HIPAA Security Risk Assessment: How to Conduct a Risk Analysis

A HIPAA security risk assessment is the risk analysis the HIPAA Security Rule requires at 45 CFR 164.308(a)(1)(ii)(A): an accurate and thorough written assessment of the risks and vulnerabilities to the electronic protected health information (ePHI) an organization holds. Every covered entity and business associate must perform one, and paragraph (B) of the same section then requires a risk management plan that reduces those risks to a reasonable and appropriate level. A defensible analysis covers every system that creates, receives, maintains, or transmits ePHI, rates each threat and vulnerability by likelihood and impact, and stays on file for six years. It is also the requirement behind the 14 enforcement actions OCR announced under its Risk Analysis Initiative through June 2026.

The risk analysis is one line of the HIPAA compliance checklist. This guide covers that line in depth, from the rule text to a scored risk register row and BD Emerson cost ranges.

What does the HIPAA Security Rule require?

The Security Rule requires two separate things: a risk analysis and a risk management program that acts on it. Both are required implementation specifications of the security management process standard, so neither is addressable. The table quotes the provisions that govern the analysis and what each means in practice.

Source: 45 CFR 164.308 and 164.316 on the eCFR, read October 2026.

Two words in paragraph (A) decide most enforcement outcomes. "Thorough" sets the scope: HHS OCR's Guidance on Risk Analysis Requirements under the HIPAA Security Rule says the analysis covers "all e-PHI that an organization creates, receives, maintains, or transmits," whatever the electronic medium. "Accurate" means the ratings describe the systems as they run, which takes technical evidence. The same guidance says the rule "does not prescribe a specific risk analysis methodology."

Risk analysis vs risk assessment: is there a difference?

The two terms name the same deliverable in practice, and the Security Rule itself uses only "risk analysis." NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide (February 2024), draws a narrow line: risk analysis "refers to that which is required by the Security Rule," while risk assessment "refers to the process by which a regulated entity can determine the level of risk to ePHI." The costly mistake is confusing the analysis with four neighboring activities, which the table separates.

A HIPAA audit tests your program requirement by requirement and supports the evaluation standard, and you still need the risk analysis itself. HITRUST's framework carries its own risk management requirements, and our guide to HITRUST certification explains how that evidence carries over.

How to conduct a HIPAA risk analysis, step by step

The eight steps below follow HHS OCR's 2010 guidance and the seven-step process in Section 3.2 of NIST SP 800-66 Rev. 2, which builds on NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (September 2012). Each step leaves evidence that an OCR investigator or a customer's reviewer will ask to see.

Sources: HHS OCR Guidance on Risk Analysis (July 14, 2010); NIST SP 800-66 Rev. 2, Section 3.2.

Step 8 discharges a separate obligation under paragraph (B). An analysis that stops at step 7 documents the risks and leaves them in place.

A sample HIPAA risk register row

A risk register is the working form of the analysis: one row per threat and vulnerability pair, rated and assigned. BD Emerson scores likelihood and impact from 1 to 3 against written definitions and multiplies them, so a score of 6 or 9 is High, 3 or 4 is Medium, and 1 or 2 is Low.

The row below is from a hypothetical SaaS business associate that hosts patient intake forms.

BD Emerson's rule for treatment deadlines: a High risk gets a funded remediation plan within 30 days of sign-off, a Medium risk within 90 days, and a Low risk is accepted or scheduled into the next annual cycle. Every accepted risk carries a written justification and the approver's name, because an undocumented acceptance reads as an untreated risk to an investigator.

Does the HHS Security Risk Assessment Tool meet the requirement?

The HHS Security Risk Assessment (SRA) Tool can record a compliant analysis for a small practice, but using it does not satisfy the rule by itself. The Office of the National Coordinator for Health IT built the downloadable tool with OCR. As of October 2026, HealthIT.gov offers version 3.7 as a Windows application and an Excel workbook, with data entered in the Windows version stored locally on the user's computer.

The limits are written into the tool's own documentation. HealthIT.gov says "use of this tool may not be appropriate for larger organizations" and that its use "is neither required by nor guarantees compliance with federal, state or local laws." NIST SP 800-66 Rev. 2 adds that the tool "cannot identify technical vulnerabilities" and that its output "is only as good as the information put into the tool." In BD Emerson's view, the tool works for a single-location practice with a handful of systems when paired with a complete asset inventory, recent scan results, and a separate risk management plan.

How often do you need a HIPAA risk assessment?

The current rule sets no fixed interval, but OCR expects the analysis to stay current. HHS's guidance says "The Security Rule does not specify how frequently to perform risk analysis," and notes that some covered entities perform it annually or as needed. Section 164.316(b)(2)(iii) requires documentation updates after changes that affect the security of ePHI.

OCR's corrective action plans show the cadence it imposes after a failure. The 2024 resolution agreement with Bryan County Ambulance Authority required a risk analysis built on an inventory of every system, device, off-site storage location, and application holding ePHI, repeated annually for three years. The July 2026 agreement with OSF Healthcare System required annual risk assessments and a risk management plan. BD Emerson recommends a full update every year and a targeted update within 30 days of a trigger: a new EHR or major application, a cloud migration, an acquisition, a new vendor handling ePHI at scale, or a security incident.

