QRRXQR Rx
    Compliance

    HIPAA Security Risk Assessment: Requirements for Medical Practices

    The HIPAA Security Rule (45 CFR 164.308(a)(1)(ii)(A)) requires every covered entity and business associate to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). The HHS Office for Civil Rights (OCR) has identified failure to perform a Security Risk Assessment (SRA) as the most common HIPAA deficiency, cited in over 70% of enforcement actions between 2019 and 2024.

    What the HIPAA Security Rule Requires

    • The Security Risk Assessment is not optional or advisory. 45 CFR 164.308(a)(1)(ii)(A) mandates that every covered entity 'conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.' OCR has imposed penalties ranging from $10,000 to $6.85 million for SRA failures, with the largest penalties targeting organizations that had no SRA on file at all.
    • The SRA must cover every system that creates, receives, maintains, or transmits ePHI. For a typical medical or dental practice, this includes the electronic health record (EHR), practice management system, billing software, patient portal, email (if used for any patient communication), imaging systems (PACS, digital X-ray), lab interfaces, cloud storage, backup systems, mobile devices used by staff, and any third-party applications that access patient data. Practices commonly miss systems like voicemail (if messages contain patient names and appointment details), fax servers, and connected medical devices (e.g., digital blood pressure cuffs that transmit to the EHR).
    • The SRA must be documented. OCR expects a written record that identifies each ePHI asset, the threats and vulnerabilities associated with each, the likelihood and impact of each threat, and the current security measures in place. The assessment must produce a risk level (high, medium, low) for each identified risk and a risk management plan with specific actions, responsible parties, and timelines for addressing risks rated medium or high. A verbal assertion that 'we reviewed our security' does not satisfy the requirement.
    • OCR does not prescribe a specific SRA methodology, but references the NIST Cybersecurity Framework and NIST SP 800-30 (Guide for Conducting Risk Assessments) as acceptable approaches. HHS provides a free SRA Tool (available at healthit.gov) designed for small and medium practices. The tool walks through each Security Rule standard and implementation specification, generating a report that documents the assessment. Using a recognized framework strengthens your position in the event of an OCR audit or breach investigation.

    Common SRA Deficiencies OCR Identifies

    • No SRA performed at all. This is the single most frequent finding in OCR enforcement actions. In the 2024 HIPAA audit cycle, OCR reported that 39% of small practices (under 15 providers) had never completed an SRA. Practices that have not performed an SRA cannot demonstrate compliance with any downstream Security Rule requirement (access controls, encryption, audit logging) because those controls are supposed to be selected based on SRA findings. OCR treats absent SRAs as per se evidence of willful neglect, which carries the highest penalty tier ($50,000 to $2,067,813 per violation category per calendar year under the 2024 HITECH inflation adjustment).
    • SRA performed once but never updated. The Security Rule requires ongoing risk management, not a one-time assessment. OCR expects the SRA to be reviewed and updated at least annually, and additionally whenever significant changes occur: new EHR system, practice acquisition, new location, major software update, security incident, or new business associate relationship. A 2019 SRA filed in response to a 2024 audit demonstrates that the practice has not monitored for new risks in 5 years.
    • SRA that does not cover all ePHI systems. Practices commonly assess the EHR but omit the billing system, patient communication platform, cloud backup, staff personal devices used for on-call communication, and business associate systems. OCR's Phase 2 audit protocol specifically asks for documentation that the SRA scope includes 'all ePHI the entity creates, receives, maintains, or transmits,' including data held by business associates.
    • SRA that identifies risks but has no risk management plan. The SRA and risk management plan are companion requirements under 45 CFR 164.308(a)(1)(ii)(A) and (B). Identifying that 'staff use unencrypted email for patient communication' without a documented plan to address that risk (with a timeline, responsible party, and interim safeguards) is incomplete compliance. OCR reviews whether identified risks were actually mitigated, not just documented.

    How to Conduct an SRA for Your Practice

    • Step 1: Inventory all ePHI assets. Create a comprehensive list of every system, device, and application that stores, processes, or transmits patient data. Include hardware (servers, workstations, laptops, tablets, smartphones, printers, medical devices), software (EHR, PM system, billing, email, patient portal, telehealth platform), network components (routers, firewalls, Wi-Fi access points, VPN), and external entities (cloud providers, clearinghouses, IT vendors, shredding services). For each asset, document the types of ePHI it handles and the volume of records.
    • Step 2: Identify threats and vulnerabilities for each asset. Threats are potential causes of harm: ransomware, phishing, stolen devices, insider access abuse, natural disaster, hardware failure, misconfigured access controls. Vulnerabilities are weaknesses that threats exploit: unpatched software, weak passwords, lack of encryption, no multi-factor authentication, absent backup testing, insufficient staff training. The NIST SP 800-30 threat catalog provides a structured starting point for small practices.
    • Step 3: Assess likelihood and impact. For each threat-vulnerability pair, rate the likelihood (low, medium, high) that the threat will exploit the vulnerability, and the impact (low, medium, high) to patient data confidentiality, integrity, or availability if exploitation occurs. Multiply likelihood by impact to produce a risk level. High-likelihood, high-impact risks (e.g., ransomware against unpatched servers with no tested backup) require immediate remediation. Low-likelihood, low-impact risks (e.g., physical theft of a never-used fax machine) can be addressed on a longer timeline.
    • Step 4: Document current safeguards and gaps. For each identified risk, record what security controls are already in place (encryption, access controls, training, backup frequency) and where gaps exist. This gap analysis becomes the foundation of your risk management plan. Assign each gap a remediation action, a responsible staff member, and a target completion date. Review progress quarterly and document completed remediations. Retain all SRA documentation (the assessment, risk management plan, and evidence of remediation) for at least 6 years, as required by 45 CFR 164.530(j).

