resources
The HIPAA Security Rule at §164.306(a) requires covered entities to protect electronic protected health information (ePHI). Gap analysis measures how well a business meets that standard. The HHS Office for Civil Rights often cites incomplete risk analysis and failure to manage risk in enforcement actions.
Use these guides to turn findings into real action plans:
- HHS.gov: Guidance on Risk Analysis Requirements under the HIPAA Security Rule
- 45 CFR Part 164, Subpart C: HIPAA Security Rule standards
- HHS.gov: Security Rule laws and regulations overview
Explore our other HIPAA services
Questions About Gap Analysis?
Tell us about your situation or question.
Or email us at hello@oneguyconsulting.com
Book Your Free 30-Minute Intro Call