HIPAA Risk Analysis: What "Accurate and Thorough" Means for a Small Practice

If a practice reports a breach or gets a complaint, one of the first documents the HHS Office for Civil Rights asks for is the security risk analysis. Not the policy binder, not the training certificates. The risk analysis. OCR runs a dedicated Risk Analysis Initiative, and its settlement announcements keep citing the same finding: the organization had not done an accurate and thorough risk analysis before the incident.

A lot of small practice risk analyses are a vendor questionnaire with every box checked "yes," dated three years ago, describing a server the practice no longer owns. That document does not protect anyone. This post is about building one that does.

What the rule actually says

The requirement sits in the HIPAA Security Rule at 45 CFR 164.308(a)(1). Covered entities and business associates must "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information" they hold.

That sentence is a required implementation specification. It is not addressable, and there is no small practice exemption. The same section also requires risk management (acting on what the analysis finds), a sanction policy, and regular review of information system activity.

Three words in the requirement do most of the work:

• Accurate means it describes the systems you run today, not the ones you ran when the template was filled out.
• Thorough means it covers every place ePHI lives, including the places nobody thinks of as "the EHR."
• Risks and vulnerabilities means it goes past "do we have antivirus" to what could actually go wrong and how likely and how bad it would be.

Step one: find every place ePHI lives

You cannot assess what you have not found. Start with an inventory, and be honest about it. In a typical small practice, ePHI shows up in:

• The EHR and practice management system, cloud or on premises
• Imaging systems and the workstations attached to them
• Email, including staff who forward to personal accounts
• Scanned documents on a shared drive or a desktop folder
• Fax servers and e-fax services
• Billing services, clearinghouses, and payer portals
• Phones and tablets used for messaging or photos
• Backups, wherever they are stored
• Old computers in a closet that were never wiped

Write each one down with who owns it, where it sits, and whether a vendor is involved. If a vendor creates, receives, maintains, or transmits ePHI for you, you also need a business associate agreement with them.

Step two: list threats and weaknesses per system

For each system, ask what could realistically happen to it. Keep it plain. Ransomware encrypts the server. A staff member's email gets phished and the attacker reads a year of referral letters. A laptop with unencrypted patient files is stolen from a car. The EHR vendor has an outage during clinic hours. A former employee still has a login.

Then list the weaknesses that make each threat more likely or more damaging. No MFA on email. Backups stored on the same network as the server. Shared front desk login. No process to remove access when someone leaves. These are the findings that matter, and they are usually obvious once you look system by system.

Step three: rate likelihood and impact, and write down why

Pick a simple scale, such as low, medium, and high, for both likelihood and impact. Combine them into a risk level. The scale itself matters less than writing down your reasoning. "High likelihood because staff receive phishing daily and email has no MFA" is useful. A bare "High" is not.

HHS has a free Security Risk Assessment Tool built for small and medium providers. It is a reasonable structure if you have nothing else. HHS also publishes guidance on risk analysis that explains what OCR expects to see. Either way, a tool only organizes your answers. It does not make them accurate.

Step four: turn findings into a risk management plan

The risk analysis identifies problems. The risk management requirement in the same section says you must implement security measures sufficient to reduce those risks to a reasonable and appropriate level. That means a written list of what you will fix, who owns each item, and the date you expect it done.

Set those dates based on the size of each fix and what your team can actually absorb. Turning on MFA for email might take an afternoon. Replacing an unsupported imaging workstation might depend on a vendor's schedule. A plan with honest dates that you meet is worth more than an aggressive one you abandon.

Some risks you will accept. That is allowed, as long as the decision and the reason are written down and someone with authority signed off.

Step five: keep it current

The Security Rule requires you to review and update security measures as needed and keep documentation for six years from when it was created or last in effect. In practice, revisit the risk analysis at least once a year and any time something material changes: a new EHR, a new location, a merger, a major incident, a new vendor that holds patient data.

A risk analysis that matches your current environment is also the foundation for everything else. Your policies, your training topics, your contingency plan, and your vendor reviews should all trace back to the risks it identified.

A note on what is proposed

HHS published a proposed overhaul of the Security Rule in January 2025. It would add more specific expectations around asset inventories, network maps, and how often the risk analysis is reviewed. It is still a proposal. The federal regulatory agenda lists it as a long-term action with final action projected for July 2027. The current rule is the one OCR enforces today. Many of the proposed items are good practice regardless, and a thorough inventory makes your current analysis better now.

Where practices usually go wrong

The common gaps are predictable:

• Treating the EHR vendor's security as the whole answer, while email and local files go unexamined
• Using a checklist that asks "do you have a policy" instead of "is the control working"
• Never updating the analysis after moving to a cloud EHR or adding a location
• Finding problems and never assigning anyone to fix them
• Leaving the analysis with an outside party and never reading the result

The practice owns the risk analysis even when someone else helps write it.

How we help

TRNSFRM works with practices across Ohio on HIPAA Security Rule work, and we sign business associate agreements with our healthcare clients. If you want a starting point, our HIPAA overview and healthcare page explain how we approach it, and the free compliance checklist gives you a quick self-score.

If you would rather walk through your current risk analysis with someone who has done this before, book a free 45-minute Compliance Gap Audit. You keep the written snapshot either way.