How to Conduct a HIPAA Security Risk Assessment (SRA)

Q: Can I use an external consultant to conduct the SRA?

Yes. Many organizations use external security consultants. However, your organization remains responsible for accuracy and completeness. Staff should be involved to ensure all systems are included.

Quick Answer

A HIPAA Security Risk Assessment (SRA) is a comprehensive evaluation of your organization's systems, processes, and controls to identify threats and vulnerabilities to electronic protected health information (ePHI). The OCR requires covered entities to conduct an SRA initially and periodically thereafter to identify security gaps, evaluate the effectiveness of existing controls, and document a plan to address vulnerabilities. A thorough SRA examines asset inventory, threat sources, vulnerabilities, current safeguards, risk determination, and remediation planning.

What Is a HIPAA Security Risk Assessment?

The HIPAA Security Rule requires covered entities to conduct a comprehensive risk analysis as part of their security management process. This analysis must evaluate potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI maintained by the organization.

A Security Risk Assessment is not a compliance checkbox—it's a foundational document that informs all of your security decisions. A quality SRA identifies which assets are critical, what threats target those assets, which vulnerabilities exist that threats could exploit, what safeguards you've implemented to mitigate risk, and what additional safeguards you need to reduce risk to acceptable levels.

The SRA serves several critical purposes:

Demonstrates to OCR that you've identified and understood your security vulnerabilities
Documents the basis for your security safeguard decisions
Guides resource allocation toward the most critical security needs
Provides evidence of due diligence that can mitigate penalties if breaches occur
Creates a roadmap for systematic security improvements

OCR Requirements for Risk Assessments

The Office for Civil Rights expects SRAs to meet specific requirements. During audits, OCR evaluates whether organizations have conducted assessments that are:

Comprehensive: Covering all systems, locations, and processes that handle ePHI, not just critical ones.
Documented: Thoroughly documented with findings, methodology, and conclusions clearly recorded and retained for audit purposes.
Current: Updated periodically (at minimum annually) and whenever significant system changes occur.
Based on sound methodology: Using recognized risk assessment frameworks and methodologies, such as NIST guidelines or industry standards.
Addressing all required elements: Covering asset inventory, threat identification, vulnerability assessment, current controls evaluation, risk determination, and remediation planning.
Actionable: Resulting in clear remediation plans with timelines and responsible parties.

The OCR recognizes that you may lack resources to address all identified risks immediately. What matters for compliance is that you identify risks, document your findings, and systematically work toward mitigation based on risk priority.

Step-by-Step Risk Assessment Process

Step 1: Define Assessment Scope

Determine which systems, locations, and workforce members your assessment will cover. Most organizations should assess:

All electronic systems storing or processing ePHI (EHR, billing systems, databases)
Network infrastructure (servers, routers, firewalls)
Workstations and mobile devices accessing ePHI
Backup and disaster recovery systems
All physical locations where ePHI is processed or stored
Cloud-based systems and business associate systems accessing ePHI
Telehealth and remote access systems

Step 2: Create an Asset Inventory

Document all systems, equipment, and data repositories that create, receive, maintain, or transmit ePHI. For each asset, record:

Asset name and description
Location (physical address or logical location for systems)
Owner/manager responsible for the asset
Type and sensitivity of ePHI stored or processed
Users/workforce with access
Current safeguards protecting the asset
Criticality to business operations

This inventory becomes the foundation of your assessment. Comprehensive asset documentation is one of the most common weaknesses the OCR identifies—many organizations discover they don't actually know all the systems storing patient data.

Step 3: Identify Threat Sources

Determine what threats could compromise your ePHI. Threats generally fall into categories:

External threats: Hackers, ransomware operators, competitors, identity thieves
Internal threats: Rogue employees, negligent staff, terminated employees with lingering access
Environmental threats: Natural disasters, power outages, hardware failures
Business threats: Business associate breaches, third-party vendor vulnerabilities
Physical threats: Theft of devices, unauthorized physical access, environmental damage

Don't limit yourself to theoretical threats—research actual threats in healthcare. Ransomware is rampant, phishing attacks target healthcare staff, and data theft by insiders remains common.

Step 4: Assess Vulnerabilities

For each asset and threat source, identify vulnerabilities that could be exploited. Examples include:

Unencrypted ePHI in transit or at rest
Weak or default passwords
No multi-factor authentication
Outdated software lacking security patches
Inadequate access controls allowing unnecessary access
No audit logging of ePHI access
Unsecured remote access capabilities
Lack of visitor controls at physical locations
Unencrypted portable devices (laptops, USB drives)
No Business Associate Agreements or inadequate BAAs

Vulnerability assessment should include both technical evaluation (system configuration review, penetration testing) and operational assessment (policy review, staff interviews).

Step 5: Evaluate Current Safeguards

Document what security measures you've already implemented for each identified vulnerability. For example:

What encryption is in place and what's its strength?
How do you currently control access to ePHI?
What audit logging and monitoring do you have?
What staff training on information security occurs?
How do you enforce access termination when employees leave?
What physical security measures protect your facilities?
How do you handle device disposal?

Honest assessment of current state is critical. Many organizations overestimate their security posture—they assume things are secure without verifying. Conduct actual testing and verification rather than relying on assumptions.

