How to Run a HIPAA Security Risk Assessment: A Step-by-Step Walkthrough

Every HIPAA obligation a practice carries sits on top of a single document, and it is the document many practices do not really have: the security risk assessment, or SRA. The Security Rule requires it by name. It is the first item the Office for Civil Rights asks for when an investigation opens, and a missing or inadequate assessment turns up in enforcement action after enforcement action.

Our complete guide to HIPAA compliance for healthcare IT explains why the SRA matters. This article is about doing it. It follows the working process we use with Houston-area practices, written for practice managers rather than IT staff, and it ends with a checklist you can print and work through.

A word of reassurance first. You do not need a security certification to do this. An SRA is a structured inventory paired with honest answers. The method is not the hard part; the hard part is finishing it completely and then following through on the plan it produces.

Scoping is where assessments most often go wrong. A practice reviews the EHR and the server, declares victory, and never notices that patient data is moving through a dozen other systems that nobody listed.

The scoping rule is short: electronic protected health information (ePHI) is in scope anywhere it is created, received, stored or transmitted. That means where it actually goes, not just where policy says it should be.

List the obvious systems first, then go hunting for the ones practices overlook. These are the strays that real assessments keep finding:

• Fax-to-email services: referrals and records arrive as email attachments, sit in mailboxes, and are often forwarded automatically.
• VoIP voicemail and call recordings: patients leave names, symptoms and callback numbers, and modern phone systems keep those as files in the cloud.
• Backup drives and old external disks: complete copies of everything, often unencrypted, sometimes in a desk drawer or at an employee's home.
• Staff texting: shift swaps and patient questions on personal phones over standard SMS, with no encryption and no management.
• Copiers, scanners and printers: multifunction devices keep images of what they scan on internal hard drives, and those drives leave with the machine when the lease ends.
• Personal devices and home computers: anywhere staff check email or log into the EHR portal from outside the office.
• Billing clearinghouses and patient-payment tools: claims data counts as ePHI, and so do payment records tied to treatment.
• Spreadsheets and downloads: that one-time Excel export of the recall list from years back, still saved on somebody's desktop.

Walk through the office in person. Ask each role to show you how they really work ("walk me through what happens when a referral comes in"), and write down every system, device and data flow you see. Pay close attention to communication channels, because that is where otherwise careful practices leak. If the inventory turns up patient texting or PHI in voicemail, Talk Is Cheap's guide to HIPAA-compliant communications explains what makes a texting platform acceptable and how phone systems should be set up, and fixing those channels will probably become an item in your remediation plan.

This step produces your ePHI inventory: a single table that lists each system, the data it holds, where it lives physically or in the cloud, who can get to it, and which vendor runs it. Everything else in the SRA is built on that table.

Take each item in the inventory and ask two questions. What could go wrong here? That is the threat. What weakness would allow it? That is the vulnerability.

For a typical practice, the threats worth working through include:

• Ransomware and other malware that encrypts or steals the systems the practice depends on
• Phishing and stolen credentials, where an attacker takes over a staff mailbox and works from inside it
• Lost or stolen devices, such as the laptop left in a car or the phone left at a coffee shop
• Insider misuse, like staff browsing the records of people they know, or data walking out with someone who is leaving
• Access that outlives employment: logins that still work weeks after a person's last day, one of the findings practice assessments turn up most often
• A breach at a vendor, where your billing company, IT provider or cloud platform is compromised and takes your data with it
• Physical and environmental events: flood, fire or a long power outage. Around Houston, hurricane season is a threat that comes with dates attached.
• Plain human error, such as a fax sent to the wrong number or an attachment emailed to the wrong patient

Vulnerabilities are the weaknesses specific to your practice that give a threat its opening: email without MFA, a shared login on the exam-room computers, an unencrypted backup drive, no checklist for offboarding staff, a server on an operating system that no longer gets security patches. Write them down as pairs, for example "ransomware (threat) through an unpatched server with no MFA (vulnerabilities)," because those pairs are what you rate next.

Nobody fixes everything at once, so the SRA asks you to set priorities honestly. Keep the method simple enough that you will really use it. Score each threat and vulnerability pair on likelihood (how plausible is this over the next year or two?) and impact (how bad would it be?), using a three-point scale for each, then read the risk level from this grid:

• High likelihood: low impact is a medium risk, medium impact is a high risk, and high impact is critical and gets fixed first.
• Medium likelihood: low impact is a low risk, medium impact is a medium risk, and high impact is a high risk.
• Low likelihood: low or medium impact is a low risk, and high impact is a medium risk.

Impact is more than downtime. Breach notification duties, regulatory exposure and patient trust all belong in the score. A stolen unencrypted laptop may be unlikely, but if it happens, every record on it becomes a reportable breach, so it ranks high. Phishing aimed at staff email is likely almost everywhere, and its impact depends on what that mailbox can reach.

Avoid scoring everything as medium. The value of this step is the separation it creates: a short list of critical and high risks that get owners and dates, sitting above a longer tail of routine maintenance.

Go risk by risk and note the protections already working: MFA, encryption, scheduled backups, periodic access reviews, staff training, locks on doors and cabinets, and business associate agreements on file. Then comes the part that requires honesty. Record what you do not have.

Gaps are not an embarrassment. Finding them is the reason you are doing this. An SRA that turns up nothing was not looking, and regulators consistently go easier on a practice that wrote down a gap and scheduled the fix than on one whose paperwork claims perfection the evidence contradicts.

This step may feel familiar. It is the same work as a general IT assessment, aimed through a regulatory lens, and a practice that had one recently can reuse much of that inventory and control documentation here.

