HIPAA risk assessment: A complete guide for small practices

A HIPAA risk assessment is the documented evaluation of the risks facing electronic protected health information (ePHI). Every provider, health plan, clearinghouse and business associate that handles ePHI must complete one under 45 CFR §164.308(a)(1)(ii)(A). The U.S. Department of Health and Human Services (HHS) lists a missing risk analysis among the findings OCR cites most often.

You complete it in six steps: Define the scope, inventory ePHI, identify threats, assess controls, score each risk, and write a risk management plan. Each step produces one document, and together those six documents form the OCR evidence pack an investigator asks to see. Repeat the assessment at least once a year, and again after any major change.

Below you’ll find each step, a fully scored example for a three-provider practice, and the triggers that call for a fresh review. The same discipline sits behind medical office HIPAA compliance generally.

Key takeaways

A HIPAA risk assessment is mandatory under 45 CFR §164.308(a)(1)(ii)(A) for every covered entity and business associate that handles ePHI.

Each of the six steps produces one document, and together they form the OCR evidence pack investigators ask for.

Our scored example rates eight risks for a three-provider practice, so you can see how likelihood and impact set the order of fixes.

Assume every system is in scope, from the EHR to the staff phones holding clinical photos, until you can show it holds no ePHI.

HIPAA sets no fixed interval, so reassess annually and after triggers like a new EHR, a new vendor or a security incident.

Keep every assessment document for 6 years, as 45 CFR §164.316(b)(2)(i) requires.

What is a HIPAA risk assessment and who must conduct one?

A HIPAA risk assessment is a mandatory, documented review of threats to ePHI, required of every covered entity and business associate under 45 CFR §164.308(a)(1)(ii)(A).

The Security Rule asks for an “accurate and thorough” assessment of risks to the confidentiality, integrity and availability of ePHI. OCR reads that to mean the assessment cannot stop at one department, one system or one location. Three categories of organization have to complete one:

• Covered entities: Providers who transmit health information electronically, health plans, and healthcare clearinghouses
• Business associates (BAs): Vendors and contractors that handle ePHI for a covered entity, from EHR vendors to billing companies to cloud storage providers
• Business associate subcontractors: Anyone handling ePHI on behalf of a BA inherits the same obligation under the HITECH Act

Smaller practices and aesthetic providers are not exempt. A practice that transmits health information electronically for a standard healthcare transaction is a covered entity, whatever its size. Cash-pay aesthetic practices usually come into scope the moment they accept insurance or bill electronically.

A three-provider practice can run a lighter HIPAA risk assessment than a hospital, because 45 CFR §164.306(b)(2) scales the Security Rule to four flexibility factors:

• Size, complexity and capabilities of the practice
• Technical infrastructure, plus its hardware and software security capabilities
• Cost of each security measure
• Probability and criticality of the potential risks to ePHI

Lighter means a shorter inventory and simpler controls. The scope stays the same: Every system holding ePHI still goes in, and the scope statement records which factors shaped the method.

Risk assessment vs. risk management vs. a HIPAA compliance assessment

A risk assessment finds and scores the risks to ePHI, risk management fixes them, and a HIPAA compliance assessment audits the whole HIPAA program. Security Rule risk management covers ePHI alone. A practice’s wider healthcare risk management also covers clinical, operational and financial risks.

The first two are separate obligations under the Security Rule, each with its own citation. A HIPAA compliance assessment is broader and has no single CFR requirement behind it. It audits the whole program against the Privacy, Security and Breach Notification Rules.

The assessment feeds the management plan, because you cannot build a workable plan without knowing which risks exist. Completing the assessment and then acting on none of it is itself a compliance failure. A HIPAA compliance assessment is a useful annual check on the wider program, but OCR still asks for the risk analysis by name.

How to conduct a HIPAA risk assessment: Step by step

To conduct a HIPAA risk assessment, define the scope, inventory ePHI, identify threats, assess controls, score likelihood and impact, then document a risk management plan.

1. Define the scope, which produces a scope statement
2. Inventory ePHI assets, which produces an asset inventory
3. Identify threats and vulnerabilities, which produces a threat and vulnerability list
4. Assess existing security controls, which produces a controls log
5. Determine likelihood and impact, which produces a scored risk register
6. Document findings and plan fixes, which produces a risk management plan

Those six documents are the OCR evidence pack, and building it as you go is faster than writing it up afterwards. HHS guidance lists nine required elements: Scope, data collection, threats and vulnerabilities, current security measures, likelihood, impact, risk level, documentation and periodic review. The six steps cover all nine.

