What Is a HIPAA Security Risk Assessment and How Often Is It Required?

A HIPAA security risk assessment is the documented review of risks to electronic protected health information (ePHI). Section 164.308(a)(1)(ii)(A) requires it of covered entities and business associates. HIPAA sets no fixed interval. The HHS Office for Civil Rights (OCR) calls the process ongoing and gives annual, bi-annual, and every-3-years schedules as examples.

Key Takeaways

• The Security Rule marks the risk analysis as Required, with no exception for small practices.
• OCR does not set a calendar interval, but it expects an ongoing process with updates after major changes.
• HIPAA prescribes no single method, so many organizations follow NIST SP 800-30 steps.
• Documentation must be written and kept for 6 years from creation or last effective date.
• The free HHS Security Risk Assessment (SRA) Tool helps small providers but does not prove compliance.

What Is a HIPAA Security Risk Assessment?

A HIPAA security risk assessment is an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI. The Security Rule calls this step "risk analysis" and labels it Required. The assessment covers the confidentiality, integrity, and availability of ePHI held by the covered entity or business associate.

The scope is broad. HHS guidance says it reaches all ePHI that an organization creates, receives, maintains, or transmits, in all forms of electronic media. Servers, laptops, phones, cloud apps, and backup drives all fall inside it. Practices that want outside help can use HIPAA risk support to cover the full scope.

The rule also tells organizations what to do with the findings. That duty leads to the question of who owes the assessment.

Who Must Complete a HIPAA Risk Analysis?

Covered entities and business associates must complete a security risk analysis. Section 164.302 of the Security Rule says each must comply with the applicable standards for the ePHI of a covered entity. HHS describes covered entities as health plans, health care clearinghouses, and most health care providers.

A business associate is a vendor that handles ePHI for a covered entity, such as a billing company or an IT provider. The rule that extended HIPAA to these vendors is covered in our post on business associate rules. Size does not remove the duty.

Both groups face the same question next: how often the assessment must be repeated.

How Often Is a HIPAA Risk Assessment Required?

HIPAA does not set a fixed schedule, so the risk analysis must be an ongoing process rather than a one-time project. HHS guidance states that the Security Rule does not specify how frequently to perform a risk analysis. The frequency varies among covered entities.

OCR gives examples. Some covered entities perform the process annually or as needed, such as bi-annual or every 3 years, depending on their environment. Annual review is a common planning choice, yet the examples show that the rule leaves the cycle to the organization.

The rule also requires updates after change. The evaluation standard in 164.308(a)(8) calls for a periodic technical and nontechnical evaluation in response to environmental or operational changes. Those changes act as triggers, shown in the graphic below.

HHS names four events that call for a fresh look at risk. The list below repeats them in the agency's words.

• A security incident at the organization.
• A change in ownership.
• Turnover in key staff or management.
• Plans to add new technology to make operations more efficient.

Practices that track these events can schedule reviews before an auditor asks. Tracking them also shows what the assessment itself must contain.

What Are the HIPAA Security Risk Assessment Requirements?

The requirements are a Required risk analysis, a Required risk management plan, and written, retained documentation. The table below lists the Security Rule provisions that tie to the process, with the exact status each carries.

The table shows that the analysis is only one of several linked duties. Each duty feeds the next, and the first one starts with the data itself.

Which Systems and Devices Does a HIPAA Risk Analysis Cover?

A HIPAA risk analysis covers every system, device, and vendor that creates, receives, maintains, or transmits ePHI. HHS guidance includes ePHI in all forms of electronic media, such as hard drives, storage devices, and portable media. External sources count as well, including vendors and consultants.

A modern practice maps that scope to concrete assets. The list below gives examples of where ePHI lives in a typical office.

• Electronic health record (EHR) servers and cloud EHR accounts.
• Workstations, laptops, tablets, and phones used by staff.
• Email accounts and shared mailboxes that carry patient details.
• Backup drives and cloud backup copies.
• Network equipment, wireless access points, and firewalls that carry ePHI traffic.
• Vendors and consultants who handle ePHI, such as billing and transcription services.

An up-to-date IT asset inventory makes this mapping faster. Gaps in the map become gaps in the analysis, so the inventory deserves careful upkeep. Once the assets are known, the analysis turns to the risks themselves.

What Is a Security Risk for Electronic Protected Health Information?

A security risk for electronic protected health information is a threat that can exploit a vulnerability in a system holding ePHI. HHS borrows its definitions from NIST SP 800-30. A vulnerability is a flaw or weakness in system security procedures, design, implementation, or internal controls.