Each gap becomes a row in the remediation plan, and every row answers four questions: what was found, what will fix it, who owns it, and by when. "IT will take care of encryption" does not qualify. "Dana, the office manager, confirms with our IT provider that full-disk encryption is on all nine practice laptops by March 31" does.

Order the work by the ratings from Step 3, criticals first. Those are usually MFA, encryption, access cleanup and backup verification, because those four shut the most dangerous doors quickly. Fixes that are cheap and fast should not wait behind big projects whatever their rating; disabling a former employee's account takes about ten minutes.

Budgets are allowed to be real. If the server replacement belongs in next fiscal year, the plan can say exactly that. A deferral that is dated, funded and documented is a legitimate risk decision. An open-ended "someday" is not.

This is the counterintuitive part, and the place practices most often hurt themselves: a risk assessment whose remediation plan is never worked is worse than having no assessment. It is written proof that you knew about particular problems and chose to leave them, which comes very close to how regulators define willful neglect. Under HIPAA's tiered penalty structure, that is the line between the lowest tiers and the most expensive one, and HHS adjusts the dollar amounts for inflation every year.

So make evidence a habit:

• Review the plan monthly or quarterly as a standing 20-minute agenda item, not a special project.
• Log each completion with its date and proof: the screenshot showing MFA enforced, the restore-test log, the training roster.
• Move dates honestly when they slip, with a note explaining why and the new target. A revised plan shows management at work; a deadline that quietly passed shows neglect.
• Keep every version. This year's SRA filed beside last year's, with risks retired and new ones added, is the most persuasive exhibit a practice can offer.

That paper trail is exactly what sets the penalty tier. A practice with a current SRA, a plan being worked and dated evidence that still suffers a breach lands in the low tiers, and OCR often settles cases like that with a corrective action plan rather than a fine. Keeping this rhythm of assessments, reviews and evidence files going all year is the core of our compliance support work for healthcare clients.

Work through the phases in order. Each one produces a document, and together those documents are your SRA.

Phase 1: Inventory (weeks 1 to 2)

• Record each system that handles ePHI in any way, and include the usual strays: fax-to-email, voicemail, staff texting, backups and copiers.
• Walk the office and interview each role about how the work really happens.
• For each system, record the data it holds, where it lives, who has access and which vendor runs it.
• Pull your vendor list and match each vendor that touches ePHI to a signed BAA.

Phase 2: Risk analysis (weeks 2 to 3)

• For each system, pair threats with the vulnerabilities that would let them succeed.
• Rate every pair on the three-by-three likelihood and impact grid.
• Sort the results into critical, high, medium and low.

Phase 3: Controls and gaps (week 3)

• Document the safeguards already in place: administrative, physical and technical.
• Document every gap, without softening any of them.

Phase 4: Remediation plan (week 4)

• Give each gap one row: finding, fix, named owner, target date.
• Schedule criticals and quick wins first, with dated deferrals for budget items.

Phase 5: Evidence discipline (ongoing)

• Put a monthly or quarterly plan review on the calendar.
• File proof of each completion as it happens.
• Keep every SRA version, year after year.

Complete the full assessment every year. Many practices tie it to a quiet month or to their insurance renewal so it never falls through the cracks. Between annual passes, revisit the affected part of the assessment after any significant change. Typical triggers are switching EHR or practice management software, opening another office, merging with or buying a practice, launching telehealth, adding an AI or automation tool that handles patient data (our post on what is safe to automate under HIPAA helps sort those), or a significant new vendor. Each of those changes the inventory, and an inventory that no longer matches reality quietly undermines the entire document.

The annual pass is where the cycle closes. The plan you wrote twelve months ago turns into the record of what you fixed, and today's findings seed the next plan. That rhythm, more than any single binder, is what a compliance program really means, and it underpins everything else in the full HIPAA guide, from BAAs to breach readiness.

A small practice can absolutely assess itself. HHS offers a free SRA tool, and nothing described above needs more than a conference table and a few focused afternoons. Going it alone has two honest limits. One is blind spots, because nobody lists a system they have forgotten about. The other is momentum, because plans tend to stall around the third month. An outside assessment adds an unbiased reviewer, a more complete inventory, and documentation from a party regulators tend to trust.

Talos performs HIPAA-focused assessments for Houston-area practices through our healthcare IT services. With a new client it is frequently where we begin, since every later project depends on its findings. If your practice has never completed an SRA, or the last one is collecting dust beside a plan nobody worked, contact us to schedule a HIPAA-focused assessment. We will build the inventory with you and hand over the findings and the remediation plan in writing, and you can carry out the plan with us or on your own.

A HIPAA security risk assessment is a written review covering each system in your practice that touches ePHI. It records the threats and vulnerabilities facing each one, how likely and how damaging each risk is, the controls you have and the gaps you found, and a remediation plan with owners and dates. The Security Rule requires it, and OCR asks for it first in an investigation.

At least once a year, with a scoped update whenever something material changes, such as a new EHR, a new location, a merger, the start of telehealth or a significant new vendor that handles patient data. Each annual pass also reviews how far the previous year's remediation plan has come.

Yes. HIPAA does not require an outside firm, and HHS publishes a free SRA tool. Self-assessment usually falls short in two places: blind spots, since nobody lists a system they have forgotten about, and follow-through once the plan is written. An outside assessor adds an objective eye and documentation that carries weight with regulators.

A missing or inadequate SRA is one of the most common findings in OCR enforcement, and it pushes a case toward the willful-neglect penalty tiers, the most expensive part of a structure whose amounts HHS adjusts for inflation every year. It also weakens every other defense you have, because you cannot show that your safeguards match your actual risks.

Only when nobody is working the plan. Open items that carry a named owner, a target date and a record of progress demonstrate good faith and keep a practice in the lowest tiers. The real danger is a plan that was written once and then shelved, because it documents problems you knew about and left alone.