HIPAA Risk Assessment: What HHS Expects and How to Do One, Step by Step
The risk analysis is the HIPAA requirement regulators check first, and the one most often found missing or incomplete. Here is how to do one that stands up.
A health tech company has a security policy, encrypted databases and a signed business associate agreement with every hospital customer. Then a hospital's security team asks a simple question: "Can we see your HIPAA risk analysis?" The company has a spreadsheet from two years ago that covers the production database and nothing else.
That gap is common, and it matters. An incomplete risk analysis is one of the failures regulators cite most often in HIPAA enforcement, and hospitals ask for it before they share patient data. This guide explains what HHS expects and how to do a risk assessment that covers everything it should.
Quick answer: A HIPAA risk assessment, called a risk analysis in the Security Rule, is a required, accurate and thorough assessment of the risks to the confidentiality, integrity and availability of the electronic protected health information (ePHI) you hold. HHS guidance describes nine elements: scope, data collection, threats and vulnerabilities, current security measures, likelihood, impact, level of risk, documentation, and periodic review. It applies to covered entities and business associates, and it must be followed by risk management to reduce the risks it finds.
What the HIPAA Security Rule Requires
Two linked requirements sit in the Security Rule's administrative safeguards:
- Risk analysis, 45 CFR 164.308(a)(1)(ii)(A). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.
- Risk management, 45 CFR 164.308(a)(1)(ii)(B). Implement security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level.
HHS does not prescribe a method, a format or a frequency. Its guidance on risk analysis says there is no single method that guarantees compliance. What it does expect is coverage: the analysis must include all ePHI, in every form and location, across the whole organization.
Security, Privacy and Breach Risk Assessments: Three Different Things
"HIPAA risk assessment" is used for three different exercises. Most people searching for it mean the first, but you may need all three.
| Type | What it covers | When you do it | Rule |
|---|---|---|---|
| Security risk assessment (risk analysis) | Risks to the confidentiality, integrity and availability of ePHI | Ongoing, and whenever systems or vendors change | Security Rule, 45 CFR 164.308(a)(1)(ii)(A) |
| Privacy risk assessment | How PHI in any form, including paper and conversations, is used and disclosed, against Privacy Rule requirements | Periodically, as good practice | Supports Privacy Rule compliance; not a separate named requirement |
| Breach risk assessment | Whether a specific impermissible use or disclosure is a reportable breach | After each incident | Breach Notification Rule, 45 CFR 164.402 |
How to Do a HIPAA Security Risk Assessment: 9 Steps
These steps follow the elements in the HHS guidance.
- Define the scope. Include all ePHI the organization creates, receives, maintains or transmits, on every system, device and medium, including laptops, phones, backups, cloud services and vendors.
- Collect the data. Map where ePHI lives and how it moves: applications, databases, integrations, file shares, email, and every vendor or subcontractor that touches it.
- Identify threats and vulnerabilities. List reasonably anticipated threats, such as ransomware, phishing, insider snooping, lost devices, misconfigured cloud storage and outages, and the weaknesses each could exploit.
- Assess current security measures. Record the safeguards already in place, such as access controls, encryption, logging, backups and training, and whether they are configured and used properly.
- Determine likelihood. Rate how likely each threat is to exploit each vulnerability, given the controls in place.
- Determine impact. Rate the harm if it happened: to patients, to the confidentiality, integrity or availability of ePHI, and to the organization.
- Determine the level of risk. Combine likelihood and impact into a risk rating for each threat and vulnerability pair, and list the actions needed for each.
- Finalize the documentation. Record the analysis in writing. HHS does not require a format, but documentation must be kept for six years.
- Review and update it. Revisit the analysis regularly and whenever something changes, then feed the results into your risk management plan.
