HIPAA Security Risk Assessment: Steps and Template (2026)

A HIPAA security risk assessment is the documented analysis of risks and vulnerabilities to all the electronic protected health information (ePHI) you create, receive, maintain or transmit. The Security Rule, at 45 CFR 164.308(a)(1)(ii)(A), requires every covered entity and business associate to have one. It maps where ePHI lives, pairs realistic threats with real vulnerabilities, rates each pair for likelihood and impact, and hands a ranked list to your risk management plan. HHS prescribes no method, tool or frequency, but it is one of the first documents the HHS Office for Civil Rights (OCR) reviews in an investigation, and a missing or inadequate risk analysis is a recurring finding in its resolution agreements.

Invadel does not sell or write risk assessments; your security official owns the analysis. We supply the technical evidence behind it: an analyst-validated vulnerability assessment from $1,500 and HIPAA penetration testing of the systems that hold ePHI, at published prices with a free retest.

HIPAA security risk analysis vs security risk assessment

The regulation says risk analysis. The free HHS tool says security risk assessment. NIST’s HIPAA guide uses “risk analysis” for the legal requirement and “risk assessment” for the process that meets it (NIST SP 800-66 Rev. 2, Section 3.1). It is one obligation: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold (45 CFR 164.308).

Four neighboring provisions get blurred together with it. OCR treats all five as separate items:

Provision	What it requires	What you produce
Risk analysis, 164.308(a)(1)(ii)(A), required	Identify and rate the risks to all ePHI	A dated report and risk register
Risk management, 164.308(a)(1)(ii)(B), required	Reduce those risks to a reasonable and appropriate level	A plan with owners, dates and proof of closure
Evaluation, 164.308(a)(8), required standard	Periodic technical and nontechnical evaluation of your safeguards	An evaluation report, including technical testing
Documentation, 164.316(b), required standard	Keep it in writing for six years and update it as conditions change	Retained, versioned records
Breach risk assessment, 164.402	After an impermissible use or disclosure, a four-factor assessment of whether PHI was compromised	A per-incident breach determination, not the risk analysis

A penetration test is none of these on its own. It is the technical input to the first, the proof of closure for the second, and the technical half of the third. Our HIPAA compliance checklist lists every safeguard with the evidence to keep; the general method is in our security risk assessment guide.

Does HIPAA require a security risk assessment?

Yes. Risk analysis is a required implementation specification, not an addressable one, and it binds business associates directly. Three things add weight in 2026:

• OCR enforcement. OCR’s Risk Analysis Initiative targets this one provision. Its June 2026 settlement with the Spencer Gifts group health plans was the initiative’s 14th enforcement action (HHS). In September 2026 Ambry Genetics paid $700,000 after a phishing attack affecting about 225,000 people, with failure to conduct an accurate and thorough risk analysis among the potential violations cited (HHS).
• Medicare incentive programs. MIPS clinicians must attest to the Security Risk Analysis measure each performance year, and for 2026 CMS added a second attestation covering risk management under 164.308(a)(1)(ii)(B) (CY 2026 Physician Fee Schedule final rule). Without both, the Promoting Interoperability category earns no score.
• Recognized security practices. Since a 2021 HITECH amendment, HHS must consider whether you had recognized security practices in place for the previous 12 months when setting fines, audit outcomes and settlements (42 U.S.C. 17941). Record in the risk analysis which practices you follow, and since when.

New York general hospitals have one more reason. 10 NYCRR 405.46 requires an annual risk assessment and accepts one performed for HIPAA, provided it meets that regulation’s own requirements. Our page on the 10 NYCRR 405.46 risk assessment and testing rules covers the differences.

How to do a HIPAA security risk assessment: the nine elements

HHS’s Guidance on Risk Analysis names nine elements and requires no particular method. NIST SP 800-66 Rev. 2 lays out the same work as seven steps. Skip one of the nine and the analysis is hard to defend as accurate and thorough.

1. Scope: all ePHI, not only the EHR

Every system, site, device and vendor that touches ePHI. NIST’s preparation step (Section 3.2) covers teleworkers and remote access, removable media, laptops and phones, connected medical devices and ePHI sent to cloud providers, and flags tracking technologies on patient-facing websites as a consideration. The common failure is an analysis that covers the EHR and skips email, file shares, backups, the billing vendor and the copier that stores every page it scans. Connected devices belong in scope as you run them; what their manufacturers must test is a separate subject, covered in our guide to medical device penetration testing.

