HIPAA Security Risk Analysis: How to Do It Right

All ePHI, everywhere: EHR and practice management systems, email, file shares, databases, cloud services (including shadow SaaS), medical devices and biomedical equipment, mobile and remote endpoints, backups and media, and PHI held by or flowing to business associates. The most common scoping failure is analyzing 'the EHR' while ignoring the imaging system, the billing vendor's SFTP drop, the marketing team's web forms, and departed-employee laptops. The analysis identifies threats and vulnerabilities per asset or asset class, rates likelihood and impact, documents current controls, and lands each risk at a level your risk management plan then accepts or treats.

Three recurring substitutes fail: (1) a Security Rule gap assessment, checking whether each rule provision has a policy, which measures paperwork, not risk; (2) a penetration test or vulnerability scan, which samples technical weaknesses but does not inventory ePHI or assess enterprise risk; (3) a vendor questionnaire or automated tool run against part of the environment. OCR's guidance requires the analysis to be accurate and thorough for the entire organization. In resolution agreements, OCR repeatedly recites that the entity 'failed to conduct an accurate and thorough risk analysis' even where the entity had produced one of these substitutes.

The rule says the analysis must be current, OCR reads this as periodic review plus event-driven refresh. Triggers: new or replaced systems (EHR migration, new cloud platform), mergers and acquisitions, new service lines (telehealth was the classic example), material incidents, and organizational restructuring. Annual review is the de facto industry standard and the cadence corrective action plans typically impose. The dated version history matters as much as the content: an investigator's first question after a breach is when the analysis was last updated and whether it covered the breached system.

An enforcement program OCR announced in October 2024 focusing specifically on the risk analysis requirement, on the logic that most large breaches trace back to unassessed risk. It has produced a continuing series of settlements against providers, plans, and business associates, typically following ransomware or hacking breaches, where the investigation found no enterprise-wide risk analysis. The settlements pair five- to seven-figure payments with multi-year corrective action plans requiring a compliant analysis, a risk management plan, and OCR monitoring. Its practical message: after a breach, the absence of a current risk analysis converts an incident into a violation.

OCR's own guidance is methodology-neutral but element-specific; NIST SP 800-30 (risk assessment) operationalized through SP 800-66r2 (the NIST-HIPAA crosswalk) is the accepted mainstream approach, and HHS's Security Risk Assessment Tool suits smaller practices. Whatever the method, produce: an ePHI asset inventory with data flows; a threat/vulnerability catalog per asset; likelihood-impact ratings with rationale; current-control documentation; residual risk levels; and a signed, dated report feeding a risk management plan with owners and deadlines. Six-year retention. If a regulator, cyber insurer, and your own security team can each use the document, it is probably right.