What is a HIPAA security risk assessment?

The documented analysis that 45 CFR 164.308(a)(1)(ii)(A) requires of every covered entity and business associate: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information the organization holds. In practice that means an inventory of where ePHI lives, the threats to each system, the safeguards in place, and a scored register of the risks that remain: together with a plan for reducing them, which 164.308(a)(1)(ii)(B) requires separately.

Is a risk assessment legally required for a small practice?

Yes. The risk analysis is a required implementation specification, not an addressable one, and the Security Rule makes no exception for size. A solo practitioner has the same obligation as a hospital; what differs is scope, which is why a small practice's assessment should take days, not months.

Why does OCR ask for the risk analysis first?

Because almost every other safeguard decision depends on it. When the HHS Office for Civil Rights opens a breach investigation or a compliance review, its initial data request asks for the current risk analysis and the risk management plan, because an organization that never assessed its risks cannot show that the safeguards it chose were reasonable and appropriate. In OCR's published resolution agreements, the absence of an accurate and thorough risk analysis is the finding that appears most often.

Can we not just use the free HHS SRA Tool?

You can, and for a single practice with somebody who has the time it is a genuinely reasonable choice; we say so on our page about it. What practices usually find is that the tool asks the questions but cannot answer them, that the output is a long file nobody reads, and that nothing happens afterwards. This service produces what the tool is meant to produce, scoped to your systems, scored, prioritised and read by a person, and it comes with the remediation plan the tool leaves you to write.

Do you need access to our patient records?

No, and we will not accept any. A risk assessment is about systems, vendors, devices, people and procedures, not about patients. The questionnaire has no field for patient information, the interview does not ask for it, and if any arrives by mistake it is deleted and the engagement letter says so.

What does Essentials not include that Plus does?

Essentials is the assessment: inventory, risk register, remediation plan, policy gap list and the executive summary. Plus adds the written programme the gap list will otherwise tell you that you are missing: twelve tailored policies and procedures, a workforce training deck with an attestation log, a business associate agreement inventory with each vendor reviewed, and an incident-response plan, plus the scope to cover two to five locations or up to forty workforce members.

Is this legal advice?

No. The assessment is a compliance deliverable prepared under your practice's direction, by compliance and security practitioners, not attorneys. It is written to the standard an OCR data request expects, but it is not a legal opinion and does not create an attorney–client relationship. If a finding needs counsel (a state-law question, a disclosure decision, a dispute) we say so in the report rather than guessing.

How long does it take, and what do you need from us?

We confirm the delivery schedule once your questionnaire is complete, because the questionnaire is what the work is built on. From you we need the questionnaire, forty-five minutes with the practice manager, and answers to any follow-ups during the analysis, typically a handful of emails.

What happens after delivery?

You own the documents and can work the remediation plan yourselves, hand it to your IT provider, or run it in our software, where the risk register imports as tracked tasks. The Compliance Programme is the option for practices that would rather someone kept the whole thing current: quarterly reviews, the annual refresh, and support if an incident happens.

Done for you

HIPAA security risk assessment, done for your practice.

A security risk assessment is the one document every covered entity and business associate is required to have: 45 CFR 164.308(a)(1)(ii)(A), and the first thing OCR asks for in any investigation. Most small practices either have none or a years-old export nobody read. We produce the real thing: an inventory of every system that touches ePHI, a scored risk register, a prioritised remediation plan and the executive summary, from a forty-question intake and one forty-five-minute interview. From $1,500, one-off.

Last reviewed October 9, 2026. No patient information is needed or accepted at any stage.

See the tiers Start the intake questionnaire

SRA Essentials

One location, up to 10 workforce members, cloud-hosted EHR

$1,500one-off

Delivery schedule confirmed after you complete the questionnaire

The risk analysis the Security Rule requires, done properly and read by a person, with a remediation plan you can actually work through.

