Last verified: October 2026, against 45 CFR 164.308 on eCFR, HHS's January 2025 Security Rule proposal and the federal SRA Tool page. General information, not legal advice — confirm with your compliance officer or attorney.
A HIPAA risk assessment is the written review of where your practice's electronic patient information lives, what could go wrong with it, how likely and how damaging that would be, and what you'll do about it. The Security Rule requires one, and HHS's own audits found most covered entities falling short on it. Generic templates tend to skip the website and marketing tools where patient data now enters a practice. This walkthrough uses free federal resources and is sized for a small practice.
Risk analysis vs risk assessment: what the rule requires
45 CFR 164.308(a)(1)(ii) (opens in a new tab) contains two required implementation specifications:
- (A) Risk analysis: "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity."
- (B) Risk management: "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level."
"Risk analysis" is the rule's word; "risk assessment" is what NIST and most people call the process. Treat them as one job. The distinction that matters is with a gap analysis, which HHS describes in its January 2025 Security Rule proposal (opens in a new tab) as "a partial assessment" giving a high-level view of which safeguards are in place. A gap analysis is useful, but it doesn't satisfy (A).
Why it matters: in its 2016–2017 audits, HHS found only 14 percent of covered entities "substantially fulfilling their regulatory responsibilities" for risk analysis. In 2023, seven of OCR's resolution agreements, almost half that year's total, followed investigations of potential Security Rule violations. The HIPAA Security Rule guide explains the safeguards your assessment will test.
Step 1: inventory where ePHI lives, including your website
HHS's summary of NIST's process starts here: "Prepare for the assessment by conducting a technology asset inventory" and determine "whether ePHI is transmitted to external third parties, such as cloud service providers." The scope covers physical locations and every device, network or service holding ePHI, "regardless of its location." If you're unsure what counts, see what is PHI.
Copy this inventory and fill in one row per system:
| System | Holds ePHI? | Vendor and BAA on file? | Who has access |
|---|---|---|---|
| EHR / practice management | Yes | ||
| Email (practice accounts) | Usually | ||
| File storage and shared drives | Often | ||
| Website host | If it stores form data | ||
| Form tool | Yes, if forms collect patient details | ||
| CRM / patient inbox | Yes | ||
| Chat widget | Yes, if patients type health details | ||
| Analytics and tag manager | Should not; check what pages they run on | ||
| Ad accounts (Google, Meta) | Should hold none | ||
| Laptops, tablets and phones | Often | ||
| Backups | Yes |
- Every row has an owner and an answer in each column.
- Every vendor marked "Yes" or "Often" has a signed BAA.
- Ad accounts and analytics are confirmed to receive no patient data; the HIPAA website checklist shows where to look.
Step 2: threats and vulnerabilities
For each system, list what could go wrong (threats) and the weaknesses that would let it happen (vulnerabilities). HHS's summary asks for "reasonably anticipated and probable human and natural incidents."
- Human, deliberate: phishing, ransomware, a stolen laptop, staff snooping.
- Human, accidental: an email to the wrong patient, a form notification going to an old inbox, a spreadsheet shared publicly, a pixel sending booking data.
- Technical: an unpatched server, a vendor breach, an expired certificate on a form page.
- Environmental: fire, flood, power or internet outage.
- Vulnerabilities: shared logins, no MFA, unencrypted devices, no offboarding, untested backups, vendors without BAAs.
Marketing software deserves its own pass, because it is often added by whoever ran the last campaign. See HIPAA checks for marketing software.
Step 3: likelihood, impact and risk level
Score each threat-vulnerability pair. HHS suggests a simple scale such as "very low," "low," "moderate," "high" or "very high" for likelihood, then a rating for impact on the confidentiality, integrity or availability of ePHI. The risk level combines the two. NIST SP 800-30 Rev. 1 (opens in a new tab), Guide for Conducting Risk Assessments, is the reference HHS cites for these scales.
Illustrative example: a fictional four-provider pediatric practice.
