HIPAA security risk assessment for small practices

Who this page is for

• Your insurer, a payer or a new IT company asked for the date of your last risk assessment.
• Someone did one years ago, and nobody can find it.
• A vendor sold you a “HIPAA compliance” package that may not include a real risk analysis.
• You want to know whether to do it yourself or hire someone.

The problem, in plain terms

A four-dentist practice moved to a cloud practice management system two years ago. The risk analysis in the binder predates the move. It lists a server that no longer exists and skips the cloud vendor, the new imaging software and the front desk’s texting app.

It’s out of date.

What the rule requires

The Security Rule’s first standard is the security management process in 45 CFR 164.308(a)(1). It has four required implementation specifications:

1. Risk analysis, 164.308(a)(1)(ii)(A): an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI.
2. Risk management, 164.308(a)(1)(ii)(B): security measures sufficient to reduce those risks to a reasonable and appropriate level.
3. Sanction policy, 164.308(a)(1)(ii)(C): sanctions for workforce members who don’t follow security policies.
4. Information system activity review, 164.308(a)(1)(ii)(D): regular review of records like audit logs and access reports.

Under 164.316(b), you keep the written assessment for 6 years from when it was created or last in effect, whichever is later.

The rule scales. Under 164.306(b), a practice weighs its size, capabilities, costs and the likelihood of each risk.

What a risk analysis includes, per HHS

HHS’s Guidance on Risk Analysis lists nine elements. It doesn’t require a format or a method.

Element	What it means for a small practice
Scope	All ePHI you create, receive, maintain or transmit, on any device or service
Data collection	Where ePHI lives: EHR or PM system, imaging, email, fax, phones, laptops, backups, vendors
Threats and vulnerabilities	What could reasonably happen: phishing, ransomware, lost laptop, ex-employee access, power loss
Current security measures	What you have in place now and whether it’s configured and used correctly
Likelihood	How probable each threat and vulnerability pair is
Impact	How bad it would be for confidentiality, integrity and availability
Level of risk	A rating that combines likelihood and impact, with corrective actions
Documentation	A written record that feeds your risk management plan
Periodic review	Keeping it current as things change

The guidance also says there is “no single method or ‘best practice’ that guarantees compliance.” It cites NIST SP 800-30 as one example.

The HHS SRA Tool

The Security Risk Assessment Tool comes from ONC and OCR. HHS built it for small and medium-sized providers and says it “may not be appropriate for larger organizations.”

• Version: 3.7, with the HealthIT.gov page last updated September 18, 2026.
• Formats: a Windows desktop app for 64-bit Windows 7, 8, 10 and 11, and an Excel workbook.
• What it asks: multiple-choice questions, threat and vulnerability assessments, and asset and vendor management. Version 3.7 adds questions on scope, remote access and telework, asset inventory and activity logging.
• Output and cost: printable reports at the end; offered as a direct download with no price listed.

HHS says using the tool is “neither required by nor guarantees compliance” with federal, state or local law. It gives your analysis structure; it isn’t a certificate.

How often to do it

The current rule doesn’t set a number. HHS’s guidance says “The Security Rule does not specify how frequently to perform risk analysis,” and that the process “should be ongoing.”

The guidance lists events that call for an update: a security incident, a change in ownership, turnover in key staff or management, and new technology, such as a new EHR, IT company or email platform.

HHS also notes that some organizations perform the analysis annually or as needed. A yearly review keeps the date on the document current, but it’s a practical choice, not a requirement in today’s rule.

Doing it yourself vs hiring help

Approach	Fits	What you get	Watch out for
You, with the HHS SRA Tool	1 to 10 staff, one location, mostly cloud software	A structured walk-through and a printable report	It only knows what you tell it; most gaps come from systems nobody listed
You plus your IT company	5 to 25 staff with an outside IT provider	Better technical answers about backups, patching, firewalls and remote access	The IT company is assessing its own work; ask for evidence, not just “yes”
Outside assessor	20 or more staff, several locations, a recent incident, or an insurer or payer asking for one	An independent document, often with vulnerability scanning	Scope and price vary widely; some “assessments” are just policy templates

CyberMaxx, one of the providers I work with, lists risk assessment offerings on its site, including a NIST CSF 2.0 self-assessment called CyberSight LENS. I’m confirming how it scopes HIPAA Security Rule risk analyses for small practices [VERIFICAR]. I can also compare it with independent assessors I don’t work with.