Scoring Risk: A Simple Likelihood × Impact Matrix
Any consistent method works. Many organizations use a three-level scale for likelihood and impact and combine them like this:
| Likelihood \ Impact | Low impact | Medium impact | High impact |
|---|---|---|---|
| High likelihood | Medium | High | High |
| Medium likelihood | Low | Medium | High |
| Low likelihood | Low | Low | Medium |
What matters is that the method is written down, applied the same way to every risk, and that high risks get owners and deadlines in the risk management plan. Our guide to an ISO 27001 risk assessment uses a similar approach and can cover HIPAA and ISO 27001 in one exercise.
Need your risk analysis done independently, or checked before a hospital security review? We run Security Rule risk analyses for covered entities and business associates.
See HIPAA compliance servicesHow Often to Update a HIPAA Risk Assessment
The Security Rule doesn't set a schedule. HHS expects the analysis to be ongoing, and many organizations review it at least once a year. Update it as well whenever:
- you add or replace a system, application or cloud service that handles ePHI
- you sign a new vendor or subcontractor that will touch ePHI
- you open, move or close a site, or change how staff work remotely
- you have a security incident or breach
- a new threat becomes common in your sector
Common HIPAA Risk Assessment Mistakes
- Covering only the main system. Email, backups, laptops, integrations and vendors are left out, so the analysis isn't organization-wide.
- Treating a gap assessment as a risk analysis. A checklist of controls is not the same as rating threats, likelihood and impact (see below).
- Never updating it. An analysis that predates your current systems no longer reflects your risk.
- No risk management afterwards. Finding risks and not acting on them is a separate violation.
- Relying on a tool alone. HHS's free Security Risk Assessment Tool is useful for small and medium providers, but HHS says using it doesn't guarantee compliance.
The cost of these mistakes is real. Missing or incomplete risk analyses appear again and again in OCR settlements, as our guide to HIPAA violations, fines and penalties explains.
The Breach Risk Assessment: HIPAA's Four-Factor Test
When PHI is used or disclosed in a way the Privacy Rule doesn't permit, HIPAA presumes it is a breach. You can only treat it as not reportable if a documented risk assessment shows a low probability that the PHI has been compromised. Under 45 CFR 164.402, the assessment must consider at least four factors:
- The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification.
- The unauthorized person who used the PHI or received it.
- Whether the PHI was actually acquired or viewed.
- The extent to which the risk has been mitigated, for example by getting written assurance that the information was returned or destroyed.
If the assessment doesn't show a low probability of compromise, the breach notification clock applies. Keep the assessment on file either way, because you carry the burden of proof.
Risk Analysis vs Gap Assessment vs Security Evaluation
- Risk analysis rates threats and vulnerabilities to ePHI by likelihood and impact. It is the required starting point.
- Gap assessment checks your controls against a list of requirements. It is useful, but on its own it isn't a risk analysis.
- Security evaluation, under 45 CFR 164.308(a)(8), is a periodic technical and nontechnical review of whether your security policies and procedures meet the Security Rule, repeated when your environment or operations change.
Many organizations run all three together: the gap assessment and evaluation feed evidence into the risk analysis, and the risk analysis decides what to fix first.
HIPAA Risk Assessments for Business Associates and SaaS Vendors
Business associates are directly liable for the Security Rule, so the risk analysis applies to them in full. If you're not sure whether you are one, see HIPAA covered entity vs business associate.
For a SaaS or cloud vendor, the analysis should cover the product's architecture and hosting, every integration with customer systems, support staff access to customer data, subprocessors, and the development pipeline. Hospital customers often ask for it alongside independent evidence such as a SOC 2 report, an ISO 27001 certificate or HITRUST certification. A well-run risk analysis feeds directly into all three.
Organization-wide
Every system, device and vendor that touches ePHI, not just the main application.
Documented method
Likelihood and impact scored the same way for every risk, with the reasoning written down.
Remediation plan
Owners and dates for every high risk, so the analysis leads to risk management.
Reusable evidence
The same work mapped to SOC 2, ISO 27001 or HITRUST controls.
Is your HIPAA risk analysis ready for a hospital's security review?
Tell us what ePHI you handle and where it lives. We'll confirm the scope, the gaps to close first, and how long the analysis will take.
Book your free scope review →HIPAA Risk Assessment FAQ
What is a HIPAA risk assessment?