Threat: phishing email steals the office manager's password. Likelihood: high (HHS uses this same phishing scenario as its example). Impact: high, because the account opens the patient inbox. Risk: high. Vulnerability: no MFA on email.
- Every pair has a likelihood, an impact and a risk level.
- The scoring method is written down so next year's review uses the same scale.
Step 4: the risk management plan
The risk analysis finds problems; 164.308(a)(1)(ii)(B) requires you to reduce them "to a reasonable and appropriate level." Turn every high and moderate risk into a dated action.
- Each risk has an action, an owner and a due date.
- High risks are fixed first: MFA on email and the EHR, device encryption, offboarding, tested backups, BAAs, no pixels on patient pages.
- Accepted risks have a written reason, signed by the owner or lead clinician.
- Results go to practice leadership, as HHS recommends.
- Everything is kept for six years under 164.316 (opens in a new tab).
Medfy covers part of the marketing column. Patient data from its forms, chat and inbox is stored in separate, encrypted HIPAA databases in the US or Canada, Medfy signs a BAA with every practice, and ad platforms never receive patient data; see Medfy's HIPAA safeguards. A free marketing audit can show whether your current site sends data to ad platforms.
Tools: the free SRA Tool and templates
The Security Risk Assessment Tool (opens in a new tab) from ONC and HHS's Office for Civil Rights is a free desktop application that walks you through the assessment. Its stated "target audience" is "medium and small providers," and version 3.7 was current when we checked. The page also notes that using it isn't required and doesn't, on its own, make a practice compliant.
Purchased templates can help with formatting, but HHS says in the 2025 proposal that there are "numerous methods of performing a risk analysis" and no single best practice that ensures compliance. A template that doesn't list your actual systems, website stack included, isn't a risk analysis. Use the inventory table above as your starting point and pair it with the HIPAA compliance checklist.
How often to repeat it
The current rule sets no fixed interval. It requires periodic evaluation under 164.308(a)(8) and, under 164.306(e) (opens in a new tab), review and modification of security measures "as needed." In practice, redo it:
- At least once a year.
- When you add or change an EHR, website, form tool, CRM or chat vendor.
- After a move, renovation or new location.
- After any security incident or breach.
The January 2025 proposal would require a written assessment reviewed "no less frequently than at least once every 12 months." As of October 2026, the Federal Register shows only the proposed rule, so it isn't a requirement yet. A stale risk analysis is also one of the factors that shape how OCR sets penalties.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Is a HIPAA risk assessment required every year?
Not by a fixed date under the current rule. The Security Rule requires an accurate and thorough risk analysis, periodic evaluations and updates when your environment or operations change, such as a new EHR, website vendor or office. Many practices redo it yearly because something always changes. HHS's January 2025 proposal would require a review at least every 12 months, but it isn't final. Confirm your cadence with your compliance officer or attorney.
Can a small practice do its own risk assessment?
Yes. The rule doesn't require an outside firm, and the free federal SRA Tool was built for small and medium providers to do exactly this. When it wrote the Security Rule, HHS called external evaluation a business decision for each practice. Bring in your IT contractor for the technical questions, and consider an outside review if you lack the expertise. Confirm the approach with your compliance officer or attorney.
What's the difference between a risk analysis and a risk assessment?
In practice, they're the same work. Risk analysis is the regulation's term, and its text calls for 'an accurate and thorough assessment' of risks to electronic PHI; NIST and HHS describe the process as a risk assessment. The useful distinction is with a gap analysis, which HHS describes as a partial, high-level review of which safeguards are in place. A gap analysis doesn't replace the full risk analysis.
Does the risk assessment need to include our website?
Yes, if your website collects, sends or stores electronic PHI, which most practice sites do through contact forms, appointment requests, chat or a patient portal. The Security Rule covers all ePHI you create, receive, maintain or transmit, and HHS says the scope should include data sent to outside parties such as cloud providers. Include the host, form tool, inbox and any tags on those pages. Confirm scope with your compliance officer or attorney.