HIPAA Risk Assessment: What Your IT Has to Be Able to Show

Is a HIPAA risk assessment required?

Yes. The Security Rule lists risk analysis as a Required implementation specification. The text in 45 CFR 164.308(a)(1)(ii)(A) says to “conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.” The next line requires risk management, meaning you then have to fix what you found, down to “a reasonable and appropriate level.”

It applies to every covered entity and business associate, regardless of size. A three-provider clinic is held to the same rule as a hospital. What changes with size is which controls are reasonable, not whether you have to look.

OCR is watching for it. HHS runs a Risk Analysis Initiative, and its February 2026 settlement with Top of the World Ranch Treatment Center was the 11th enforcement action under it. That case started with a phishing attack on one staff email account. OCR’s finding was that the provider had not done an accurate and thorough risk analysis. The corrective plan’s first item was to go do one.

If you run a practice and want the wider picture of what the Security Rule asks of your IT, our medical practices page walks through it.

How often do you have to do it?

The rule doesn’t give a number. HHS’s own Guidance on Risk Analysis says the Security Rule “does not specify how frequently to perform risk analysis,” and that the process “should be ongoing.”

Two parts of the rule force the issue anyway. 164.308(a)(8) requires a periodic evaluation in response to “environmental or operational changes.” 164.316(b)(2) requires you to review your documentation periodically, update it as needed, and keep it for six years from creation or from the last date it was in effect.

In practice, the triggers HHS names in that guidance are the ones that matter: a security incident, a change in ownership, turnover in key staff, or new technology. A new EHR, a move to a new office, a switch to Microsoft 365, or a breach. Any of those means the old assessment no longer describes your office.

We tell practices to do it on a calendar and on every one of those changes. Once a year is a reasonable floor. It isn’t a legal number, it’s just how often things change in a small office.

What does IT need to produce?

The evidence. HHS’s guidance lays out what a risk analysis has to cover: every place ePHI is stored or sent, the threats and vulnerabilities to it, the security measures already in place, likelihood, impact, and a risk level for each. Most of those inputs live in your IT systems. Here is what we expect a practice’s IT to hand over.

An asset inventory. HHS’s guidance says the scope covers “all e-PHI,” on every kind of electronic media, from “a single workstation” to networks across locations. You can’t assess what you can’t list. That means every workstation, laptop, server, and storage device, with serial numbers, owner, and location. 164.310(d)(2)(iii) also asks you to keep a record of the movement of hardware and media. Pull it from live systems. We built one for a cyber insurance audit in Insurance Audit Hardware Inventory: 312 Assets in 47 Minutes, and the same script output works here.

Encryption status, per device. Encryption is an addressable specification under 164.312(a)(2)(iv). Addressable does not mean optional. Under 164.306(d)(3), you either implement it or document why it isn’t reasonable and put an equivalent measure in place. For a laptop that leaves the building, that is a hard memo to write. The evidence is a list of every machine, whether its disk is encrypted, and where the recovery key is escrowed. See BitLocker Encryption at Scale for how we roll that out and keep the keys.

Access reviews. 164.308(a)(1)(ii)(D) requires you to “regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” 164.312(b) requires audit controls that record that activity in the first place. So IT should be able to show who has an account in the EHR, email, and file shares, that former staff are gone, and that someone looked at the logs.

Backups that have been restored. A data backup plan is Required under 164.308(a)(7)(ii)(A): “retrievable exact copies” of ePHI. Testing the contingency plan is addressable under (a)(7)(ii)(D). “Retrievable” is the word that matters. The only proof a backup is retrievable is a restore. Keep the date, what was restored, and how long it took.

The gaps. HHS’s guidance says the output should include risk levels and “a list of corrective actions.” An assessment with no findings is not believable. Your IT should be telling you what’s still weak and what it would take to fix it.

Who can do a HIPAA risk assessment?

You can. The rule doesn’t require a certified assessor or a specific method. HHS says “there is no single method or ‘best practice’ that guarantees compliance.” It does require you to name a security official under 164.308(a)(2), the person responsible for the policies.

For small practices, HHS and ONC publish a free Security Risk Assessment Tool, built for medium and small providers. It’s a good structure. The same page says plainly that using it “is neither required by nor guarantees compliance.” The tool asks the questions. Someone still has to answer them with real data.

That is where most small-practice assessments fall apart. The office manager answers “yes, laptops are encrypted” because someone said so once. Then the one unencrypted laptop gets stolen out of a car. If you use an outside firm, HHS’s risk management guidance is clear that the practice stays responsible for its own compliance, even when vendors do the work. Hiring help doesn’t hand off the liability.

So the honest division of labor: the practice owns the assessment and the decisions. IT supplies the evidence and does the fixes. A good IT provider also tells you when the answer to a question is “no.”

Key takeaways

What this looks like when we do it

When a practice comes on with us, we start with discovery, not a questionnaire. We pull the device inventory from our RMM, check encryption and key escrow on every machine, list accounts in Microsoft 365 or Google Workspace and the EHR where we have access, and look at what’s exposed at the firewall. We have found Remote Desktop open to the internet on day one of an onboarding. That’s the kind of finding a self-assessment checkbox misses.

Then we hand the practice the evidence in the shape the risk analysis needs: what holds ePHI, what protects it, what’s missing, and what we recommend first. The practice makes the calls. We do the work, and the evidence gets regenerated on a schedule so next year’s assessment is a refresh, not a rebuild. Backups get test restores, and we write down the results.

We’re a managed IT and compliance shop for regulated firms in Knoxville and East Tennessee, and HIPAA is one of the rules we map controls to. More on how we run it for clinics is on the medical practices page.

If your last risk assessment was a form someone filled out from memory, book a call and we’ll walk through what your IT can actually show.