Scoped inventory of every system that creates, receives, stores or transmits ePHI
Threat and vulnerability assessment across the HHS SRA Tool domains
Risk register with likelihood × impact scoring for each finding
Prioritised remediation plan with suggested owners and sequencing
Policy gap list against the Security Rule's required documentation
Executive summary letter in the form an OCR data request asks for
PDF plus editable DOCX, structured as an evidence binder

Order Essentials

Most practices choose this

SRA Plus

2–5 locations, or up to 40 workforce members

$3,500one-off

Delivery schedule confirmed after you complete the questionnaire

Everything in Essentials, plus the written programme that the assessment will otherwise tell you that you are missing.

Everything in SRA Essentials, scoped across every location
12 core written policies and procedures, tailored to your practice rather than templated
Workforce training deck and an attestation log to record who completed it
Business associate agreement inventory with a review of each vendor's status
Incident-response plan with the breach-notification decision path
Walkthrough call to hand over the binder and agree the first 90 days

Order Plus

Compliance Programme

Practices that want the programme kept current rather than redone

$750/month

Starts after an Essentials or Plus assessment; quarterly cadence

The assessment is a point in time. This keeps the register, the policies and the evidence binder current between annual refreshes.

Quarterly risk-register review with remediation status updated
Annual SRA refresh, carried forward from the prior year rather than restarted
Policy updates when the rules or your systems change
Breach-notification support: the four-factor assessment and the deadlines, when something happens
Evidence binder kept current and ready to send when a client or OCR asks

Enquire about the programme

Prices in US dollars, exclusive of any applicable tax. One-off tiers are paid on a hosted card page before the intake begins; the programme is invoiced monthly after an initial assessment. More than five locations or forty workforce members is a scoped quote: email support@hipaacompliancesoftware.org.

How it works: five steps

The whole engagement takes about ninety minutes of your time: the questionnaire, the interview, and a handful of follow-up emails. Delivery is counted from the day the questionnaire is submitted, because the questionnaire is what the work is built on.

Intake questionnaire
About forty questions on your systems, vendors, devices, access, policies and prior incidents. It asks about how the practice runs, never about patients: there is no field anywhere for patient information. Most practice managers finish it in thirty to forty-five minutes, and it saves nothing until you submit.
Structured interview
A forty-five-minute call with whoever runs the practice day to day, usually the practice or office manager, sometimes with your IT provider on the line. It follows up on the questionnaire, confirms the system inventory and fills in what a form cannot ask.
Analysis against a fixed control library
Your answers and the interview notes are assessed against a control library built on the HHS SRA Tool's domains with a NIST Cybersecurity Framework mapping: the same library behind our software's 68-control assessment. Each threat is scored for likelihood and impact to produce the risk register.
Review, every line
A person reads every finding, every score and every remediation step before anything goes to you. An assessment nobody read is the thing we are replacing, so this step is not optional and not quick.
Delivery and walkthrough
You receive the PDF and an editable DOCX, structured as an evidence binder: executive summary, system inventory, risk register, remediation plan, policy gap list. On Plus, the policies, training deck, BAA inventory and incident-response plan ship alongside, with a handover call.

What a security risk assessment actually is

The HIPAA Security Rule requires every covered entity and business associate to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information it holds. That sentence is 45 CFR 164.308(a)(1)(ii)(A), and it is a required implementation specification: not addressable, not scaled by size, not satisfied by a vendor's assurance that their product is secure.

In practice the assessment is a document that answers five questions about your organization and keeps the answers in one place. Where does ePHI live, every system, device, service and cabinet, including the ones no clinician touches? What could go wrong with each: the threats, from a lost laptop to a billing vendor's breach to a staff member looking at a record they have no reason to see? What is already in place against each threat? How likely is each, and how bad would it be? And, having scored all of that, what will you do about the risks that remain, in what order?

HHS's own guidance on the risk analysis requirement lists the elements an assessment must cover, and the free SRA Tool organises them into domains. The output that makes the exercise useful is the risk register: one line per identified risk, with a likelihood rating, an impact rating, the resulting risk level, and the planned response. Everything else in the deliverable exists to make that register accurate.

