HIPAA Security Risk
Assessment

A HIPAA Security Risk Assessment (SRA) is a required analysis under 45 CFR §164.308(a)(1)(ii)(A). It identifies risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI).

The SRA is the single most cited deficiency in OCR enforcement actions and HIPAA audit findings.

Key Definitions

Electronic Protected Health Information (ePHI) is protected health information that is created, received, maintained, or transmitted in electronic form (45 CFR §160.103).

This includes data in EHR systems, email, digital imaging, cloud storage, mobile devices, and any electronic medium containing individually identifiable health information.

Security Risk Assessment (SRA) is the process of identifying reasonably anticipated threats to ePHI, assessing the likelihood and impact of each threat, and documenting the security measures in place to mitigate identified risks.

The requirement appears in the HIPAA Security Rule's Administrative Safeguards at §164.308(a)(1)(ii)(A).

Covered Entity means a health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically in connection with a covered transaction (45 CFR §160.103).

Business Associate is a person or entity that performs functions involving PHI on behalf of a covered entity (45 CFR §160.103). Business associates are independently required to conduct their own SRA under the Security Rule.

What the HIPAA Security Rule Requires in a Risk Assessment

The HIPAA Security Rule (45 CFR Part 164, Subpart C) does not prescribe a specific SRA methodology. However, OCR's Guidance on Risk Analysis and enforcement actions establish clear expectations.

NIST SP 800-30 (Guide for Conducting Risk Assessments) and NIST SP 800-66 (Implementing the HIPAA Security Rule) provide widely accepted frameworks for satisfying this requirement. Key elements include:

• Scope — Identify all ePHI the organization creates, receives, maintains, or transmits, including data at rest and in transit across all systems, devices, and locations.
• Threat identification — Document reasonably anticipated threats to ePHI, including natural disasters, human error, insider threats, malware, ransomware, and unauthorized access.
• Vulnerability assessment — Identify vulnerabilities in administrative safeguards (§164.308), physical safeguards (§164.310), and technical safeguards (§164.312).
• Likelihood and impact analysis — Assess the probability of each threat exploiting a vulnerability and the potential impact on ePHI confidentiality, integrity, and availability.
• Risk rating — Assign risk levels to each identified threat-vulnerability combination to prioritize remediation.
• Remediation plan — Document security measures to reduce identified risks to a reasonable and appropriate level per §164.306(b).
• Documentation — The SRA and all supporting documentation must be retained for a minimum of six years per §164.530(j).

Who Must Conduct a HIPAA Security Risk Assessment

• All covered entities (regardless of size, solo practitioners, group practices, hospitals, health plans, and clearinghouses)
• All business associates that create, receive, maintain, or transmit ePHI
• Organizations that have added new systems, telehealth workflows, or remote work configurations that changed their ePHI exposure
• Organizations preparing for OCR (Office for Civil Rights) compliance reviews, payer credentialing, Mergers and Acquisitions due diligence, or contractual security requirements

OCR expects the SRA to be reviewed and updated at least annually or whenever significant changes occur in the organization's environment, operations, or technology.

SRA Enforcement and Penalties

Civil Monetary Penalties

Failure to conduct a Security Risk Assessment is the most frequently cited violation in OCR enforcement actions. Civil monetary penalties range from $141 to $2,134,831 per violation category per calendar year under 45 CFR §160.404.

Notable OCR Settlements for SRA Failures

• Banner Health (2023) — $1,250,000 settlement after a 2016 breach affecting 2.81 million individuals. OCR found failure to conduct an enterprise-wide risk analysis.
• CHSPSC LLC (2020) — $2,300,000 settlement following a breach affecting 6.1 million individuals. OCR cited failure to conduct a compliant risk analysis across the organization.
• Cardionet (2017) — $2,500,000 settlement. OCR determined the wireless health services provider had not conducted an accurate and thorough risk analysis prior to a laptop theft exposing ePHI.
• Steven A. Porter, M.D. (2020) — $100,000 settlement for a solo practitioner who failed to conduct any risk analysis, demonstrating OCR enforces regardless of organization size.

OIG Findings and Breach Notification Exposure

The HHS Office of Inspector General (OIG) has also identified incomplete or missing risk assessments as a systemic deficiency across the healthcare industry in multiple reports to Congress. Breach notification requirements under 45 CFR §§164.400–414 create additional compliance exposure when an SRA gap contributes to a reportable incident.

Authoritative Guidance References

• OCR Guidance on Risk Analysis — HHS guidance document outlining OCR expectations for SRA scope and methodology
• NIST SP 800-30 Rev. 1 — Guide for Conducting Risk Assessments, widely used as a methodological framework for HIPAA SRAs
• NIST SP 800-66 Rev. 2 — Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide
• HHS/ONC Security Risk Assessment Tool — Free SRA tool developed by ONC and OCR for small and medium healthcare organizations

Chuck Weiselberg, C.H.P. (Certified HIPAA Professional) is the founder of One Guy Consulting and the lead assessor on all SRA engagements. He has over 20 years of experience supporting customers in achieving their compliance goals, with 10 of those years focused exclusively on HIPAA compliance as a Subject Matter Expert.

He has supported thousands of users at healthcare organizations, helping Compliance Officers implement risk-based compliance programs — none of whom have failed an audit or received a fine. This track record reflects a repeatable methodology grounded in regulatory requirements, practical remediation planning, and documentation standards that satisfy OCR scrutiny.