HIPAA Resource
Every Ohio covered entity and business associate must perform an accurate and thorough Security Risk Analysis under 45 CFR 164.308(a)(1)(ii)(A). HHS offers a free SRA Tool, so the real cost is staff time and expertise. Outside help is priced by scope: number of locations, systems that hold ePHI, and how many vendors need Business Associate Agreements.
The cost of skipping it is better documented: since October 2024 OCR has run a Risk Analysis Initiative, and its 2026 settlements included $103,000 from a treatment center after a phishing breach and a combined $1,165,000 from four ransomware cases, one involving a women's health network with Ohio locations.
The risk analysis is one of the required implementation specifications of the Security Rule's security management process. It must identify where ePHI is created, received, maintained or transmitted, the threats and vulnerabilities to it, the likelihood and impact of each, and the safeguards in place, and it must be documented and updated as your environment changes. HHS does not prescribe a methodology and says the approach can scale with the size and complexity of the practice.
The HHS and ONC Security Risk Assessment Tool is free and built for small and mid-sized practices. It works well if someone in the practice has the time and technical knowledge to answer it accurately. Practices bring in outside help when nobody internal can verify the technical answers, when there are several locations, or after a breach or OCR inquiry when the analysis has to stand up to scrutiny.
Your IT provider, cloud backup, EHR host, email platform and billing service are business associates if they create, receive, maintain or transmit ePHI for you, and HIPAA requires a signed BAA with each (45 CFR 164.308(b) and 164.502(e)). HHS guidance says a cloud provider that stores ePHI is a business associate even if the data is encrypted and it cannot view it.
In March 2026 OCR settled with a software vendor acting as a business associate whose breach exposed data on about 15 million people. TRNSFRM signs BAAs with our healthcare clients.
HHS proposed a major Security Rule update in January 2025 that would require a written risk analysis reviewed at least every 12 months, an asset inventory and network map, annual compliance audits, and written verification from business associates. As of the 2026 Unified Agenda, the final rule is projected for July 2027 and is not yet in effect.
TRNSFRM performs HIPAA Security Risk Analyses for Ohio medical, dental and behavioral health practices in Greater Cleveland and Central Ohio, then fixes what we find as your managed IT and security provider. We sign BAAs and document the work so it holds up if OCR ever asks.
Security Rule safeguards and risk analysis.
Our healthcare security and IT practice.
IT and security for dental practices.
HIPAA-aligned IT for Cleveland practices.
HIPAA-aligned IT for Columbus practices.
From the TRNSFRM blog.
Baseline your environment.