Scope: all ePHI, not just the EHR: The commonest failure is an assessment that covers the practice management system and nothing else. Email, scanned documents on a shared drive, the billing company's portal, the texting service, phones that receive patient messages, backups and the server closet all hold ePHI and all belong in scope.
Threats and vulnerabilities, per system: A vulnerability is a weakness: an unencrypted laptop, a shared login, a vendor without an agreement. A threat is what exploits it. The assessment pairs them, because the response to each pairing is different.
Likelihood and impact, scored: Each risk is rated for how likely it is given the safeguards in place, and for how severe the consequence would be. The product of the two is the risk level, and the risk level is what decides the order of the remediation plan.
Documented, and kept: 45 CFR 164.316 requires the analysis to be in writing and retained for six years from the date it was created or last in effect. An assessment that happened in a meeting, or lives on one person's laptop, does not meet that.

Why OCR asks for it first

When the HHS Office for Civil Rights opens a breach investigation or a compliance review, its initial data request asks for the organization's current risk analysis and its risk management plan before it asks for almost anything else. The reason is structural rather than procedural: the Security Rule lets each organization choose safeguards that are reasonable and appropriate for its own size, complexity and risk, and the risk analysis is the document that shows how those choices were made. Without it, there is no basis on which any safeguard decision can be defended.

That is why, in OCR's published resolution agreements and civil money penalty notices, the absence of an accurate and thorough risk analysis is the finding that appears most often: more often than any particular technical failure. The breach that triggered the investigation is frequently a lost device or a phishing email; the finding that sets the penalty is that nobody had assessed the risk of exactly that, so nothing had been decided about it.

The same document is the one a hospital's vendor-security questionnaire asks a billing company for, the one a cyber-insurer wants before renewal, and the one a practice attests to each performance year under MIPS. One deliverable answers all four, provided it exists and is current.

What you receive

Both one-off tiers deliver an evidence binder: a PDF for sending and an editable DOCX for keeping current. The binder is structured the way an OCR data request or a security questionnaire asks for it, so the executive summary can go out on its own and the rest can follow if asked.

Deliverables by tier. Essentials is the assessment; Plus adds the written programme the assessment will otherwise show you are missing.
Deliverable	SRA Essentials	SRA Plus
Executive summary letter, in the form an OCR request expects	Included	Included
ePHI system and vendor inventory	One location	Up to five locations
Threat and vulnerability assessment across the HHS SRA Tool domains	Included	Included
Risk register with likelihood × impact scoring	Included	Included
Prioritised remediation plan with suggested owners	Included	Included
Policy gap list against the Security Rule	Included	Included
Twelve core written policies and procedures, tailored	–	Included
Workforce training deck and attestation log	–	Included
Business associate agreement inventory and vendor review	–	Included
Incident-response plan with the breach-notification path	–	Included
Handover call	On request	Included

The Compliance Programme is the maintenance option for either tier: quarterly register reviews, the annual refresh carried forward rather than restarted, policy updates when the rules or your systems change, and support with the four-factor assessment and the deadlines if an incident happens.

Who this is for, and who it is not for

It is for outpatient medical, dental, physical-therapy and behavioural-health practices with one to five locations, ABA agencies, and the billing companies that serve them: organizations with a practice manager and no compliance officer, where the assessment is overdue because nobody has the afternoon it takes. It is for the practice that has been asked for the document by a hospital, an insurer or a MIPS attestation and does not have it.

It is not for a hospital, a health system or a vendor selling into enterprise health: those need an assessment scoped to a far larger environment and usually a SOC 2 or HITRUST engagement alongside it, which we do not do. It is not for an organization that wants a legal opinion: the assessment is prepared by compliance and security practitioners under your direction, and where a finding needs counsel the report says so. And it is not a substitute for doing something about the findings: 45 CFR 164.308(a)(1)(ii)(B) requires the risks to be reduced, and that part stays yours, with or without our software to track it.

The same job, three ways

The assessment is required; buying it from us is not. Here is how the options compare for a small practice, honestly.

Option	Cost	What you get	Where it falls short
The free HHS SRA Tool	Free, plus a day or two of somebody's time	A structured questionnaire and a report, scoped to one organization, on one computer.	It asks the questions and cannot answer them. The output is long, unscored in any useful order, and nothing happens afterwards unless somebody makes it happen.
A HIPAA consultant	$5,000–$25,000 for a small practice	Judgement about your situation, often on site, with a remediation engagement attached.	Priced for a scope most small practices do not have. The deliverable is frequently the same register this service produces, at several times the cost.
This service	$1,500 or $3,500, one-off	The register, remediation plan and gap list, built from your intake and one interview against a fixed control library, read line by line, with the delivery schedule confirmed after you complete the questionnaire.	No site visit, no technical testing, no legal opinion. If your environment needs any of those, the report says which.

