HIPAA Security Risk Assessment
Every healthcare practice that handles patient data must do a Security Risk Assessment (SRA). It is required under 45 CFR §164.308(a)(1)(ii)(A). The SRA finds threats to your electronic health records and forms the base of HIPAA Security Rule compliance.
SRA Deliverables
Records detailed enough for OCR review and practical enough for your team to use.
Documented Risk Analysis
Risk inventory mapped to your specific environment, not a generic template output. Our HIPAA risk assessment template guide explains the structure and documentation standards we follow.
Prioritized Remediation Roadmap
Clear owners, sequenced actions, and measurable outcomes tied to each finding.
Executive Summary
Leadership-ready briefing for compliance stakeholders, payers, and board review.
Implementation Guidance
Practical direction for converting each finding into a completed control improvement.
Audit Evidence Support
Framing and documentation structure designed for audit, contract, and due diligence use.
Part of both plans
The SRA comes with Self-Guided and Full-Scope. Full-Scope adds 4 hours a month of 1:1 implementation calls with Chuck.
Compare plans →
What Is a HIPAA Security Risk Assessment?
A HIPAA Security Risk Assessment (SRA) is a required analysis under 45 CFR §164.308(a)(1)(ii)(A). It identifies risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI).
The SRA is the most common problem found in OCR enforcement actions and HIPAA audits.
45 CFR 164.308 establishes the Administrative Safeguards of the HIPAA Security Rule. The risk analysis requirement at 164.308(a)(1)(ii)(A) is the first and most frequently cited standard in OCR enforcement.
Organizations that skip or shortcut their 45 CFR 164.308 compliance expose themselves to the highest penalty tiers and the most preventable audit failures.
What the HIPAA Security Rule Requires in a Risk Assessment
The HIPAA Security Rule (45 CFR Part 164, Subpart C) does not require one set SRA method. However, OCR's Guidance on Risk Analysis and its enforcement actions set clear expectations.
NIST SP 800-30 (Guide for Conducting Risk Assessments) and NIST SP 800-66 (Implementing the HIPAA Security Rule) offer accepted frameworks to meet this requirement. Key elements include:
- Scope. Identify all ePHI the organization creates, receives, keeps, or sends. Include data at rest and data in transit across systems, devices, and locations.
- Threat identification. Record expected threats to ePHI. Examples include natural disasters, human error, insider threats, malware, ransomware, and unauthorized access. Organizations that do not have a documented incident response and management program are more exposed when a threat occurs.
- Vulnerability assessment. Identify gaps in administrative safeguards (§164.308), physical safeguards (§164.310), and technical safeguards (§164.312). SRA work often finds weak physical safeguard controls and missing device and IT audit records.
- Likelihood and impact analysis. Rate how likely each threat is to exploit a gap. Then rate the impact on ePHI confidentiality, integrity, and availability.
- Risk rating. Assign risk levels to each threat and gap pair. Use those ratings to set remediation priority.
- Remediation plan. Record security steps that reduce risks to a reasonable and appropriate level under §164.306(b). OGC builds HIPAA remediation plans with phases, owners, and evidence checkpoints.
- Documentation. Keep the SRA and all supporting records for at least six years under §164.316(b)(2)(i).
Seven-Phase Methodology
Each phase includes practical checkpoints so the process does not drift into theory. Clear owners and target dates from the first week.
- 01
Scoping and Discovery
Confirm legal entity structure, service lines, locations, systems in scope, vendor dependencies, and where ePHI actually flows.
§164.308(a)(1)(ii)(A)NIST SP 800-30 §3.1OCR expectsIdentify all ePHI the organization creates, receives, maintains, or transmits. - 02
Data Flow and Asset Mapping
Document data entry points, repositories, integrations, endpoints, and admin pathways that affect confidentiality, integrity, and availability.
§164.312(e)(1)NIST SP 800-66 §4.1OCR expectsDocument data at rest and in transit across all systems, devices, and locations. - 03
Safeguard Review
Record your administrative, physical, and technical controls, and whether each one works in your environment. This phase often finds the same gaps as a HIPAA gap analysis.
- 04
Threat and Vulnerability Analysis
Evaluate realistic failure scenarios including access control failures, vendor issues, endpoint exposure, and process gaps.
§164.308(a)(1)(ii)(A)NIST SP 800-30 §§3.2–3.3OCR expectsIdentify expected threats and vulnerabilities to ePHI. - 05
Risk Scoring and Prioritization
Each finding is rated for likelihood and impact so leadership can see what must be addressed first, ranked, not listed.
