A HIPAA security risk assessment is the documented process of identifying where electronic protected health information (ePHI) is created, stored and transmitted, the threats and vulnerabilities that could affect it, and how likely and harmful those risks are. The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to manage identified risks. It is also one of the first documents regulators request after a breach.
Key Takeaways
- Risk analysis is a required implementation specification under the HIPAA Security Rule.
- It must cover all ePHI across systems, devices, cloud services and vendors.
- Risk is evaluated by likelihood and impact, then documented with a remediation plan.
- Assessments should be repeated regularly and after major changes.
- Business associates such as IT and cloud providers have their own HIPAA obligations.
Step-by-Step HIPAA Risk Assessment Checklist
1. Define scope and inventory ePHI
- List systems that hold ePHI: EHR, practice management, email, file shares, Microsoft 365, backups.
- Include laptops, mobile devices, medical devices and removable media.
- Map data flows to vendors, labs, billing companies and cloud services.
2. Identify threats and vulnerabilities
- Threats: ransomware, phishing, insider misuse, lost devices, natural disasters, vendor breaches.
- Vulnerabilities: missing MFA, unpatched systems, weak passwords, unencrypted devices, excessive access.
3. Evaluate current safeguards
| Safeguard type | Examples to review |
|---|---|
| Administrative | Security officer, policies, workforce training, sanctions, contingency plan, BAAs |
| Physical | Facility access, workstation security, device disposal |
| Technical | Access control, unique IDs, audit logs, integrity controls, transmission encryption |
4. Determine likelihood and impact
Rate each threat-vulnerability pair (for example low, medium, high) for likelihood and impact on confidentiality, integrity and availability of ePHI.
5. Assign risk levels
Combine likelihood and impact into a risk rating and prioritize the highest risks.
6. Document findings
Record the scope, methodology, risks, ratings, and existing controls. Documentation is evidence of compliance.
7. Build a risk management plan
Assign owners, budgets and deadlines for each remediation item, and track progress.
High-Impact Controls for Microsoft 365 Healthcare Environments
- MFA and Conditional Access for every user.
- Device encryption and compliance with Intune.
- Email encryption and advanced email security against phishing.
- Microsoft Purview DLP for health information.
- Immutable backups and a tested disaster recovery plan.
- Centralized logging and alerting with Microsoft Sentinel or Defender XDR.
How Often Should You Assess Risk?
HIPAA does not set a fixed frequency, but many organizations perform a full assessment annually and update it after significant changes such as a new EHR, a cloud migration, mergers or a security incident.
How Skytech Enterprise Helps
Our HIPAA security risk assessment service maps ePHI, evaluates safeguards across Microsoft 365, Azure and endpoints, and delivers a prioritized remediation plan for US healthcare organizations and their business associates. Schedule an assessment. This article is general information, not legal advice.
Frequently Asked Questions
Is a HIPAA risk assessment mandatory?
Yes. Risk analysis and risk management are required implementation specifications under the HIPAA Security Rule for covered entities and business associates.
What is the difference between a risk assessment and a gap assessment?
A gap assessment checks whether required safeguards exist. A risk assessment evaluates threats, vulnerabilities, likelihood and impact to ePHI and prioritizes remediation.
Can we use the HHS Security Risk Assessment Tool?
Yes. The HHS SRA Tool can help smaller practices structure the process, but you still need accurate inventory, evidence and follow-through on remediation.
Does Microsoft 365 make us HIPAA compliant?
Microsoft offers a Business Associate Agreement for eligible services, but compliance depends on how you configure and use them. Shared responsibility applies.
Do business associates need a risk assessment?
Yes. Business associates that handle ePHI must comply with the Security Rule, including risk analysis.
How long should we keep risk assessment documentation?
HIPAA requires security documentation to be retained for six years from creation or last effective date, whichever is later.