How to Do a HIPAA Security Risk Assessment: A Step-by-Step Guide

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) — 45 CFR § 164.308(a)(1)(ii)(A). In plain terms: before you can protect ePHI, you have to know where it lives and what could happen to it.

This is the process the Department of Health & Human Services expects, step by step. If you are a small practice or business associate starting from scratch, the official HHS Security Risk Assessment Tool (SRA) is the same questionnaire most consultants use — and it is free.

1. Define the Scope: Find Every Place ePHI Lives

Before answering a single question, build an inventory of ePHI across your organization: which systems create, receive, maintain, or transmit it; which devices carry it (laptops, phones, workstations, servers); which facilities store it; and who in your workforce touches it. Include third parties — billing services, cloud EHR vendors, email providers — that handle ePHI on your behalf. If it is not on the inventory, the assessment cannot cover it.

2. Work the Questionnaire: 127 Questions, 7 Sections

The official SRA walks you through every safeguard category in the Security Rule. Answering honestly — not aspirationally — is what makes the output useful:

• SRA Basics — scope and how your assessment is run
• Security Policies — documented policies and procedures
• Security & Workforce — training and workforce safeguards
• Security & Data — access control, encryption, device security
• Security & the Practice — physical and facility safeguards
• Business Associates — third-party agreements and oversight
• Contingency Planning — availability, backup, and recovery

Many questions offer multiple response options with different security strength — the SRA labels the most effective option so you can see where your current state falls short.

3. Score the Threats: Likelihood × Impact

Each section ends with a Threats & Vulnerabilities block. For every threat consequence, you assign a Likelihood (Low, Moderate, High) and an Impact (Low, Moderate, High). The 3×3 matrix maps the pair to a final risk level: Low, Moderate, High, or Critical. This is where most organizations discover their real exposure — a practice with unencrypted laptops and no backup will score Critical on loss and ransomware scenarios.

4. Identify the Gaps: Weak Responses Are Your To-Do List

Compile every question where you selected a weaker option and every threat scored High or Critical. These are your remediation priorities — not every answer needs to be perfect tomorrow, but the gaps need an owner, a deadline, and a decision: mitigate it, transfer it (insurance, vendor contract), or formally accept it.

5. Fix, Then Document: OCR Looks for Follow-Through

The risk analysis is only half the requirement — OCR expects a risk management plan that addresses identified risks, plus policies, procedures, and workforce training that match what you documented. Enforcement cases (like the 2026 Spencer Gifts settlement, $450,000) repeatedly hinge on two failures: no accurate risk analysis before an incident, and no reasonable policies in place. Save your completed assessment, your remediation plan, and evidence of the work — that is what an auditor or OCR investigator will ask for.

6. Keep It Current: Reassess on Change

The Security Rule does not set a calendar cadence — it requires the analysis to remain accurate and current. OCR recommends reviewing it periodically and whenever the environment changes: new systems or software, a new location, remote work, new business associates, or after any incident. Many practices reassess annually and after every significant change.

Do It Now: Free Interactive SRA

The checklist above takes most practices 30–45 minutes per section pass with the right tool. Our HIPAA Security Risk Assessment tool recreates the official HHS questionnaire as an interactive web experience — same questions, same 3×3 threat scoring, same seven sections — and exports a report you can keep as documentation or hand to a security professional.

Important: a self-assessment is not a substitute for the formal risk analysis required by 45 CFR § 164.308(a)(1)(ii)(A) or for professional security consultation. Have your results reviewed by a qualified security professional.