Common questions

What is a HIPAA security risk assessment?: The documented analysis that 45 CFR 164.308(a)(1)(ii)(A) requires of every covered entity and business associate: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information the organization holds. In practice that means an inventory of where ePHI lives, the threats to each system, the safeguards in place, and a scored register of the risks that remain: together with a plan for reducing them, which 164.308(a)(1)(ii)(B) requires separately.
Is a risk assessment legally required for a small practice?: Yes. The risk analysis is a required implementation specification, not an addressable one, and the Security Rule makes no exception for size. A solo practitioner has the same obligation as a hospital; what differs is scope, which is why a small practice's assessment should take days, not months.
Why does OCR ask for the risk analysis first?: Because almost every other safeguard decision depends on it. When the HHS Office for Civil Rights opens a breach investigation or a compliance review, its initial data request asks for the current risk analysis and the risk management plan, because an organization that never assessed its risks cannot show that the safeguards it chose were reasonable and appropriate. In OCR's published resolution agreements, the absence of an accurate and thorough risk analysis is the finding that appears most often.
Can we not just use the free HHS SRA Tool?: You can, and for a single practice with somebody who has the time it is a genuinely reasonable choice; we say so on our page about it. What practices usually find is that the tool asks the questions but cannot answer them, that the output is a long file nobody reads, and that nothing happens afterwards. This service produces what the tool is meant to produce, scoped to your systems, scored, prioritised and read by a person, and it comes with the remediation plan the tool leaves you to write.
Do you need access to our patient records?: No, and we will not accept any. A risk assessment is about systems, vendors, devices, people and procedures, not about patients. The questionnaire has no field for patient information, the interview does not ask for it, and if any arrives by mistake it is deleted and the engagement letter says so.
What does Essentials not include that Plus does?: Essentials is the assessment: inventory, risk register, remediation plan, policy gap list and the executive summary. Plus adds the written programme the gap list will otherwise tell you that you are missing: twelve tailored policies and procedures, a workforce training deck with an attestation log, a business associate agreement inventory with each vendor reviewed, and an incident-response plan, plus the scope to cover two to five locations or up to forty workforce members.
Is this legal advice?: No. The assessment is a compliance deliverable prepared under your practice's direction, by compliance and security practitioners, not attorneys. It is written to the standard an OCR data request expects, but it is not a legal opinion and does not create an attorney–client relationship. If a finding needs counsel (a state-law question, a disclosure decision, a dispute) we say so in the report rather than guessing.
How long does it take, and what do you need from us?: We confirm the delivery schedule once your questionnaire is complete, because the questionnaire is what the work is built on. From you we need the questionnaire, forty-five minutes with the practice manager, and answers to any follow-ups during the analysis, typically a handful of emails.
What happens after delivery?: You own the documents and can work the remediation plan yourselves, hand it to your IT provider, or run it in our software, where the risk register imports as tracked tasks. The Compliance Programme is the option for practices that would rather someone kept the whole thing current: quarterly reviews, the annual refresh, and support if an incident happens.

Have the document before somebody asks for it.

Order a tier, complete the questionnaire, book the interview. We confirm the delivery schedule once the questionnaire is in, and the risk register imports into our software afterwards if you want the remediation tracked.

Order SRA Essentials: $1,500 Start the questionnaire first

The assessment is a compliance deliverable prepared under your practice’s direction by compliance and security practitioners. It is not legal advice, does not create an attorney–client relationship, and is not a certification: no organization or product can be “HIPAA certified”; no such designation exists. Conducting a risk analysis is one requirement; implementing measures to reduce the risks it finds is a separate one at 45 CFR 164.308(a)(1)(ii)(B), and remains your responsibility. Regulatory citations are to the published text of 45 CFR Part 164 as read on October 9, 2026. See our editorial standards and terms.