A threat is the potential for a person or thing to trigger or exploit a specific vulnerability. HHS also tells organizations to consider human, natural, and environmental threats. A phishing email, a stolen laptop, and a flood in a server room each qualify.

The Security Rule defines a security incident as attempted or successful unauthorized access, use, disclosure, modification, or destruction of information. Interference with system operations counts too. A broader view of cyber exposure appears in our guide to cyber risk assessments. Identifying these risks follows a defined sequence.

What Are the 5 Steps of Security Risk Assessment?

The 5 steps of security risk assessment are scoping, threat identification, control review, risk rating, and documentation. The steps below show how to conduct a HIPAA security risk assessment. They follow the elements in HHS risk analysis guidance, which points to NIST SP 800-30.

1. Define the scope and locate all ePHI. Identify where ePHI is stored, received, maintained, or transmitted, and document it.
2. Identify and document threats and vulnerabilities. List reasonably anticipated threats and the weaknesses they could exploit.
3. Assess current security measures and likelihood. Review existing controls, then estimate how likely each threat and vulnerability pair is.
4. Determine impact and assign risk levels. Rate the harm to confidentiality, integrity, and availability for each pair.
5. Document findings and corrective actions. Record the risk levels and list the actions that reduce each risk.

HHS adds that the output of the last step is documentation of assigned risk levels and a list of corrective actions. The fifth step is not the end. The process repeats whenever a trigger occurs.

The graphic above maps the five steps in order. Step one depends on a complete inventory of devices, systems, and vendors.

Step two depends on scanning for weak points. A vulnerability assessment finds technical weaknesses, such as missing patches and open ports. A finished checklist then confirms that no step was skipped.

What Does a Risk Rating Look Like in a HIPAA Risk Analysis?

A risk rating combines the likelihood of a threat with the impact of its harm. HHS says risk levels can be set by analyzing the values assigned to likelihood and impact. The Security Rule does not require a scoring scale, so each organization picks its own.

The table below shows an illustration of how a practice might record ratings. The threats and ratings are examples for teaching, not figures from HHS or NIST.

The register becomes the source for the risk management plan. HHS states that the output should include assigned risk levels and corrective actions. Teams then rank the actions by risk level and set owners and dates.

What Should a HIPAA Security Risk Assessment Checklist Include?

A checklist should include scope, inventory, threats, controls, risk ratings, a corrective action plan, and signed documentation. The list below turns the Security Rule language into items a practice manager can tick off.

• A written scope that names every system, device, vendor, and location touching ePHI.
• An inventory showing where ePHI is created, received, stored, and transmitted.
• A list of threats and vulnerabilities, including human, natural, and environmental threats.
• A review of current controls, such as access controls, backups, and audit logs.
• Likelihood, impact, and risk level for each threat and vulnerability pair.
• A corrective action list with owners and target dates.
• A written record kept for 6 years and reviewed periodically.

A practice that completes this list holds the core of a written assessment report. The report then drives the risk management plan, and tools can speed up the work.

Is the HHS SRA Tool Enough for a Security Risk Analysis?

The HHS SRA Tool is a free starting point, but it does not prove compliance on its own. The Office of the National Coordinator for Health IT (ONC), working with OCR, built it for small and medium providers. HealthIT.gov states that using it is neither required nor an assurance of compliance.

The SRA Tool runs on 64-bit Windows 7, 8, 10, and 11. Version 3.7 stores all entries locally, and HHS does not collect, view, store, or transmit them. An Excel workbook version 3.7 offers the same content in spreadsheet form.

HealthIT.gov also notes that the tool may not suit larger organizations. A tool records answers, but a person must judge the answers against the real environment. That judgment is why many practices pair the tool with a compliance partner.

How Long Must Risk Assessment Records Be Kept?

Risk assessment records must be kept for 6 years, counted from creation or the date last in effect, whichever is later. Section 164.316(b)(2)(i) sets that retention time limit as Required. The same section requires periodic review and updates after environmental or operational changes.

HHS adds that the Security Rule requires the risk analysis to be documented but not in a specific format. A written record may be electronic. Our post on HIPAA record retention covers the wider set of documents.

Good records also matter when regulators investigate, as the next case shows.

What Happens When a Practice Skips the Risk Analysis?

A practice that skips the risk analysis can face an OCR investigation and a corrective action plan. On February 19, 2026, OCR announced its 11th Risk Analysis Initiative enforcement action, against Top of the World Ranch Treatment Center. A phishing attack compromised the ePHI of 1,980 patients.

