← All guides
Owner guide
The HIPAA risk analysis, in plain English
HIPAA requires every practice to look honestly at its security risks and act on what it finds. That is the risk analysis.
What it is
A written review of where patient information lives in your practice, what could go wrong, how likely it is, and what you are doing about it. It is required under the HIPAA Security Rule (45 CFR 164.308). There is no small-practice exemption.
What it covers
- Computers, servers, and phones that hold or reach patient data
- Email, your EHR, and cloud services
- Your office: locks, screens, and paper
- People: training, access, and vendor agreements
How often
Review it regularly and whenever something changes, such as a new EHR, a new office, or a security incident. Many practices do it every year.
Doing it yourself
HHS offers a free Security Risk Assessment Tool. It is a good start, but it asks technical questions many owners cannot answer alone.
Questions? Talk to us, or start with a free exposure check.