Short answer: Yes. Under the HIPAA Security Rule, every covered health care provider that handles electronic protected health information must conduct an accurate and thorough risk analysis. That includes a three-provider family practice, a solo therapist, and a small dental office. Size changes how detailed the analysis needs to be, but not whether it's required.
Below, we explain what a security risk analysis is, what it usually covers, how often to do one, and how small practices can get it done without stopping patient care.
What Is a HIPAA Security Risk Analysis?
A security risk analysis is a structured review of how your practice protects electronic patient information, often called ePHI. It answers three basic questions:
- Where does patient information live and travel in our practice?
- What could realistically go wrong with it?
- How likely and how harmful would each problem be?
The requirement comes from the HIPAA Security Rule's administrative safeguards at 45 CFR 164.308(a)(1)(ii)(A). The U.S. Department of Health and Human Services publishes guidance on risk analysis that explains what regulators expect.
Isn't This Just for Hospitals?
No. This is one of the most common misunderstandings we hear from small practices. HIPAA applies to covered entities based on what they do, not how big they are. If your practice bills insurance electronically, you're almost certainly a covered entity.
The rule is designed to scale. HHS expects a small practice's analysis to reflect its size, budget, and technology. A clinic with five computers and a cloud-based EHR won't need the same documentation as a hospital system. It still needs a real analysis, written down.
What a Risk Analysis Usually Covers
A useful analysis looks at technology, people, and procedures together. Common areas include:
- Where ePHI is stored: EHR systems, imaging software, billing platforms, email, scanned documents, and personal devices.
- Who can access it: staff accounts, shared logins, former employees, vendors, and remote access.
- How it's protected: passwords, multifactor authentication, encryption, and screen locks.
- Backup and recovery: whether you can restore patient records after a ransomware attack or hardware failure.
- Physical security: front-desk screens, unlocked server closets, and paper records near computers.
- Vendors: business associates who handle patient data on your behalf.
For each risk, the analysis should note how likely it is and how much harm it could cause. That's what turns a list of worries into a plan.
Risk Analysis vs. Risk Management
These two terms are related but different. The risk analysis identifies and rates risks. Risk management is what you do about them. HIPAA requires both. Finding a problem and leaving it alone doesn't meet the intent of the rule.
A practical approach is to rank findings by priority and assign each one an owner and a target date. For example, "Turn on multifactor authentication for the EHR" might be a high-priority item for this month. "Replace the aging front-desk computer" might be planned for next quarter.
How Often Should a Practice Do One?
The HIPAA Security Rule doesn't set an exact schedule. It expects risk analysis to be an ongoing process. Many practices review their analysis at least once a year. You should also update it after major changes, such as:
- Switching EHR or practice management systems.
- Opening a new location.
- Moving to cloud services.
- Experiencing a security incident.
- Adding remote work or telehealth.
What About the Proposed HIPAA Security Rule Changes?
HHS proposed significant updates to the HIPAA Security Rule in January 2025. As of this writing, those changes have not been finalized, and federal regulators have signaled that final action won't come until at least mid-2027. The current Security Rule, including the risk analysis requirement, remains fully in effect. Practices shouldn't wait for new rules to address the requirements already on the books.
Free Tools and Where They Fit
The Office of the National Coordinator for Health IT offers a free Security Risk Assessment Tool designed for small and medium-sized providers. It walks you through questions and helps organize your answers.
The tool is a solid starting point. Keep in mind that it records what you tell it. If nobody on your team knows how backups are configured or which vendors still have remote access, the results will have gaps. That's where an outside review often helps.
Frequently Asked Questions
Is a vulnerability scan the same as a risk analysis?
No. A vulnerability scan checks computers for technical weaknesses. It can be one input to a risk analysis, but it doesn't cover people, procedures, vendors, or physical security.
Do we need an outside company to do it?
HIPAA doesn't require outside help. Many small practices still use a third party because staff are busy and an independent view tends to catch blind spots.
What happens if we never did one?
Start now. A current, documented analysis with an active remediation plan is far better than none. The HHS Office for Civil Rights has repeatedly cited missing risk analyses in enforcement actions.
Getting It Done Without Disrupting Patients
Most small practices can complete a solid analysis with a few short interviews, a review of systems, and a written report with priorities. It doesn't need to take your front desk offline.
Maise Technology helps practices meet compliance requirements with practical, plain-language findings. You can also read about our approach on our IT services for healthcare organizations page, or see how a cybersecurity risk assessment works in general.
Have a question about where your practice stands? Get In Touch and we'll point you in the right direction.
This article provides general information and is not legal advice. Consult qualified counsel about your practice's specific HIPAA obligations.
