HIPAA Security Risk Analysis: Step-by-Step Guide

Last updated: 13 October 2026

Quick answer: A HIPAA security risk analysis is the required, documented assessment of risks and vulnerabilities to the confidentiality, integrity and availability of all electronic protected health information (ePHI) an organization creates, receives, maintains or transmits. It must be accurate and thorough, cover every system and location, and feed a risk management plan that reduces risks to a reasonable level.

The risk analysis is the foundation of the HIPAA Security Rule. Every safeguard decision, from encryption to access controls, is supposed to trace back to it. It is also where enforcement most often starts: when the HHS Office for Civil Rights (OCR) investigates a breach, one of the first documents it asks for is the organization’s risk analysis.

This guide explains what the rule requires, how to perform a HIPAA security risk analysis step by step, what OCR has found in recent enforcement, and how proposed changes to the Security Rule could raise the bar. It is written for CISOs and security leaders at covered entities and business associates.

What is a HIPAA security risk analysis?

The requirement sits in the administrative safeguards at 45 CFR 164.308(a)(1)(ii)(A). It requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI held by the organization.

It is paired with a second requirement, risk management, at 164.308(a)(1)(ii)(B): implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The analysis tells you where the risks are; risk management is what you do about them.

Two points are often misunderstood:

• It is required, not addressable. Some Security Rule specifications are “addressable,” which allows flexibility. Risk analysis is not one of them.
• No specific method is prescribed. The HHS guidance on risk analysis states that the rule does not prescribe a specific methodology. What matters is that the analysis is accurate, thorough and documented.

Is a risk analysis the same as a risk assessment?

In everyday use the terms overlap, and many people use “HIPAA risk assessment” to mean the same thing. Strictly, the Security Rule uses “risk analysis” for the assessment itself and “risk management” for the follow-up. A gap assessment or compliance checklist that only asks whether policies exist is not a risk analysis, because it does not identify threats, vulnerabilities, likelihood and impact for your ePHI.

Common mistake: submitting a compliance checklist or a vendor’s security questionnaire as your risk analysis. OCR has repeatedly found that organizations had conducted some form of review but had not performed an accurate and thorough analysis covering all ePHI.

What must a HIPAA risk analysis include?

HHS guidance identifies the elements a risk analysis should contain. They also make a practical step-by-step method.

1. Define the scope. Include all ePHI in every form and location: EHRs, billing systems, email, backups, laptops, mobile devices, medical devices, cloud services and portable media. Scope is not limited to your main clinical system.
2. Collect data on where ePHI lives and moves. Identify where ePHI is stored, received, maintained or transmitted, using interviews, documentation reviews and technical discovery. An up-to-date asset inventory and data flow map make this far easier.
3. Identify and document threats and vulnerabilities. List reasonably anticipated threats, such as ransomware, phishing, insider misuse, lost devices, vendor compromise, power outages and natural disasters, and the vulnerabilities they could exploit.
4. Assess current security measures. Record the safeguards already in place and whether they are configured and used properly.
5. Determine the likelihood of threat occurrence. Estimate how likely each threat is to exploit each vulnerability.
6. Determine the potential impact. Assess the impact on confidentiality, integrity and availability, using qualitative or quantitative methods.
7. Determine the level of risk. Combine likelihood and impact to assign a risk level to each threat and vulnerability pair.
8. Finalize documentation. Record the analysis. The rule requires documentation but no specific format.

After that, the analysis should be reviewed and updated periodically. HHS guidance notes that organizations may perform it annually or as needed, for example every two or three years, depending on circumstances, and that it should be revisited when the environment or operations change.

A worked example: one threat, one asset

A risk register row shows how the elements fit together. Here is an illustrative example for a mid-sized clinic.

In practice: OCR and auditors look for this chain from asset to threat to risk level to treatment. A register that only lists “phishing: high” without the asset, vulnerability and treatment will not show an accurate and thorough analysis.

Which tools and references can help?

Several free government resources support the process:

• The HHS Security Risk Assessment Tool. The SRA Tool, developed by ONC with OCR, walks small and medium-sized providers through the process. Its own disclaimer notes that using it is neither required by nor guarantees compliance with the law, and that it may not suit larger organizations.
• NIST SP 800-66 Rev. 2. NIST’s HIPAA Security Rule resource guide, published in February 2024, explains the Security Rule in cybersecurity terms and maps it to NIST SP 800-53 and the NIST Cybersecurity Framework.
• NIST CSF 2.0. Many healthcare organizations use the CSF to organize their program, as we covered in our article on NIST CSF 2.0 governance.

Larger organizations usually need a system rather than a spreadsheet, because risks, assets, vendors and remediation tasks have to stay linked over time. A dedicated risk management module can hold the register, owners and treatment plans in one place. If you want to test that approach, you can start your 14-day free trial of Enactia with no credit card.

What has OCR enforcement shown?

