The HIPAA security risk analysis: what it actually requires

When the Office for Civil Rights investigates a breach, the first document it asks for is the security risk analysis. In settlement after settlement, the finding is the same: the organization never did one, or did one years ago and never updated it.

What the rule says

The HIPAA Security Rule requires covered entities and business associates to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.”

That is the whole requirement. The guidance that follows fills in what “accurate and thorough” means.

What a real one contains

1. An inventory of where ePHI lives. Every system, device, application, and vendor that stores, processes, or transmits it. This is where most practices discover the imaging server and the fax-to-email service nobody listed.
2. Threats and vulnerabilities for each. Ransomware, lost laptops, departed staff with active accounts, unpatched systems, vendors without a BAA.
3. Current controls. What is actually in place today, verified, not assumed.
4. Likelihood and impact. A rating for each risk so they can be ranked.
5. A risk management plan. What will be done about each significant risk, by whom, by when.
6. Documentation. Dated, signed, and retained for six years.

How often

The rule says “periodically.” OCR expects at least annually and whenever something significant changes: a new EHR, a new location, a merger, a breach.

What it is not

A vendor’s checklist or a compliance software questionnaire completed in an afternoon does not meet the standard on its own. The analysis has to reflect your environment.

The practical path

Do it once properly, with someone who has done it before. Then keep the inventory and risk register alive so the annual update is a review rather than a rebuild.

That is how we run healthcare security programs: one honest assessment, then continuous maintenance.