In practices we onboard, the ePHI inventory is where the surprises turn up, most often clinical photos sitting on personal phones. Give steps 2 and 5 dedicated time rather than treating them as quick checkboxes.

Step 1: Define the scope

Assume every system is in scope until you can show it never creates, receives, stores or sends ePHI. The omissions that draw OCR scrutiny are predictable. Remote laptops, personal phones used for clinical messaging, third-party cloud storage and legacy fax-to-email gateways all get missed.

HHS mandates no single methodology, so scale the method to the flexibility factors above. NIST SP 800-30 is the framework most assessments borrow from, and HHS guidance draws on it too.

A practice that already runs a paperless, HIPAA-compliant practice has fewer physical sites to scope, but a wider electronic surface to account for. The scope statement lists these four areas:

• Clinical systems: EHR, practice management software, lab portals
• Administrative systems: Billing platforms, scheduling tools, email
• Physical locations: All practice sites, off-site storage, home offices with ePHI access
• Third-party integrations: Payment processors, telehealth platforms, cloud backup services

Step 2: Inventory ePHI assets

Map every data flow: Where ePHI starts, where it moves, and where it comes to rest. A practice on a cloud EHR still holds ePHI in a dozen other places. The table below is a starting inventory for a small or aesthetic practice, with the usual owner, weak point and control for each location.

Interfaces are the easiest to forget, because nobody logs into them. A lab feed built on healthcare interoperability standards such as HL7 or FHIR still carries names, results and record numbers.

The asset inventory records each item with its location, its owner and how ePHI flows in and out. Date the finished table and file it as the Step 2 document in the OCR evidence pack.

Step 3: Identify threats and vulnerabilities

Threats are the forces that could exploit a weakness and compromise ePHI. OCR groups them into three categories:

• Human threats: Unauthorized access, phishing, insider misuse, workforce errors
• Environmental threats: Floods, fires, and power failures affecting server rooms or devices
• Technical threats: Malware, ransomware, unpatched software, unsecured APIs

Vulnerabilities are the weaknesses those threats exploit. Weak passwords, missing encryption, loose access controls and untrained staff turn up most often. Write each one down as a pair tied to an asset, such as “phishing against front-desk email that has no multi-factor login”. That pairing is your threat and vulnerability list.

Step 4: Assess existing security controls

Work through each threat-vulnerability pair and judge whether your current safeguards address it. The Security Rule sorts controls into three groups:

• Administrative: Policies and procedures, workforce training, access management
• Physical: Facility locks, workstation controls, device disposal
• Technical: Encryption, access control, audit logs, automatic logoff

Some Security Rule specifications are required and others are addressable. Addressable does not mean optional. Under 45 CFR §164.306(d)(3), the practice first assesses whether each addressable specification is reasonable and appropriate for its setup.

If the specification is reasonable and appropriate, you implement it. If it is not, you document why, then put an equivalent alternative measure in place where one is reasonable. That written decision belongs in the controls log, with the specification, the reasoning, the alternative and the name of whoever signed off.

Encryption of stored ePHI is addressable today, so the controls log needs a written decision on it either way. HHS proposed removing the addressable label in its January 6, 2025 Security Rule proposal. That rule had not been finalized as of October 2026, so the current text still applies.

The controls log records which safeguards are in place for each pair, and flags every risk that has no control behind it.

Step 5: Determine likelihood and impact of each risk

Score each risk on likelihood times impact. OCR does not prescribe a scoring model, so the three-tier matrix below is a widely used and defensible starting point. This single step carries three of the nine HHS elements: Likelihood, impact, and the resulting risk level.

Add one sentence of reasoning to every score, so a reviewer can follow why a lost laptop rated high and a power cut rated low. The result is your scored risk register.

Step 6: Document findings and implement a risk management plan

Step 6 turns the scored register into a risk management plan and closes the OCR evidence pack. The written record includes the scope, the methodology and the data sources. It also carries the finding for each risk, the assigned risk levels and the plan itself.

Keep the whole OCR evidence pack for 6 years from its creation or last effective date, whichever is later, under 45 CFR §164.316(b)(2)(i). Note the date the assessment is next due, which covers the periodic review element.

Not every risk gets fixed this year. The step 5 risk level decides whether a risk is fixed now, scheduled, or formally accepted:

• High: Fix now, with a named fix, an owner and a deadline counted in days or weeks. Never accept a high risk.
• Medium: Schedule the fix on the plan, with an owner and a deadline before the next annual assessment. Accept one only with a compensating control written down.
• Low: Fix it if the fix is cheap, or formally accept it.

