HIPAA security risk assessments, in plain English

What the rule actually requires

The HIPAA (show definition) Security Rule requires every covered practice and many of their vendors to do a security risk assessment. This is not a form you fill out once and file away. It is a documented look at where patient health information lives, how it moves, and what could go wrong.

This is general information, not legal advice. Talk to a qualified compliance professional or attorney about your specific obligations.

What the assessment should cover

• Where patient data is stored, including servers, laptops, phones, backups, and cloud tools
• Who can access that data and how access is granted or removed
• Technical safeguards in place, like Multi-factor authentication (MFA) (show definition), encryption, and Patching (show definition)
• Physical safeguards, like locked server rooms and screen privacy in patient areas
• Administrative safeguards, like training records and written policies
• Third parties who touch patient data, such as billing companies or IT vendors

How often to update it

A risk assessment is not a one-time event. Update it on a regular schedule, at least once a year, and any time something changes the picture. That includes adding a new software system, opening a new location, changing IT vendors, or having a security incident.

Documentation matters as much as the work

If an auditor or investigator ever asks for your risk assessment, the date matters, the findings matter, and what you did about the findings matters. A risk assessment with no record of follow-up looks the same as no risk assessment at all.

• Keep a dated copy of every assessment, not just the most recent one
• Record each finding with an owner and a target date to fix it
• Note when a finding was closed and how
• Keep training records separate and up to date

Common gaps in small practices

• The last risk assessment is several years old or was never updated after a system change
• Access lists are not reviewed, so former employees or vendors still have logins
• Backups exist but have never been tested for restore
• Staff training happened once, at hire, with nothing since
• No one owns the assessment; it is assumed to be the IT vendor's job

Where to start if you are behind

If your last risk assessment is old or missing, start with an honest inventory: what systems hold patient data, who has access, and what safeguards exist today. Write it down. A simple, honest document beats a polished one that does not reflect reality.