What a HIPAA Risk Assessment Actually Involves (For a Small Practice)

If a small practice does one HIPAA security task this year, it should be the risk analysis. It's required, it's the first document HHS asks for after a breach or a complaint, and it's the failure cited again and again in HHS enforcement actions — including against small providers. HHS's Risk Analysis Initiative alone had produced at least 14 enforcement actions by June 2026.

It also sounds far more daunting than it is. For a small office, it's a structured look at where patient information lives and what could go wrong with it, written down. Here's what that actually involves.

What HIPAA actually requires

The Security Rule requires every covered entity — including every practice that bills insurance electronically — to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities" to the electronic patient information it holds. Then it requires you to put security measures in place that reduce those risks to a reasonable level.

Two things in that are worth noticing. First, it's about electronic protected health information wherever it lives, not just the EHR. Second, the rule is deliberately flexible: a three-provider family practice isn't expected to do what a hospital does. It is expected to do it accurately, write it down, and keep it current.

Step 1: Find everywhere patient data lives

This is where most of the value is, because it's where the surprises are. The EHR is the obvious one. The rest of the list usually includes:

• Imaging systems and the workstation attached to the sensor or scanner
• Email — referrals, lab results and patient replies all end up there
• Scanned paper sitting in a shared folder or on someone's desktop
• Phones and tablets with email or the EHR app on them
• Fax, whether a machine or an online fax service
• Backups, wherever they go
• Vendor portals: labs, payers, clearinghouses, the billing service
• The old server or PC from before the EHR migration that nobody turned off

Step 2: What could realistically go wrong

For each place, think through the threats that actually happen to practices your size: a phishing email that hands over a password, ransomware, a stolen laptop, a former employee whose account still works, a disk failure with no restorable backup, a staff member looking up a neighbour's chart. Then the vulnerabilities that would let each one through — no multi-factor sign-in, an unencrypted laptop, shared logins, an unpatched machine.

Step 3: Rate them

For each threat-and-vulnerability pair, estimate how likely it is and how bad it would be. A simple high-medium-low scale is fine. The point isn't precision; it's ranking, so the remediation plan tackles the shared front-desk password before the theoretical risk nobody can name.

Step 4: Record what you already do

Most practices are doing more than they realise and less than they assume. Write down the safeguards actually in place — not the ones the vendor says are available. "Backups run nightly" and "we restored a backup last month" are different safeguards.

Step 5: The remediation plan

The output is a short, prioritised list of what to fix, who owns it, and roughly when. This is the part that turns a document into reduced risk — and the part HHS looks for evidence of. An assessment that identifies problems and then sits in a drawer for three years can be worse than none, because it proves you knew.

How often to do it

The current rule requires the risk analysis to stay accurate and up to date rather than setting a fixed schedule. The usual reading — and the one we'd follow — is to review it at least once a year and whenever something significant changes: a new EHR, a move, a new location, new remote-access arrangements, or a security incident. HHS's proposed update to the Security Rule would add explicit 12-month cycles for related work, including a technology asset inventory and a compliance audit.

Doing it yourself vs. having it done

A small practice can do this itself. HHS and the Office of the National Coordinator publish a free Security Risk Assessment Tool designed for small and medium providers, and it walks you through the questions. If you have someone on staff with the time and the technical knowledge, it's a reasonable route.

The usual difficulty is that the person answering the questions also set up the systems, so the answers describe how things are supposed to work rather than how they do. That's the main argument for an outside assessment: someone who'll actually check whether encryption is on, rather than ask.

What it isn't

• It isn't a certification. HHS doesn't recognise any HIPAA certification, and a risk analysis doesn't make you "compliant" on its own.
• It isn't a vulnerability scan. A scanner report can feed into it, but a printout of findings isn't a risk analysis.
• It isn't the vendor's assessment. Your EHR vendor's security covers their system, not your office.

If you want a two-minute read on where you stand, try our free HIPAA self-check. If you'd rather have the assessment done — written up, prioritised, and with the technical fixes handled by the same people — that's our HIPAA security service for practices across central New Jersey.