§164.306(b)NIST SP 800-30 §3.4OCR expectsAssess likelihood and impact. Assign risk levels. - 06
Remediation Planning
Turn findings into a phased work plan. Include owners, effort, dependencies, and work order.
§164.308(a)(1)(ii)(B)NIST SP 800-30 §3.5OCR expectsDocument steps to reduce risks. - 07
Executive Readout
Deliver an audit-ready package and decision briefing so leaders can approve and fund the right next steps quickly.
§164.316(b)(2)(i)NIST SP 800-30 §3.6OCR expectsKeep all SRA records for at least six years. Share findings with leadership.
SRA Phase to Regulatory Crosswalk
Each phase of the SRA methodology links to specific HIPAA Security Rule provisions, OCR guidance, and NIST framework references. This mapping shows how each deliverable meets regulatory requirements.
| SRA Phase | HIPAA Security Rule (45 CFR) | NIST Reference | OCR Expectation |
|---|---|---|---|
| 1. Scoping & Discovery | §164.308(a)(1)(ii)(A) | SP 800-30 §3.1 | Identify all ePHI the organization creates, receives, maintains, or transmits. |
| 2. Data Flow & Asset Mapping | §164.312(e)(1) | SP 800-66 §4.1 | Document data at rest and in transit across all systems, devices, and locations. |
| 3. Safeguard Review | §164.308, §164.310, §164.312 | SP 800-66 §§4.2–4.4 | Evaluate safeguards against regulatory intent. |
| 4. Threat & Vulnerability Analysis | §164.308(a)(1)(ii)(A) | SP 800-30 §§3.2–3.3 | Identify expected threats and vulnerabilities to ePHI. |
| 5. Risk Scoring & Prioritization | §164.306(b) | SP 800-30 §3.4 | Assess likelihood and impact. Assign risk levels. |
| 6. Remediation Planning | §164.308(a)(1)(ii)(B) | SP 800-30 §3.5 | Document steps to reduce risks. |
| 7. Executive Readout | §164.316(b)(2)(i) | SP 800-30 §3.6 | Keep all SRA records for at least six years. Share findings with leadership. |
Who Must Conduct a HIPAA Security Risk Assessment
The HIPAA Security Rule applies broadly. The following organizations are required to conduct and document a Security Risk Assessment:
- All covered entities, regardless of size.
- Solo practitioners, group practices, hospitals, health plans, and clearinghouses.
- All business associates that create, receive, maintain, or transmit ePHI.
- Organizations that added new systems, telehealth workflows, or remote work setups that changed their ePHI exposure.
- Organizations preparing for OCR (Office for Civil Rights) reviews, payer credentialing, Mergers and Acquisitions due diligence, or contract security rules. Many pair this work with a HIPAA gap analysis.
OCR expects the SRA to be reviewed and updated at least annually or whenever significant changes occur in the organization's environment, operations, or technology.
SRA Enforcement and Penalties
Civil Monetary Penalties
Failure to conduct a Security Risk Assessment is the most frequently cited violation in OCR enforcement actions.
HIPAA civil monetary penalties range from $145 to $2,190,294 per violation per calendar year, per 45 CFR 160.404.
Notable OCR Settlements for SRA Failures
OCR has settled cases against organizations of all sizes for failing to conduct an adequate risk analysis. This includes solo practitioners and large health systems. The following enforcement actions show the range of exposure:
OIG Findings and Breach Notification Exposure
The HHS Office of Inspector General (OIG) has also found missing or incomplete risk assessments across healthcare. Breach notification rules under 45 CFR §§164.400–414 add more exposure when an SRA gap helps cause a reportable incident.
Authoritative Guidance References
The following federal resources define the methodology and documentation standards OCR applies when evaluating SRA compliance:
- OCR Guidance on Risk Analysis: HHS guidance on SRA scope and method.
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments.
- NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule.
- HHS/ONC Security Risk Assessment Tool: Free SRA tool for small and medium healthcare organizations.
From Policy on Paper to Closed Findings
A multi-location outpatient group thought their HIPAA program was in good shape. During due diligence with a larger referral partner, they were asked for a current SRA and remediation evidence. Their existing assessment was too high-level and didn't reflect a cloud migration or new remote workflows.
Inconsistent role-based access reviews, weak deprovisioning speed for departing users, and incomplete vendor due diligence for one integration path handling ePHI. No consistent process for documenting security exceptions and control compensations.