Step 6: Determine Risk for Each Vulnerability

For each vulnerability, assess the risk by considering:

Likelihood of exploitation: How likely is it that a threat actor would discover and exploit this vulnerability? Unencrypted ePHI is high likelihood if exposed. A security feature that requires access to locked equipment might be low likelihood.
Potential impact if exploited: How many patients would be affected? What type of data would be exposed? Vulnerabilities allowing access to all patient records have higher impact than those exposing limited data.
Overall risk rating: Combine likelihood and impact to determine whether risk is low, medium, or high.

Use this risk rating to prioritize remediation—address high-risk vulnerabilities first.

Step 7: Develop Remediation Plan

For each identified vulnerability and risk, determine what safeguards you need to implement. Your remediation plan should include:

Specific safeguard or control to be implemented
Whether implementation is required (mandatory HIPAA standard) or addressable (your organization determined it's appropriate)
Priority level (high-risk vulnerabilities addressed first)
Responsible party or department
Timeline for implementation
Estimated cost
Success criteria (how you'll verify the safeguard works)

A realistic remediation plan considers your budget and resource constraints. You don't need to fix everything immediately, but you need a documented plan showing how you'll systematically address vulnerabilities.

Step 8: Document and Retain the Assessment

Maintain thorough documentation of your entire assessment including:

Assessment methodology and framework used
Assessment scope and dates
Complete asset inventory
Identified threats and vulnerabilities
Risk ratings and justifications
Current safeguards evaluation
Remediation plan with timelines
Evidence of implementation and completion of planned safeguards
Updates to the assessment reflecting completed improvements

Retain documentation for at least 6 years. When OCR conducts audits, they'll want to see this documentation.

Ongoing Risk Assessment and Updates

Risk assessment is not a one-time project. HIPAA requires periodic updates to your assessment. Update your SRA when:

At least annually (best practice quarterly or semi-annually)
Implementing new systems or major technology changes
Deploying new software or operating system versions
Changing workflows or business processes affecting ePHI access
Expanding facilities or adding new locations
Adding new business associates or changing existing relationships
Experiencing security incidents or near-misses
Learning of new threat trends relevant to healthcare

Common Risk Assessment Weaknesses

The OCR frequently identifies these weaknesses in assessments:

Incomplete asset inventory: Failing to identify all systems storing ePHI, especially older legacy systems or systems added recently.
Vague vulnerability descriptions: Identifying vulnerabilities at high level without specific details about which systems are vulnerable and why.
No risk rating or prioritization: Identifying vulnerabilities but not assessing their actual risk, leading to unfocused remediation efforts.
Outdated assessments: Failing to update assessments as systems change, rendering the assessment irrelevant to current infrastructure.
No implementation evidence: Creating a remediation plan but failing to implement or verify completion of planned safeguards.
Inadequate supporting documentation: Relying on assessment summary without detailed supporting data that shows how conclusions were reached.
Insufficient detail on current safeguards: Failing to honestly assess the effectiveness of current safeguards, overestimating their adequacy.

Frequently Asked Questions

How often must I conduct a risk assessment?

HIPAA requires conducting an initial risk assessment and periodically updating it. There's no specific required frequency, but best practice is annually at minimum. More frequent assessments (quarterly or semi-annually) are advisable for organizations with dynamic IT environments or recent security incidents.

Can I use an external consultant to conduct the SRA?

Yes. Many organizations use external security consultants or firms specializing in HIPAA assessments. However, your organization remains responsible for the assessment's accuracy and completeness. Even with external help, staff should be involved to ensure all systems and processes are included.

What if I identify vulnerabilities I cannot immediately fix due to budget constraints?

Document the vulnerability and your plan to address it. Include timelines and responsible parties. If remediation timeline is reasonable and you're making progress, OCR will view this favorably. What matters is demonstrating that you've identified risks and are systematically working to mitigate them, not that you have unlimited resources.

Should the risk assessment include business associates?

Yes. Your SRA should evaluate risks from business associate systems and processes. If vendors process ePHI, evaluate whether they have adequate safeguards. Include their systems in your threat and vulnerability assessment.

What framework or methodology should I use?

NIST has published risk assessment guidance (especially NIST Special Publications on security) that many healthcare organizations follow. Other recognized frameworks include the HITRUST CSF (Common Security Framework) or ISO 27001. Use any recognized methodology—what matters is that you're systematic and thorough.

Who should be involved in conducting the SRA?

Involve your Security Officer, IT leadership, system owners, clinical leadership, and workforce members who understand how ePHI is actually used. Multiple perspectives ensure comprehensive identification of vulnerabilities.

How detailed should my asset inventory be?

Detailed enough that someone unfamiliar with your systems could understand what you have, where it is, what data it stores, and who has access. Include system name, location, owner, function, ePHI sensitivity level, and current safeguards.

Should I conduct penetration testing as part of the SRA?

Penetration testing (ethical hacking) can be valuable to identify actual vulnerabilities that theoretical assessment might miss. It's not required by HIPAA but is increasingly recommended best practice, especially for organizations processing high volumes of sensitive data.

Conduct a Comprehensive Risk Assessment

A thorough security risk assessment is foundational to HIPAA compliance and provides the basis for all your security decisions. Medcurity helps healthcare organizations conduct detailed assessments identifying vulnerabilities, evaluating current safeguards, and developing prioritized remediation plans aligned with your budget and resources.

Start Your SRA →