2. Data collection: where ePHI enters, moves, rests and leaves

Inventory the systems and owners, how ePHI arrives (portals, interfaces, fax), where it flows and is stored, and where it leaves (clearinghouses, labs, business associates). Draw on past assessments, asset exports, network diagrams, business associate agreements and interviews.

3. Identify threats and vulnerabilities

Threats are natural, human (phishing, ransomware, insider misuse, error) and environmental. Vulnerabilities are the technical and nontechnical weaknesses they would use. NIST lists vulnerability scan and security test results, such as penetration tests, among the sources for this step. This is where testing enters: a finding is a documented vulnerability, not an assumed one. If the three terms blur together, threat vs vulnerability vs risk defines each with worked examples.

4. Assess current security measures

Record each control and whether it works as intended. A policy requiring MFA on remote access is a control on paper; a test that logs in to a legacy VPN portal with a password alone shows the control failing in practice. Map controls to the safeguards, covered in our guides to administrative and physical safeguards and technical safeguards.

5. Determine likelihood

Rate the probability that each threat exploits each vulnerability on a defined scale. Use evidence: a weakness a tester exploited in a day from a standard user account is not “low likelihood,” whatever the questionnaire said.

6. Determine impact

Rate the harm: records exposed, care disrupted, systems down, data altered. Score confidentiality, integrity and availability separately, because ransomware hits availability first and, when data is copied out before encryption, confidentiality too.

7. Determine the level of risk

Combine the two. NIST’s sample matrix (Table 6 in SP 800-66 Rev. 2) is a reasonable default:

Likelihood	Low impact	Moderate impact	High impact
High	Low	Moderate	High
Moderate	Low	Moderate	Moderate
Low	Low	Low	Low

Any matrix works if you apply it consistently and explain it in the methodology.

8. Finalize documentation

Write it down, date it, name the approver, keep it six years. NIST suggests a risk register holding every threat and vulnerability pair with its ratings.

9. Review and update periodically

Keep it current as systems, vendors and threats change (timing below).

HIPAA risk assessment template

A usable template has two parts: a report explaining the analysis and a register holding the results.

The report outline

Section	What it contains	What it evidences
1. Ownership and approval	Security official, approver, date, version	Assigned responsibility, 164.308(a)(2)
2. Scope	Entities, sites, systems and vendors in scope; exclusions with reasons	HHS element 1
3. Methodology	Framework, rating scales, data sources, tests and scans used	That the analysis is accurate and thorough
4. ePHI inventory and data flows	Asset list, network map, business associates	HHS element 2
5. Threats and vulnerabilities	Pairs per asset group, each with its evidence source	HHS element 3
6. Current controls	Mapped to 164.308, 164.310 and 164.312	HHS element 4
7. Risk ratings	Likelihood, impact and level for every pair	HHS elements 5 to 7
8. Risk register and treatment	Mitigate, accept, transfer or avoid; owner; due date	The hand-off to risk management
9. Recognized security practices	Framework in use and the date adopted	42 U.S.C. 17941
10. Review log	Review dates, triggers, next scheduled review	HHS element 9

Risk register columns

ID, asset or ePHI flow, threat, vulnerability, evidence source (interview, scan, test finding ID, vendor attestation), existing controls, likelihood, impact, risk level, treatment, owner, due date, status, closure evidence (a retest or rescan date) and the Security Rule citation. Download the register as a spreadsheet with the six sample rows below filled in: HIPAA risk register template (XLSX).

To start your own register, copy the two lines below into a text file, save it with a .csv extension and open it in any spreadsheet. The first line is the header row; the second is an example to overwrite.

ID,Asset or ePHI flow,Threat,Vulnerability,Evidence source,Existing controls,Likelihood,Impact,Risk level,Treatment,Owner,Due date,Status,Closure evidence,Security Rule citation
R-001,Patient portal,Data exposure,Changing a record number opens another patient's lab results,Penetration test finding,Login required but no per-record check,High,High,High,Fix the authorization check and retest,Application owner,2026-12-15,Open,,164.312(a)(1)

For the technical findings that feed the register, our vulnerability assessment report template gives a free format with a filled-in example.

Likelihood and impact scales you can adopt

HHS and NIST let you choose the scale. What matters is that each level has a written definition, so two people rating the same row reach the same answer. A three-level set that fits the matrix above:

Level	Likelihood	Impact
High	The weakness is exposed to the threat today and no working control stands in the way; it has been exploited in a test, in an incident of yours, or in current attacks on similar organizations	ePHI for a large share of patients disclosed, altered or unavailable; care delayed or diverted; breach notification likely
Moderate	The weakness is real, but exploiting it needs something more: a foothold inside the network, a second flaw, or an existing control to fail	A limited set of records or one system affected; operations disrupted but care continues
Low	A tested control blocks the path, or the threat has no realistic route to the weakness	No ePHI exposed or changed; a brief inconvenience handled in normal operations

Put these definitions in the methodology section of the report and use them unchanged from one review to the next, or year-on-year comparisons mean nothing.