Full risk inventory, scored findings, and a 90-day remediation plan. Passed partner diligence. Gained a repeatable internal process for reassessing risk after operational changes, shifting from reactive compliance to predictable risk governance.
About the Consultant
Chuck Weiselberg, C.H.P. (Certified HIPAA Professional) is the founder of One Guy Consulting and has been consulting since 2015. On the Full-Scope plan, he guides you through answering the audit.
“One Guy Consulting is super easy to work with. I actually look forward to my implementation meetings for HIPAA.”
Samantha M.
Chuck Weiselberg, Certified HIPAA Professional (C.H.P.). Zero client fines. Zero failed audits.
Want to see how it works?
SRA Considerations by Specialty
We tailor findings and the remediation plan to your practice type so the work is realistic and measurable, not copied from a generic template.
Dental Practices
Shared operatory workflows, imaging systems, and front-desk crossover access patterns.
Dental guide → BehavioralBehavioral Health
Documentation sensitivity, session privacy controls, and communication channel governance.
Behavioral health guide →Medical Practices
Multi-role access management and EHR workflow segmentation across care teams.
Pharmacies
System integration controls, dispensing-related access paths, and vendor control assurances.
Business Associates
Client-mandated evidence standards, subcontractor governance, and response SLAs.
BA guide →What Your Practice Needs to Provide
We guide you through gathering these inputs during the scoping phase. Most small practices can assemble everything within weeks, not months.
- Systems and devices inventory: every system, device, and software application that stores, transmits, or accesses ePHI (EHR, practice management software, email, cloud storage, mobile devices, fax machines, printers)
- Physical locations: all sites where ePHI is accessed or stored, including satellite offices, remote worker locations, and off-site storage
- Workforce roster with access levels: current staff list showing each person's role, which systems they access, and their level of access to ePHI
- Vendor and business associate inventory: all third parties who create, receive, maintain, or transmit ePHI on your behalf, including IT providers, billing companies, cloud vendors, shredding services, and answering services
- Existing compliance documentation: any current HIPAA policies, procedures, prior risk assessments, training records, BAAs, or incident reports you already have (even if incomplete or outdated)
- Network and data flow information: how systems connect and share data, including network diagrams if available, or a description of how patient data moves through your workflows
- Known incidents: any security incidents, breaches, near-misses, or patient complaints from the past 12 months, whether reported or not
How Often Should You Reassess?
At minimum: annually. OCR does not mandate a single fixed interval, but its enforcement guidance and corrective action plans consistently require annual review. Under 45 CFR 164.308(a)(1)(ii)(A), the risk analysis must remain current and accurate. A single point-in-time assessment does not satisfy the ongoing obligation.
Beyond the annual cycle, reassess whenever significant changes occur in your environment:
One Guy Consulting structures every SRA engagement to produce documentation that supports annual reassessment, not just a one-time report.
Data Breach Risk Calculator
Answer eight questions about your current security controls and get an instant risk score. Takes under two minutes. No email required.
This calculator provides an estimate for educational purposes only. A comprehensive Security Risk Assessment involves detailed analysis of your specific environment, workflows, and threat landscape. Scores are not a substitute for a formal HIPAA Security Risk Analysis.
The SRA is included in both plans.
Two plans, six ways to pay. No per-user fees. Pick the level of help you want from Chuck.
- The platform on its own, no consulting time
- SRA, gap analysis, remediation plans
- Policy templates and staff training
- Vendor and BAA management
- Everything in Self-Guided
- 4 hours a month of 1:1 implementation calls with Chuck
- Incident response guidance
- CMS audit response support
One payment, two full years of coverage.
Flat rate per location.
Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.
Frequently Asked Questions
What do I do if my small clinic still does not have a HIPAA risk assessment or written policies?+
What inputs does a small practice need to provide for a Security Risk Assessment?+
What is the difference between an SRA and vulnerability scanning?+
How often should we perform an SRA?+
Can this include remediation execution support?+
How detailed is the final report?+
Does a software tool alone satisfy the SRA requirement?+
Can a business associate use this service too?+
What is a HIPAA security risk analysis for FQHCs?+
What does HIPAA security consulting include?+
Begin Your Security Risk Assessment
An introductory call covers scoping, expected timeline, and which plan fits your organization's size and complexity.
Deep-Dive Resources
These articles explain SRA scope, process, timing, and next steps:
Explore our other HIPAA services
Questions About Risk Assessments?
Tell us about your situation or question.
Or email us at hello@oneguyconsulting.com
Book Your Free 30-Minute Intro Call