Skip to main content
BizSecurityTools

HIPAA Security Risk Assessment Tool

A free, guided walkthrough of the official HHS Security Risk Assessment (SRA) questionnaire — 127 HIPAA questions across 7 sections, plus 206 threat/vulnerability consequences to score. No signup required.

⚠️ Self-assessment for informational purposes only — not a substitute for the formal risk analysis required by 45 CFR § 164.308(a)(1)(ii)(A).

Assess your ePHI safeguards in about 30–45 minutes

This tool mirrors the official HHS/OCR Security Risk Assessment Tool (v3.7), the questionnaire the Office for Civil Rights gives covered entities and business associates to fulfill the HIPAA Security Rule risk analysis requirement. It walks you through 127 questions across 7 sections:

  1. SRA Basics — scope and how your assessment is run
  2. Security Policies — documented policies and procedures
  3. Security & Workforce — training and workforce safeguards
  4. Security & Data — access control, encryption, and device security
  5. Security & the Practice — physical and facility safeguards
  6. Business Associates — third-party agreements
  7. Contingency Planning — availability, backup, and recovery

Each section also includes a Threats & Vulnerabilities block where you score the likelihood and impact of threats against your ePHI on a 3×3 Low/Moderate/High matrix — the same method the official workbook uses to arrive at a risk level per consequence.

Suggested prerequisites: an inventory of facilities, systems, and devices that create or transmit ePHI; your current security policies; your business associate list; and 30–45 uninterrupted minutes.
Based on the official HHS Security Risk Assessment Tool v3.7 (public domain, US government work, updated 2025-07-28) — HealthIT.gov.

What is a HIPAA security risk assessment?

The HIPAA Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). This risk analysis is a foundational safeguard under the Administrative Safeguards standard (45 CFR § 164.308(a)(1)(ii)(A)) — it is the document that tells you what your other safeguards actually need to protect against.

The US Department of Health & Human Services publishes a free Security Risk Assessment Tool to help small practices work through the required SRA. This page recreates that questionnaire as an interactive web experience, letting you answer the same questions, score the same threats, and generate a report you can review with a security professional.

How the risk levels are calculated

For each threat consequence, you assign a Likelihood (Low, Moderate, or High) and an Impact (Low, Moderate, or High). These map through a 3×3 risk matrix to a final level: Low, Moderate, High, or Critical — the same matrix the official HHS workbook uses. Consequences scored High or Critical are where your remediation budget should go first.