Sample rows

Illustrative rows showing the level of detail an investigator can follow, not client data:

Asset or ePHI flow	Threat and vulnerability	Evidence	Likelihood / impact	Risk	Treatment
Patient portal	Data exposure: changing a record number opens another patient’s lab results	Penetration test finding	High / High	High	Fix the authorization check, retest in 30 days
Domain and file servers	Ransomware: a phished workstation reaches Domain Admin via a reused local admin password	Internal penetration test	High / High	High	Unique local admin passwords, separate admin accounts, retest
Backup server	Ransomware: backup console reachable with domain admin rights	Internal test, configuration review	Moderate / High	Moderate	Isolate backups, keep an immutable copy, test a restore
Front desk mail	Phishing: shared mailbox login with no MFA	Microsoft 365 review	High / Moderate	Moderate	Individual accounts, enforce MFA
Former billing vendor	Unauthorized access: VPN account active after the contract ended	Access review	Moderate / High	Moderate	Disable it, add vendors to termination procedures
Clinic laptops	Theft: disk encryption not enforced on some devices	Endpoint management report	Moderate / High	Moderate	Enforce encryption, document any exception

Both High rows are the kind only testing produces; a questionnaire would have marked those controls as in place.

Where the HHS SRA Tool fits, and where it stops

The free Security Risk Assessment Tool from ASTP/ONC and OCR, now version 3.7, runs as a Windows application or an Excel workbook. It walks through questions, threat and vulnerability assessments and asset and vendor inventories, produces a report, and keeps data on your computer (HealthIT.gov). It is built for small and medium providers; HealthIT.gov notes it may not suit larger organizations and that using it neither is required nor guarantees compliance.

NIST names the gap: a questionnaire cannot identify technical vulnerabilities, so the SRA Tool should be paired with a method that can, such as vulnerability scanning (SP 800-66 Rev. 2, Section 3.4). The tool records what you believe about your controls. A scan or test shows what is true.

Common gaps in a HIPAA risk analysis

OCR resolution agreements and what testers commonly find point to the same list:

• Scope that stops at the EHR, leaving out email, backups, business associates and cloud services.
• A checklist instead of an analysis: yes or no answers with no threats, vulnerabilities or ratings.
• No inventory, so the analysis cannot be thorough by definition.
• Written once and never updated after a migration, a new telehealth platform or an incident.
• Risks with no plan: nothing in the register has an owner or a date.
• No technical evidence, so the ratings are guesses.

How often to update a HIPAA security risk assessment

The current rule sets no fixed interval. It requires reviewing security measures as needed (164.306(e)), updating documentation after environmental or operational changes (164.316(b)(2)(iii)), and repeating the evaluation when changes affect ePHI security (164.308(a)(8)). HHS calls risk analysis an ongoing process, and NIST warns against treating it as a one-time task.

In practice: a full review every year, which MIPS clinicians already need and the proposed rule would require of everyone, plus an update after a new EHR or billing system, a cloud migration, a new portal or telehealth app, a merger or new site, a new business associate with ePHI access, a security incident (yours or a vendor’s), or test results that change your ratings.

What the proposed Security Rule would change

The January 2025 proposal would make the risk analysis its own standard at a renumbered 164.308(a)(2) (Federal Register): a written, “accurate and comprehensive” assessment with eight minimum elements, from a technology asset inventory and network map to the risk each business associate poses based on its written verification, reviewed at least every 12 months and after relevant changes. The same proposal adds vulnerability scans at least every six months and a penetration test at least every 12 months (proposed 164.312(h)).

As of November 2026 none of this is final. The 2026 Unified Agenda moved the rule to long-term actions, with final action projected for July 2027 (reginfo.gov), and OCR enforces the current rule.

Who should perform the risk assessment?

The Security Rule does not say who must do the work. It makes one person answerable for it: the security official you designate under 164.308(a)(2). In practice there are three options, and each has an independence question to answer.

