HIPAA Risk Assessment: Requirements, Steps, and Checklist

A HIPAA risk assessment identifies potential threats and vulnerabilities to electronic protected health information (ePHI). Under the HIPAA Security Rule, covered entities and business associates must conduct an accurate and thorough security risk analysis. The process involves identifying where ePHI is stored or handled, evaluating risks, documenting findings, and taking appropriate steps to reduce them.

Whether you run a small clinic or manage a large healthcare team, knowing how to assess risks helps you protect patient information and plan better security measures.

What Is a HIPAA Risk Assessment?

A HIPAA risk assessment is a review of problems that could put electronic patient information at risk. The HIPAA Security Rule uses the term risk analysis for this required activity.

The assessment focuses on three important goals:

• Confidentiality: Keeping ePHI away from people who should not access it.

• Integrity: Protecting ePHI from improper changes or destruction.

• Availability: Making sure authorized people can access ePHI when needed.

For example, a medical practice may use an electronic health record (EHR) system to store patient records. Its risk analysis should consider threats involving computers, employee accounts, cloud services, and other systems that handle ePHI.

A security risk analysis is not the same as a breach risk assessment. A security risk analysis looks for possible threats before problems happen. A breach risk assessment examines whether PHI was compromised after certain improper uses or disclosures.

A general HIPAA compliance audit may cover additional duties, such as patient rights, privacy policies, and workforce training.

Is a HIPAA Risk Assessment Required?

Yes. HIPAA requires covered entities and business associates to conduct a security risk analysis.

Under 45 CFR § 164.308(a)(1)(ii)(A), regulated organizations must assess potential risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI.

This applies to covered healthcare providers, health plans, healthcare clearinghouses, and business associates. Small practices are not automatically exempt.

Organizations must also manage the risks they identify. That means deciding which security measures are appropriate and putting them into practice.

Hospitals should connect risk findings to broader oversight activities, including the controls covered in a hospital compliance checklist.

How Often Is a Risk Assessment Required?

The current HIPAA Security Rule does not set one universal annual deadline for completing a security risk analysis.

However, organizations must keep their security efforts current. New software, changes in staffing, remote work, new vendors, or security incidents may create reasons to review risks again.

HIPAA also does not require every organization to hire an outside consultant. Qualified internal staff can conduct an assessment, but the results must still be accurate and thorough.

The HHS proposals to strengthen the Security Rule should not be confused with requirements already in effect.

How to Conduct a HIPAA Risk Assessment

A useful HIPAA risk assessment follows a clear process. These six steps reflect HHS risk analysis guidance, although HIPAA does not require one specific six-step method.

Identify Where ePHI Is Stored and Handled

Start by listing every system and location where your organization creates, receives, stores, or sends ePHI.

Look beyond the main patient records system. Your inventory may include laptops, email, mobile devices, cloud storage, backup systems, medical equipment, and remote-access tools.

Include vendors that handle ePHI for your organization.

If your practice offers virtual appointments, review the platforms and devices discussed in this telehealth compliance checklist.

An incomplete inventory can leave important risks out of the assessment.

Identify Threats and Vulnerabilities

Next, ask what could go wrong.

Threats may include ransomware, stolen devices, unauthorized access, power failures, or employee mistakes.

Vulnerabilities are weaknesses that make those threats more dangerous. Examples include weak passwords, outdated software, poor access controls, or missing backups.

Also review the security measures already in place. These may include access restrictions, encryption, employee procedures, and physical security.

Evaluate Likelihood and Impact

Now consider how likely each problem is and what damage it could cause.

For example, a lost laptop containing unencrypted ePHI could expose patient information. A failed backup system could stop staff from accessing records during an emergency.

Some organizations rate likelihood and impact as low, medium, or high. Others use a numerical system.

HIPAA does not require one particular scoring formula. What matters is using a reasonable method and documenting how risks were evaluated.