What a good deliverable looks like

Whoever does the work, the final document should include:

• A dated scope statement that names every location, system and vendor with ePHI.
• An asset and data-flow list: where ePHI is stored, who can reach it, and how it moves.
• Each threat and vulnerability pair, rated for likelihood and impact.
• A risk level for each item and a recommended fix.
• A risk management plan: owner, budget, target date and status for each fix.
• A decision record for each addressable specification you didn't implement, with the alternative.
• Who approved it and the next review date.

If a vendor hands you a “certificate of HIPAA compliance” without that content, it is not a risk analysis. Microsoft’s HIPAA compliance page notes that HHS approves no certification standard for demonstrating HIPAA compliance by a business associate. Email vendors and BAAs are covered on the HIPAA compliant email page.

What it costs

The HHS SRA Tool is a direct download with no listed price. Your cost is staff time.

None of the providers I checked publish a price for a HIPAA risk assessment, so I can’t give you a sourced range. These are the things that move the quote:

• Locations, users and systems with ePHI, including on-premises servers and imaging.
• Technical work: vulnerability scans, phishing tests or penetration testing.
• Whether the assessor writes the risk management plan and policies, or only the findings.

What OCR enforcement shows

OCR runs a Risk Analysis Initiative that HHS describes as focused on compliance with the risk analysis provision. These are examples from HHS releases and resolution agreements:

Entity	Type	Announced	What happened	OCR finding	Payment
Northeast Surgical Group, P.C. (Michigan)	Surgical group practice	January 2025	Ransomware breach affecting up to 15,298 people	No accurate and thorough risk analysis	$10,000 and a 2-year corrective action plan
Comprehensive Neurology, PC (New York)	Small neurology practice	April 25, 2025	Ransomware encrypted the network; 6,800 people may have been affected	No accurate and thorough risk analysis	$25,000 and a 2-year corrective action plan
Comstar, LLC (Massachusetts)	Billing business associate for ambulance services	May 30, 2025	Ransomware; about 585,621 people affected	No accurate and thorough risk analysis	$75,000 and a 2-year corrective action plan
BST & Co. CPAs, LLP (New York)	Accounting firm acting as a business associate	August 18, 2025	Ransomware on part of its network	No accurate and thorough risk analysis	$175,000 and a 2-year corrective action plan
MMG Fusion, LLC (Maryland)	Software business associate	March 5, 2026	Breach of data on about 15 million people	No accurate and thorough risk analysis, plus other potential violations	$10,000 and a 3-year corrective action plan

The payments for small organizations were modest. Every corrective action plan, though, required what the organization should have had already: a risk analysis, a risk management plan, updated policies and training.

My recommendation by scenario

• If you have 1 to 10 staff and only cloud software, do it yourself with the SRA Tool. Block two half-days, involve whoever handles IT, and use the HIPAA security checklist first to find the obvious gaps.
• If you have an on-premises server, imaging PCs or an outside IT company, do it yourself but have your IT provider answer the technical sections in writing, with screenshots.
• If you have 20 or more staff, several locations, or a recent incident, get an outside assessment. Ask for scanning and a written risk management plan, not just findings.
• If you’re a dental office, give imaging and practice management their own rows, as the dental office page explains.

Questions to ask any assessor

1. Will the report list every system and vendor with ePHI, or only the ones I tell you about?
2. Do you include vulnerability or external scanning, and on how many devices?
3. Will I get a risk management plan with owners and dates?
4. How do you document addressable specifications we decide not to implement?
5. What does an update cost next year, or after we change systems?
6. Do you sign a BAA? An assessor who sees ePHI may be a business associate.

Common mistakes

1. Using a policy template as the risk analysis. Policies say what you’ll do; the analysis says what could go wrong.
2. Leaving vendors out. Your cloud EHR, fax service, IT company and backup provider all handle ePHI. Each belongs in scope, each needs a BAA.
3. No risk management plan. A list of risks with no owners or dates is half of the requirement under 164.308(a)(1)(ii)(B).
4. Never updating after a change. A new system or a new IT company is exactly when HHS says to update.
5. Answering “yes” without checking. “MFA is on” may mean only the owner’s mailbox. Verify each answer with a setting or screenshot.

The healthcare cybersecurity guide shows what usually comes after the analysis, and the glossary defines terms like ePHI and addressable. If you want me to compare outside assessment options or line up the fixes your analysis finds, request a risk assessment quote.