    Integrating the SRA Into Practice Operations

    • Assign an SRA owner. The Security Rule requires designation of a Security Official (45 CFR 164.308(a)(2)) responsible for developing and implementing security policies. In small practices, this is often the practice manager or office administrator. The Security Official does not need a cybersecurity background but must have authority to implement changes and access to all systems in scope. External consultants can assist with the technical assessment, but the practice retains accountability for implementation.
    • Schedule the SRA annually. Many practices tie the SRA to their annual HIPAA compliance review (often in Q1 or Q4). Block 4 to 8 hours for the initial assessment (using the HHS SRA Tool) and 2 to 4 hours for annual updates. Annual updates are faster because the asset inventory and baseline controls are already documented. Focus the update on new systems, new threats (the HHS Health Sector Cybersecurity Coordination Center, HC3, publishes quarterly threat briefings), changes in business associates, and remediation progress from the prior year.
    • Staff training connects directly to SRA findings. If the SRA identifies phishing as a high-likelihood threat (which it is for healthcare: the Verizon 2024 Data Breach Investigations Report found that 36% of healthcare breaches involved phishing), the risk management plan should include phishing awareness training for all staff. Document the training date, content, attendees, and any testing (simulated phishing campaigns). Training that addresses SRA-identified risks demonstrates to OCR that the practice is using the SRA as a living document, not a compliance checkbox.
    • Meaningful Use and MIPS connection: the Promoting Interoperability performance category under the Merit-based Incentive Payment System (MIPS) requires an attestation that a Security Risk Assessment was conducted or reviewed during the performance period (Objective: Protect Patient Health Information, Measure: Security Risk Analysis). Failure to attest results in a score of zero for the entire Promoting Interoperability category (25% of the MIPS composite score), triggering a negative payment adjustment. The SRA required by MIPS is the same assessment required by the HIPAA Security Rule.
    Related
    HIPAA-Compliant Patient Communication: Channels, BAAs, and PHI RulesHIPAA Breach Notification Requirements for Surgical PracticesInformed Consent Documentation: Legal Requirements for Providers
    Frequently asked

    Questions patients ask.

    How often must we perform a HIPAA Security Risk Assessment?

    The Security Rule does not specify a fixed frequency, but OCR interprets the 'ongoing' risk management requirement (45 CFR 164.308(a)(1)(ii)(B)) to mean at least annual review and update. The SRA must also be revised whenever significant changes occur: new EHR implementation, practice merger or acquisition, opening a new location, major security incident, or adding a new category of business associate. For MIPS Promoting Interoperability attestation, the SRA must be conducted or reviewed during each performance year.

    Can we use the free HHS SRA Tool, or do we need a consultant?

    The HHS SRA Tool (available at healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool) is designed for practices with 1 to 10 providers and is fully sufficient for OCR compliance. It walks through each Security Rule standard with yes/no questions and generates a documented report. Larger practices (10+ providers, multiple locations, complex IT infrastructure) benefit from engaging a qualified HIPAA security consultant who can perform penetration testing and technical vulnerability scanning beyond what the HHS tool covers. Whether you use the HHS tool or a consultant, the practice must retain ownership of the completed assessment and any resulting risk management plan.

    What happens if we have a data breach and never performed an SRA?

    Absent SRA documentation dramatically increases OCR enforcement severity. Under the HITECH Act penalty tiers, OCR may classify the violation as 'willful neglect not corrected,' which carries penalties of $68,928 to $2,067,813 per violation category per calendar year (2024 inflation-adjusted amounts). In the 2023 Banner Health settlement ($1.25 million), OCR specifically cited failure to conduct an enterprise-wide SRA as a contributing factor. Additionally, plaintiffs' attorneys in breach litigation use absent SRA documentation as evidence of negligence, and cyber insurance policies may deny coverage if the insured failed to perform required security assessments.

    Does the SRA requirement apply to dental practices?

    Yes. Dental practices that electronically transmit any HIPAA-covered transaction (electronic claims, electronic remittance advice, eligibility inquiries) are covered entities subject to the full HIPAA Security Rule, including the SRA requirement. The ADA notes that virtually all dental practices conducting electronic billing meet this threshold. Dental practices using digital imaging (CBCT, digital X-rays), electronic prescribing, or patient portals have ePHI in multiple systems that must be included in the SRA scope. The HHS SRA Tool is suitable for dental practices.

    For practices

    Bring this to your own practice.

    QR Rx turns every procedure into a branded recovery plan that keeps patients engaged and brings them back. Start free in minutes, or see it live in a 20-minute demo.

    Start free trial

    This blog provides general information about healthcare compliance and aftercare best practices. It does not constitute legal, medical, or regulatory advice. Consult qualified professionals for guidance specific to your practice.