The January 2025 proposed rule would write a cadence into the regulation. The proposed Security Rule amendments, published January 6, 2025 (90 FR 898), would require a written risk analysis that reviews a technology asset inventory and network map and assigns a risk level to each threat and vulnerability, updated at least once every 12 months, plus a compliance audit every 12 months, vulnerability scans every six months, and penetration tests every 12 months. As of October 2026 the proposal is not final: HHS's NPRM page says the current Security Rule remains in effect, and the 2026 Unified Agenda entry for RIN 0945-AA22 lists it under long-term actions with a final action date of July 2027. Our article on the HIPAA Security Rule update covers the proposal in full.

What OCR's Risk Analysis Initiative shows

OCR runs an enforcement program aimed at this requirement. In its March 2025 Health Fitness announcement, OCR described the Risk Analysis Initiative as created "to focus select investigations on compliance with the HIPAA Security Rule Risk Analysis provision." By June 18, 2026, it had announced 14 actions under the initiative; the table lists five.

Source: HHS OCR press releases, March 2025 to June 2026.

Three patterns repeat. Vendors carry the same exposure as providers: three of the five organizations are business associates. Each finding follows a breach, whether the organization reported it or a complaint exposed it, which means OCR measures the analysis that existed before the incident. And corrective action plans such as OSF's require an approved methodology, a new analysis, annual updates, and a risk management plan.

The gap predates the initiative. OCR's 2016-2017 HIPAA Audits Industry Report, published in December 2020, found that only 14% of audited covered entities and 17% of business associates substantially met the risk analysis requirement, and that 94% of covered entities and 88% of business associates failed to implement appropriate risk management.

How long do you keep risk analysis documentation?

Keep each risk analysis, risk management plan, and the evidence behind them for six years from the date each was created or last in effect, whichever is later, under 45 CFR 164.316(b)(2)(i). Keep every dated version with the inventory, data flow diagrams, scan and test reports, and interview notes it relied on, plus the sign-off record and the plan's status history. A current version alone cannot show OCR what you knew before an incident.

Common HIPAA risk analysis failures

The failures below appear in OCR's settlement findings and audit report, and they are the gaps BD Emerson finds most often when it reviews an organization's prior analysis.

• The scope stops at the EHR, leaving out email, file shares, imaging, fax servers, backups, and SaaS tools that staff adopted on their own.
• No asset inventory or data flow map exists, so no one can show the scope is complete.
• A questionnaire stands in for the analysis. Yes or no answers about safeguards do not pair threats with vulnerabilities or rate likelihood and impact.
• No technical evidence supports the ratings, so their accuracy rests on interviews alone.
• Systems that vendors run are left out, even when they hold most of the organization's ePHI.
• The analysis has no plan. A list of High risks with no owners or dates meets paragraph (A) and fails paragraph (B).
• The analysis goes stale. One dated before an EHR migration, a merger, or a ransomware event describes a different environment from the one OCR investigates.

How much does a HIPAA risk assessment cost, and how long does it take?

As of October 2026, BD Emerson plans HIPAA risk analyses in the ranges below. Each covers the analysis, the risk register, and the risk management plan; remediation is priced separately.

BD Emerson planning ranges, October 2026. A fixed quote follows scoping.

Four drivers move a project within its range. The number of systems and locations holding ePHI sets the size of the register. A missing asset inventory adds one to three weeks. Testing costs less when scans and a penetration test from the past 12 months can be reused. And each vendor, medical device class, and operational technology system in scope adds interviews and evidence requests.

Frequently asked questions

Is a HIPAA risk assessment required every year? No regulation sets an annual interval today, and HHS guidance says the Security Rule does not specify a frequency. OCR's corrective action plans require annual updates, and the January 2025 proposed rule would require a review at least every 12 months, though it was not final as of October 2026. Update the analysis annually and after each major change.

Can we do a HIPAA risk analysis ourselves? Yes. The Security Rule does not require an outside assessor, and HHS built the SRA Tool for small and medium-sized organizations to use on their own. A self-assessment still needs a complete asset inventory, technical evidence such as scan results, and a separate risk management plan. Outside help adds independence and testing capacity, which matters most for business associates whose customers review the result.

What is the difference between a HIPAA risk assessment and a HIPAA audit? A risk assessment asks what could happen to your ePHI and how likely and severe each risk is, then feeds a risk management plan. A HIPAA audit asks whether you meet each HIPAA requirement, including whether a compliant risk analysis exists, and supports the evaluation standard at 45 CFR 164.308(a)(8). You need the risk analysis either way.

Does a SOC 2 report or HITRUST certification replace the HIPAA risk analysis? No. Both can reuse much of the same evidence, but neither is the documented risk analysis the Security Rule requires of your organization, and HHS does not recognize private certifications regarding the Security Rule. Keep a HIPAA risk analysis that covers all of your ePHI, then map it to your SOC 2 or HITRUST controls so one body of evidence serves all three.

What happens if we have never done a risk analysis? Start one now and date it. OCR measures the analysis that existed before an incident, and its settlements show what follows a breach at an organization without one: a payment, a corrective action plan of two or three years, and a new analysis built under OCR's review. Rate the internet-facing systems holding the most ePHI first.

Who should own the HIPAA risk analysis? The security official your organization must designate under 45 CFR 164.308(a)(2) owns it. That person runs the analysis with IT, the privacy officer, clinical or product leaders, and the vendors that hold ePHI, and senior leadership signs the result. Each risk in the register belongs to the person who controls the budget and systems for that risk.

If you are scoping a first HIPAA risk analysis or updating one before an OCR inquiry or a customer review, our HIPAA compliance team can build the inventory, run the testing, and score the register with your staff, then leave your security official a signed analysis and a risk management plan to run.