OCR has made risk analysis a specific enforcement priority through its Risk Analysis Initiative. In April 2026 it announced four ransomware settlements totaling $1,165,000, affecting more than 427,000 individuals, and said these brought the number of completed Risk Analysis Initiative investigations to 13 and completed ransomware investigations to 19. In June 2026 OCR announced a $450,000 settlement with a health plan, which it described as its 14th Risk Analysis Initiative enforcement action and its 20th ransomware enforcement action.

The pattern across these cases is consistent: organizations suffered a ransomware or hacking incident, and OCR’s investigation found they had not conducted an accurate and thorough risk analysis beforehand. Corrective action plans typically require the organization to perform a new risk analysis, implement a risk management plan and report to OCR for a monitoring period.

The lesson for CISOs is simple. The risk analysis is not paperwork you produce after an incident. It needs to exist, be current and cover all ePHI before anything goes wrong.

How could the proposed Security Rule changes affect risk analysis?

On January 6, 2025, HHS published a proposed rule to strengthen the HIPAA Security Rule. According to the HHS fact sheet, the proposals include:

• Greater specificity for the written risk analysis, including a review of the technology asset inventory and network map.
• A technology asset inventory and network map, reviewed at least annually and when changes affect ePHI.
• Compliance audits at least every 12 months.
• Vulnerability scanning at least every six months and penetration testing at least annually.
• Removing the distinction between required and addressable specifications, with limited exceptions.
• Business associates verifying their safeguards at least annually through a written analysis and certification.

As of September 2026, HHS had not finalized the proposal, and any final rule may differ. Even so, the proposals reflect what OCR already expects in practice: a documented inventory, clear scope and regular review.

How do business associates fit in?

Business associates must comply with the Security Rule directly, including the risk analysis requirement. For covered entities, vendors that handle ePHI are also a major source of risk that belongs in your own analysis.

• Include every business associate that stores, processes or transmits your ePHI in scope.
• Check business associate agreements are signed and current.
• Assess vendor security proportionately, from questionnaires to reports such as SOC 2.
• Record vendor risks and treatments in the same register as internal risks.

A structured vendor and third-party risk management process helps keep that inventory complete as vendors change.

HIPAA security risk analysis checklist

• Scope covers all ePHI, in every system, device, location and vendor.
• Asset inventory and data flow map are current.
• Threats and vulnerabilities are documented for each asset.
• Existing safeguards are recorded and tested.
• Likelihood, impact and risk level are assigned using a consistent method.
• A risk management plan assigns owners and dates for each treatment.
• Documentation is retained for six years, in line with Security Rule documentation requirements.
• The analysis is reviewed on a set schedule and after major changes, incidents or new systems.
• Incident response and breach notification procedures reflect the risks identified, ideally in one incident and breach management workflow.

Key takeaways

• The risk analysis is a required Security Rule specification and the basis for every safeguard decision.
• It must be accurate, thorough and cover all ePHI, not just the EHR.
• HHS does not prescribe a method, but it expects scope, threats, vulnerabilities, likelihood, impact, risk level and documentation.
• OCR had announced 14 Risk Analysis Initiative enforcement actions by June 2026.
• Proposed Security Rule changes would make inventories, network maps and regular testing explicit.

Frequently asked questions

How often should a HIPAA security risk analysis be performed?
The Security Rule does not set a fixed frequency. HHS guidance says organizations should review and update the analysis periodically, annually or as needed, for example every two or three years, depending on circumstances. It should also be updated after significant changes such as new systems, office moves, mergers or security incidents. Annual review is a common practice.

Who has to perform a HIPAA risk analysis?
All covered entities, including health plans, health care clearinghouses and health care providers that conduct standard electronic transactions, must perform one. Business associates that create, receive, maintain or transmit ePHI on behalf of a covered entity must also comply with the Security Rule directly, including the risk analysis requirement. Size does not create an exemption.

Does using the HHS SRA Tool make us compliant?
No. The SRA Tool helps small and medium-sized providers structure the process, but its own disclaimer states that using it is neither required by nor guarantees compliance with federal, state or local law. You still need accurate inputs, a complete scope covering all ePHI and a risk management plan that addresses the risks the tool helps you identify.

What is the difference between risk analysis and risk management under HIPAA?
Risk analysis identifies and evaluates risks to ePHI by looking at threats, vulnerabilities, likelihood and impact. Risk management is the separate required step of implementing security measures that reduce those risks to a reasonable and appropriate level. OCR enforcement frequently cites both, because an analysis without a follow-up plan leaves the identified risks untreated.

Can we outsource our HIPAA risk analysis?
Yes. Many organizations use consultants or managed security providers to perform or support the analysis. Responsibility stays with the covered entity or business associate, however. Make sure the outsourced work covers all ePHI, reflects your actual environment, is documented in a form you retain and feeds a risk management plan that your own staff will own.

Making your risk analysis work year-round

A HIPAA security risk analysis is most useful when it becomes a living register rather than an annual report. Keep the asset inventory current, link each risk to a treatment and owner, review after every significant change and use the results to plan your security budget. That approach meets the rule, prepares you for any strengthened requirements and gives you the evidence OCR asks for first.

To see how Enactia supports HIPAA compliance alongside frameworks such as NIST CSF and SOC 2, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.