Who	Works well when	Watch for
Your security official with internal IT	Staff know the systems and data flows	People rating controls they built and run themselves
Your managed service provider	A small practice has no IT staff	The provider grading its own work; ask who reviews the ratings
An outside compliance or security firm	You want a method an investigator will recognize and a second opinion on ratings	A report written without interviews or technical evidence; you still supply the inventory and own the result

Whoever does it, two things cannot be outsourced: leadership approves the report and accepts the residual risk in writing, and the regulated entity stays responsible for its accuracy. Technical evidence works best from a party that neither built nor operates the controls, which is the role a tester plays.

Where testing feeds the assessment, and what it costs

HIPAA does not require an outside party for the risk analysis; your security official, an internal team or a compliance firm can. An outside tester adds the evidence for elements 3 to 7 and the retest that proves your risk management worked. At our published starting prices:

Testing evidence	What it feeds in the analysis	From
Vulnerability assessment, internal or external	Validated vulnerability list for every scanned system	$1,500 up to 250 devices, $2,500 up to 1,000
External network penetration test	Likelihood for internet-facing systems and remote access	$4,200
Internal network penetration test	Likelihood and impact for ransomware and lateral movement	$6,000
Web application test of the patient portal	Access control between patient records	$5,200
API test of FHIR and EHR integrations	Authentication and over-broad data returns	$4,000
Microsoft 365 or Google Workspace assessment	Mailboxes and drives holding ePHI	$4,200
Phishing simulation	The human likelihood behind phishing-led ransomware and mailbox compromise	$3,600

A single-office practice under 250 devices might pair an external test with an internal vulnerability assessment: $5,700; a second assessment six months later, as the proposed rule would require, makes it $7,200. A health-tech vendor facing a hospital’s security review before a business associate agreement might pair a web application test with an API test: $9,200.

Every penetration test includes a free retest of remediated findings, which becomes the closure evidence in your register (phishing excepted). Reports map findings to the Security Rule safeguards, as our HIPAA penetration testing page describes, and include an attestation letter; the sample penetration test report shows the finding format that goes into the register. Prices are fixed in writing from your scope with no sales call, and onboarding starts within 24 hours of a signed proposal. Clinical systems are tested around patient safety, as our healthcare penetration testing page explains. For the wider budget see HIPAA compliance cost; the pricing calculator totals several tests.

Frequently asked questions

What are the steps in a HIPAA security risk assessment? Scope every system that touches ePHI, map where it flows, identify threats and vulnerabilities, assess current controls, rate likelihood, impact and risk level, document the result, and review it after changes. HHS lists nine elements; NIST SP 800-66 Rev. 2 groups them into seven steps.

What is the difference between a HIPAA risk assessment and a HIPAA risk analysis? Under the Security Rule, none: the rule says “risk analysis” and the HHS tool says “security risk assessment.” The breach risk assessment under 164.402 is a separate, per-incident document.

How often should a HIPAA security risk assessment be conducted? The current rule sets no fixed interval but requires keeping it current. Review it fully once a year and after significant changes such as a new EHR, a cloud migration or an incident; the proposed rule would make the annual review mandatory.

Is the HHS SRA Tool enough on its own? No. It is a reasonable framework for a small practice, but NIST notes a questionnaire cannot identify technical vulnerabilities and should be paired with vulnerability scanning.

Who can perform a HIPAA security risk assessment? Anyone with the knowledge to do it accurately and thoroughly: your security official, internal IT, a managed service provider or an outside firm. HIPAA requires no certification or outside party. Your designated security official stays responsible for the result whoever writes it.

Is there a free HIPAA risk assessment template? HHS publishes the free SRA Tool for small and medium providers. This page adds a ten-section report outline, a register header row you can copy into a spreadsheet, rating definitions and six sample rows.

How much does a HIPAA risk assessment cost? The HHS SRA Tool is free, and doing the analysis in-house costs staff time. Outside firms quote by the number of sites, systems and vendors in scope. Invadel does not sell the assessment; the testing evidence behind it starts at $1,500 for a validated vulnerability assessment of up to 250 devices.

Is a penetration test the same as a HIPAA risk assessment? No. The assessment covers every risk to ePHI; a penetration test proves which technical vulnerabilities are real. Its findings feed the assessment, and the retest documents the fix.

What are the three types of HIPAA security safeguards? Administrative (164.308), physical (164.310) and technical (164.312). The risk analysis sits in the administrative safeguards and shapes how you implement the other two.

The short version

A HIPAA security risk assessment is a required, written analysis of every risk to your ePHI, updated yearly and after major changes. The weakest analyses are questionnaires with no technical evidence. Give yours real findings with a validated vulnerability assessment from $1,500 or an internal network penetration test from $6,000, each with a free retest (all prices), or scope a HIPAA test and get a fixed price the same day.