A HIPAA risk assessment, called a risk analysis in the Security Rule, is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI) that an organization holds. It is required under 45 CFR 164.308(a)(1)(ii)(A) for covered entities and business associates.
Is a HIPAA risk assessment required?
Yes. The risk analysis is a required implementation specification of the HIPAA Security Rule, so it is not optional for any covered entity or business associate that handles ePHI. The rule also requires risk management: putting security measures in place to reduce the risks it identifies to a reasonable and appropriate level.
How often should you do a HIPAA risk assessment?
The Security Rule does not set a fixed frequency. HHS expects the analysis to be reviewed and updated on an ongoing basis, and whenever there are changes such as new systems, new vendors, office moves or a security incident. Many organizations review it at least once a year so the analysis stays accurate.
What are the steps in a HIPAA risk assessment?
HHS guidance describes nine elements: define the scope, collect data on where ePHI is, identify and document threats and vulnerabilities, assess current security measures, determine the likelihood of each threat, determine its potential impact, determine the level of risk, finalize the documentation, and review and update the assessment periodically.
Is there an official HIPAA risk assessment tool?
HHS and ONC offer a free Security Risk Assessment (SRA) Tool for small and medium health care providers. Using it is not required and does not by itself guarantee compliance, and HHS says it may not suit larger organizations. Any method can be used if the analysis is accurate and thorough.
What is the difference between a risk assessment and a risk analysis under HIPAA?
The Security Rule uses the term risk analysis. In practice the two terms are used interchangeably. Some guidance uses risk assessment for the wider process that also includes risk management, the follow-up work to reduce the risks the analysis finds.
Do business associates need a HIPAA risk assessment?
Yes. Business associates are directly liable for the Security Rule, including the risk analysis. SaaS, cloud, billing and IT vendors that handle ePHI for covered entities must do their own analysis, and hospital customers increasingly ask to see evidence of it before signing a business associate agreement.
What should HIPAA risk assessment documentation include?
HHS does not require a specific format. The documentation should show the scope, where ePHI is created, received, maintained or transmitted, the threats and vulnerabilities identified, current security measures, likelihood and impact ratings, the resulting risk levels, and the plan and owners for reducing each risk. Keep it for six years.
Who can do a HIPAA risk assessment for my organization?
You can do it internally or use an independent provider. Look for one that covers every system and vendor that touches ePHI, scores risk with a documented method, produces a remediation plan, and gives evidence your customers accept. Accredify Global, headquartered in Dallas–Fort Worth, Texas, runs Security Rule risk analyses for covered entities and business associates and maps the work to SOC 2, ISO 27001 or HITRUST controls.
What is the four-factor HIPAA breach risk assessment?
When PHI is used or disclosed impermissibly, HIPAA presumes a breach unless a documented risk assessment shows a low probability that the PHI has been compromised. Under 45 CFR 164.402 it must consider at least four factors: the nature and extent of the PHI, including identifiers and re-identification risk; the unauthorized person who used or received it; whether the PHI was actually acquired or viewed; and the extent to which the risk has been mitigated.
Is the HHS Security Risk Assessment Tool enough for HIPAA compliance?
Not on its own. The free HHS and ONC SRA Tool is designed for small and medium health care providers and helps structure the analysis, but HHS states that using it neither is required nor guarantees compliance. You still need an accurate, organization-wide analysis and a risk management plan that acts on the results.
What is the difference between a risk analysis and a security evaluation under HIPAA?
A risk analysis rates threats and vulnerabilities to ePHI by likelihood and impact. A security evaluation, required under 45 CFR 164.308(a)(8), is a periodic technical and nontechnical review of whether your security policies and procedures meet the Security Rule. Both are required, and they are often done together.
How long does a HIPAA risk assessment take?
It depends on size and complexity. A small practice with a few systems can complete one in days, while a SaaS vendor or health system with many systems, integrations and vendors usually needs several weeks to map ePHI, interview teams, score risks and agree a remediation plan.
This article is general information, not legal advice.