A high risk cannot be accepted because §164.308(a)(1)(ii)(B) requires measures that bring risks down to a reasonable and appropriate level. A high score says the practice is not there yet.

Every accepted risk gets a written record. Note the risk, why the remaining exposure is reasonable, and any compensating control. The Security Official signs and dates it and sets a review date, usually the next annual assessment. File the record with the step 6 plan.

A HIPAA risk assessment example for a small practice

This HIPAA risk assessment example shows a three-provider aesthetic practice scoring eight risks on likelihood and impact, then fixing the high scorers first.

The practice is illustrative, not a customer, and the figures are example scores rather than data. The example practice has three providers, two front-desk staff, a cloud EHR, online booking, one card terminal and a shared laptop. Every score comes from the step 5 matrix, and the register is sorted by risk level.

Five of the eight risks score high, and three of those five come from staff habits rather than software. That pattern matters for the plan. Device settings fix in a day, but a habit needs a policy, training and a check that it stuck.

Each row becomes one line of the risk management plan, with the owner and deadline copied across. When a fix lands, the practice records the date and re-scores the risk. Those dated re-scores show OCR the plan was carried out.

The top row traces back to the photo line in the step 2 inventory table, and the email and SMS row to its messaging line. A risk only reaches the register if the inventory found the asset first.

The diagram below shows where each document sits in the OCR evidence pack.

How often should you do a HIPAA risk assessment?

HIPAA sets no fixed interval, but an annual HIPAA risk assessment is the accepted baseline, plus a fresh review whenever ePHI storage or transmission changes.

The Security Rule requires periodic review under 45 CFR §164.306(e) but names no interval. Section 164.316(b)(2)(iii) adds that documentation must be updated after environmental or operational changes. An annual cycle is the widely used baseline, and it lines up with yearly workforce training.

Between cycles, a trigger calls for a targeted review of the affected rows, not a full rerun. The table shows what to re-assess for each trigger and what to file:

Date each entry and keep them together as a trigger log. That log is the re-assessment record in the OCR evidence pack, and it shows OCR the review followed the change rather than the next breach.

The Security Rule proposal HHS published on January 6, 2025 would make this stricter. A written technology asset inventory, a network map and a risk analysis reviewed at least every 12 months would all become explicit requirements.

As of October 2026, the Federal Register shows only the proposed rule, with no final rule published. An inventory table and an annual cycle built now already meet those proposals if they are finalized.

How the risk analysis differs from a breach risk assessment

A Security Rule risk analysis reviews every system holding ePHI on a schedule, while a breach risk assessment tests one incident against four factors. The breach test comes from the Breach Notification Rule (45 CFR §164.402), and it is a same-week judgment call.

When an unauthorized disclosure of ePHI happens, covered entities have to run that four-factor test to decide whether the incident is a reportable breach:

• Nature and extent of the PHI involved: Which identifiers were exposed, and how easily the person could be re-identified
• The unauthorized person who used or received the PHI: Whether the recipient is another covered entity or someone who could exploit the data
• Whether PHI was actually acquired or viewed: Log evidence that the data was or was not opened
• Extent to which the risk has been mitigated: Whether the receiving party gave satisfactory assurances that the data was destroyed

If the four-factor analysis cannot show a low probability of compromise, the disclosure is treated as a reportable breach. The two assessments connect in practice. A thin Security Rule analysis leaves weaker controls behind it, and weaker controls produce more incidents that need the four-factor test.

Common mistakes that draw OCR scrutiny

OCR scrutiny usually follows a narrow scope, missing documentation, findings with no plan behind them, or an assessment never updated after changes. OCR settlements and audit findings show these failures at small providers as often as at hospital systems.

• Scope too narrow: Limiting the assessment to the EHR and ignoring email, mobile devices, third-party integrations, and the physical sites where ePHI exists
• Missing business associate coverage: Never checking that BAs ran their own assessments, or leaving ePHI sent to BAs outside the scope
• No documentation: Running a verbal review, or working off a checklist without keeping the written output OCR can request
• One-and-done thinking: Treating the assessment as a single event rather than a standing obligation that follows system and workflow changes
• Conflating assessment with management: Documenting risks while putting no formal plan behind the high and medium findings
• Vague risk statements: Writing “data may be compromised” instead of a specific threat-vulnerability pair tied to a named system and location

Small providers are squarely in OCR’s sights. In February 2026, OCR settled with Top of the World Ranch Treatment Center, an Illinois treatment provider, for $103,000. A phishing attack on one staff email account had exposed the ePHI of 1,980 patients.