Document Findings and Existing Safeguards

Write down what you reviewed and what you found.

Your records should identify the affected systems, threats, vulnerabilities, existing safeguards, risk ratings, and reasons for those ratings.

Keep enough evidence to explain how the assessment was completed. This might include system inventories, security reviews, interviews, and technical findings.

A risk register can help organize the results.

Develop a Risk Management Plan

Finding a risk is only the beginning.

Decide what needs to change. Your plan might include stronger authentication, updated software, improved backups, or tighter access permissions.

Assign each action to a responsible person. Set a target date and track progress.

HHS explains the difference between risk analysis and risk management: analysis identifies risks, while management puts appropriate security measures into place.

Not every risk can be removed completely. Organizations must choose reasonable and appropriate safeguards based on their circumstances and legal obligations.

Review Risks and Update the Assessment

Risk assessments need attention after the initial review.

A new EHR, cloud provider, office location, or remote-work process may change how ePHI is handled.

The HHS Security Rule summary explains the requirement to periodically evaluate security measures, including in response to changes affecting ePHI security.

Keep records of follow-up work, completed fixes, and new findings.

HIPAA Risk Assessment Example

Imagine a small medical practice that uses a cloud-based EHR system.

Employees can access patient records from office computers and approved remote devices. During a security review, the practice finds that remote access relies on weak authentication.

Here is how the practice might document that finding.

This is a fictional example. The ratings are illustrative.

The practice would need to examine its actual systems, access settings, and security measures before assigning final risk ratings.

After making changes, the IT/security lead should confirm that the new controls work. The practice should document the results and decide whether any risk remains.

This example shows one risk finding, not a complete HIPAA risk assessment. A full analysis must consider all relevant ePHI across the organization.

HIPAA Risk Assessment Checklist

Use this checklist to organize your work and identify missing steps.

☐ Inventory systems and locations containing ePHI.

☐ Identify relevant threats.

☐ Review vulnerabilities and existing safeguards.

☐ Evaluate risk likelihood and impact.

☐ Document findings and supporting evidence.

☐ Plan corrective actions.

☐ Assign responsibilities and track progress.

☐ Review and update the assessment when needed.

A checklist helps you stay organized, but it does not replace an accurate and thorough security risk analysis.

Tools and Common Risk Assessment Mistakes

You do not need to create every assessment document from scratch.

The free Security Risk Assessment Tool from HealthIT.gov can help small and medium-sized healthcare organizations work through security risk questions.

It is a useful starting point, but using the tool does not guarantee HIPAA compliance.

Avoid common mistakes such as leaving out cloud services, ignoring vendor risks, failing to document findings, or assuming a vulnerability scan is a complete risk analysis.

Weak access controls and overlooked security practices can contribute to HIPAA compliance mistakes that put patient information at risk.

Remember that workforce training and security risk analysis are separate responsibilities. Both matter, but one does not replace the other.

Strengthen HIPAA Knowledge With USCI Training

Healthcare administrators and compliance managers need to understand security risks, even when technical specialists perform parts of the assessment.

US Compliance Institute’s HIPAA Compliance Training – Executive Certification Program covers HIPAA privacy, security safeguards, risk analysis, breach response, and compliance oversight.

The self-paced online course is designed for healthcare administrators, compliance officers, practice managers, and other professionals responsible for HIPAA-related work.

Participants who successfully complete the program receive a USCI certificate of completion.

Managers should also understand HIPAA training requirements when planning workforce education.

The course supports professional learning. It does not replace an organization’s required security risk analysis or the work of qualified technical specialists.

Conclusion

A HIPAA risk assessment helps healthcare organizations understand where electronic patient information may be at risk.

Start with a complete ePHI inventory. Identify threats and weaknesses, evaluate the risks, document your findings, and take appropriate action.

Review your assessment as systems and operations change. Good documentation and consistent follow-up help turn risk findings into stronger security practices.