OCR found evidence that the provider failed to conduct an accurate and thorough risk analysis. The provider paid $103,000 and agreed to a corrective action plan that OCR monitors for two years. That plan required it to complete an accurate and thorough risk analysis.

The case shows how a missing analysis turns a single phishing email into a federal enforcement matter. Practices can lower that exposure by protecting patient data safeguards in daily workflows, and by keeping the analysis current.

What Else Should You Know About the HIPAA Risk Analysis?

What Is a Risk Assessment Under HIPAA?

A risk assessment under HIPAA is the Security Rule's risk analysis, the first step in its compliance process. HealthIT.gov uses the name Security Risk Assessment for the same duty. HHS calls risk analysis foundational. Name differences do not change the requirement.

What Is the Difference Between Risk Analysis and Risk Management?

Risk analysis finds and rates the risks, while risk management reduces them. Section 164.308(a)(1)(ii)(B) requires security measures sufficient to reduce risks to a reasonable and appropriate level. HHS says the analysis documentation is a direct input to risk management.

Is Encryption Required Under the HIPAA Security Rule?

Encryption is an Addressable specification, not a flat Required one. Section 164.312(a)(2)(iv) says to implement a mechanism to encrypt and decrypt ePHI. The risk analysis decides whether encryption is reasonable and appropriate. Our guide to ePHI encryption explains the compliance side.

Does Practice Size Change the Risk Assessment?

Practice size changes how the safeguards are chosen, not whether the analysis happens. Section 164.306(b)(2) lists four factors: size, complexity, and capabilities; technical infrastructure; costs of security measures; and probability and criticality of potential risks. Every covered entity still completes the analysis.

Which NIST Guides Support a HIPAA Risk Analysis?

NIST SP 800-30 Rev. 1, published in September 2012, guides risk assessments, and HHS cites it for example steps. NIST SP 800-66 Rev. 2, published in February 2024, is the HIPAA Security Rule cybersecurity resource guide. HIPAA itself prescribes no specific methodology.

Do Business Associates Need Their Own Risk Assessment?

Yes, a business associate must complete its own risk analysis for the ePHI it handles. Section 164.302 applies the Security Rule to both covered entities and business associates. A covered entity cannot rely on a vendor's analysis in place of its own.

Can a Managed IT Provider Help With the Risk Assessment?

Yes, a managed IT provider can gather inventories, scan systems, and document controls. The covered entity still owns the decisions and the signed record. An outside team supplies the technical data and the schedule, while leadership accepts or treats each risk. Our ePHI security controls work supports the controls step.

What Should Happen After a Security Incident?

A security incident calls for a new look at risk, and HHS lists it as a trigger. The organization then reviews its response and updates the analysis. A written incident response steps guide speeds that review.

Frequently Asked Questions

What Does It Mean to Be HIPAA Compliant?

Being HIPAA compliant means following the Privacy, Security, and Breach Notification Rules that OCR enforces. For ePHI, that includes a documented risk analysis and a risk management plan. Compliance is ongoing and needs written proof.

What Is the HIPAA Security Rule?

The HIPAA Security Rule is the set of national standards in 45 CFR Part 164, Subpart C, that protect ePHI. It applies to covered entities and business associates. The risk analysis is its first and foundational requirement.

What Are the Three Major Security Safeguards in HIPAA?

The three safeguard categories are administrative, physical, and technical. The Security Rule defines security measures as all three together. The risk analysis sits in the administrative category at 164.308.

What Is Considered a Security Incident Under HIPAA?

A security incident is the attempted or successful unauthorized access, use, disclosure, modification, or destruction of information. Interference with system operations in an information system also counts. A failed attack attempt still fits the definition.

How Does Interweave Technologies Help Healthcare Practices With a HIPAA Security Risk Assessment?

We help healthcare practices run a documented assessment that follows the Security Rule. Our managed HIPAA compliance service maps ePHI, reviews controls, rates risks, and keeps the records current. Our team in Huntsville works with providers and business associates across North Alabama.

We do not issue certifications or act as a law firm. A compliance advisor or attorney should confirm legal questions. Practices can start with a risk inquiry to scope the work, or call (256) 837-2300 to talk through the next review.

Our staff builds the inventory, the risk register, and the corrective action list with your team. We then schedule reviews around the triggers HHS names. Practice managers who want a partner for that cycle can reach Interweave Technologies directly.