OCR found the provider had never conducted an accurate and thorough risk analysis. The case was the 11th enforcement action under OCR’s Risk Analysis Initiative. The corrective action plan requires a new risk analysis, a risk management plan and annual workforce training.

Tools, templates and who should run the assessment

Most small practices can run the assessment in-house with the free HHS and ONC Security Risk Assessment Tool, signed off by their Security Official.

The SRA Tool comes as a Windows desktop app and as an Excel workbook. The SRA Tool walks you through the Security Rule only, so Privacy Rule duties sit outside it. HealthIT.gov also states that using the SRA Tool neither is required nor guarantees compliance.

NIST SP 800-30 is the alternative when you want your own method. The NIST guide sets out the threat, likelihood and impact approach that HHS risk analysis guidance draws on. Here is how the four routes compare:

A split often works best for a small practice. Run the SRA Tool yourself, then pay an outside reviewer to check the controls log and the register.

A security risk assessment template in a spreadsheet works just as well, as long as it captures:

• Every ePHI location across administrative, clinical, and physical environments
• Identified threats and vulnerabilities per safeguard category
• An inventory of current controls, marked where a risk has no control behind it
• Likelihood and impact scores for each risk pair
• An overall risk level determination, with the reasoning written down
• A linked risk management plan with owners and remediation deadlines

Whoever does the work, the Security Official signs off the result. Under 45 CFR §164.308(a)(2) every practice must name one, and in a small practice that is usually the owner or practice manager.

Dedicated HIPAA compliance software is worth comparing if you would rather keep the evidence in one system year-round. For organization-specific questions, particularly around BA relationships or new technology, qualified HIPAA counsel is the right call.

Penalties for skipping the risk analysis

OCR enforces HIPAA through civil monetary penalties (CMPs) set across four tiers by level of culpability, as defined in 45 CFR §160.404. The amounts below are HHS’s inflation-adjusted figures, effective January 28, 2026. If an incident has already happened, the next step is knowing what to do if you violate HIPAA.

The table shows the regulatory ceilings. OCR’s 2019 Notice of Enforcement Discretion applies lower annual caps to tiers 1 to 3 in practice.

A missing risk analysis is the cited violation behind every action in OCR’s Risk Analysis Initiative. Civil penalties are not the only exposure. Egregious cases can be referred to the Department of Justice for criminal prosecution, particularly where a breach was deliberately concealed. State attorneys general also hold independent enforcement authority under HITECH.

How Pabau supports HIPAA-compliant practice management

Steps 2 and 4 are where a patchwork of tools hurts most. Every separate app for booking, forms, photos and payments adds a row to the asset inventory and another vendor needing a BAA.

Pabau, the all-in-one practice management system we build, keeps the records those rows point to in one place. Online booking, digital consent forms, before-and-after photos and treatment notes sit in the same patient record. Fewer systems means fewer places for ePHI to hide, and a shorter inventory to defend.

For the controls log, our compliance management software limits each staff member to the records their role needs. Pabau’s audit log records every access and change, and patient records are encrypted at rest and in transit. Pabau also provides business associate agreements for covered entities in the US.

Those settings map onto the technical safeguards the Security Rule asks you to assess. Audit log configuration answers the audit controls standard (§164.312(b)). Role-based access answers the access control standard (§164.312(a)(1)). Encryption answers the transmission security standard (§164.312(e)(1)). So you can point at settings and exports instead of rebuilding the picture from memory every year.

See how Pabau supports your HIPAA compliance workflow

Pabau provides audit logs, role-based access controls, encrypted patient records, and business associate agreements. Together they cover the technical and administrative safeguards your risk assessment has to evaluate.

Book a demo

Conclusion

A HIPAA risk assessment is only as defensible as its evidence pack. An investigator never sees the thinking that happened in a staff meeting. They see the dated scope, register and plan that came out of it, or they see nothing.

If you do one task this month, fill in the step 2 inventory table, and be honest about phones and inboxes. The scores, fixes and deadlines all inherit from it, so a system you leave out is a risk you never score.

The trade-off is a few days a year now against reconstructing a year of decisions under an investigator’s deadline. Book a demo to see how Pabau keeps records, consent forms and access logs in one system, so your next evidence pack builds faster.

Continue your research

Want the technical safeguards in more depth? EHR security covers the encryption, access control, and audit settings your assessment has to review.

Operating under GDPR as well as HIPAA? GDPR checklist for UK clinics outlines the parallel documentation and access control duties for practices working across jurisdictions.

Does workforce error keep showing up in your risk register? HIPAA training for employees explains how to build and document the training your assessment will reference.

Frequently asked questions