What a HIPAA security risk analysis has to cover

The HIPAA Security Rule requires covered entities and their business associates to conduct an accurate and thorough assessment of the risks to the electronic protected health information they hold. It does not prescribe a template, and that freedom is where many practices go wrong: a vendor questionnaire or a one-page checklist is not a risk analysis.

Guidance from the Department of Health and Human Services describes what a complete analysis includes. In practice, it comes down to the items below. Nothing here is legal advice for your situation; it is the shape of the work.

1. The whole scope, not just the EHR

The analysis covers all electronic protected health information, wherever it lives: the EHR, but also email, laptops, phones, backups, the scanner that keeps copies, the imaging workstation and the cloud tools staff adopted without asking.

2. Where the data goes

Document where the information is created, received, stored and sent. A simple data-flow sketch, from front desk to billing service to lab, is often the most useful page in the whole file.

3. Threats and vulnerabilities

List what could reasonably go wrong, from ransomware and a lost laptop to a misdirected fax or a former employee whose login still works, and the weaknesses that would let it happen.

4. The controls you already have

Record the security measures in place today and whether they are actually configured and used. Encryption that is available but switched off does not count.

5. Likelihood and impact

For each threat, estimate how likely it is and how bad it would be. A plain high, medium and low scale is fine, as long as you apply it consistently and can explain your reasoning.

6. A level of risk for each item

Combine likelihood and impact into a risk level. That ranking is what turns the analysis into a work plan: the high risks are the ones your risk management plan has to address first.

“

The auditor did not start with our policies. The first request was the analysis, the date on it, and what we had done about the top five risks since.

7. Documentation and a date to do it again

Write it all down, keep it, and review it periodically and whenever something significant changes: a new EHR, a move, a merger, a breach. An analysis that was thorough three years ago and never touched since is one of the most common findings in enforcement actions.