Ask most practice owners whether they’ve done a HIPAA risk assessment, and the answer is usually yes, in some form. Maybe it’s a checklist a vendor sent over years ago. Maybe it’s a one-time exercise a former office manager completed and filed away. The problem is that a lot of what practices call a risk assessment wouldn’t actually hold up if the Office for Civil Rights ever asked to see it.
That gap matters more than most practices realize, because a missing or inadequate risk analysis is one of the most common findings behind HIPAA enforcement actions, sometimes even when no actual data breach occurred. It’s also one of the more common gaps a provider of healthcare IT services in Charlotte finds when reviewing a practice’s environment for the first time.
What HIPAA Actually Requires
The requirement itself is specific, not vague. Federal regulation requires every covered entity and business associate to conduct an accurate and thorough assessment of the risks and vulnerabilities to the electronic protected health information they create, receive, maintain, or transmit. HHS’s official guidance on risk analysis explains that this analysis is meant to help organizations identify the most effective and appropriate administrative, physical, and technical safeguards for protecting that information, not simply check a box once and move on.
That distinction, between a genuine analysis and a generic checklist, is where a lot of practices unknowingly fall short.
What a Real Risk Assessment Actually Covers
A complete inventory of where patient data actually lives
Before anything can be assessed, a practice needs a full picture of everywhere electronic patient health information exists: the EHR system, billing software, email, backup systems, mobile devices, and any third-party vendors or cloud services that touch that data. Most practices are surprised by how much broader this list is than they initially assumed.
Identification of realistic threats and vulnerabilities
A real assessment considers the specific threats that could reasonably affect that data, from ransomware and phishing to lost devices, improper access, and vendor security gaps, rather than a generic list copied from a template that doesn’t reflect the practice’s actual environment.
An honest evaluation of current safeguards
The assessment needs to document what security controls are already in place, technical, physical, and administrative, and honestly evaluate whether those controls are actually adequate for the threats identified, not just whether something exists on paper.
A documented risk rating and remediation plan
Each identified risk needs to be rated by likelihood and potential impact, with a documented plan for addressing the highest-priority gaps first. A list of risks without a plan to act on them doesn’t satisfy the requirement and doesn’t actually reduce exposure.
Written documentation that would survive a review
Verbal awareness of risk doesn’t count. If a risk assessment exists only as institutional knowledge or a verbal conversation, it doesn’t hold up under an actual OCR investigation. Everything needs to be written down, dated, and kept current.
What Separates a Real Assessment From a Checklist
|
Element |
Generic Checklist |
Real HIPAA Risk Assessment |
|
Data inventory |
Assumes EHR is the only system involved |
Maps every system and vendor touching ePHI |
|
Threat identification |
Generic, templated list |
Specific to the practice’s actual environment |
|
Safeguard evaluation |
Confirms tools exist |
Evaluates whether tools are actually adequate |
|
Risk prioritization |
Absent or superficial |
Documented, rated by likelihood and impact |
|
Documentation |
Minimal or nonexistent |
Written, dated, and regularly updated |
The right column is what OCR investigators are actually looking for. The left column is what a lot of practices mistakenly believe satisfies the requirement.
Why This Isn’t a One-Time Task
A risk assessment completed once and never revisited becomes outdated the moment anything in the practice changes: a new EHR module, a new vendor, added staff, a new remote work arrangement, or a prior security incident. HIPAA guidance is clear that risk analysis needs to be an ongoing process, not a document filed away and forgotten.
Practices that treat this as a recurring discipline, reviewed at least annually and after any significant change, are in a fundamentally stronger position than those treating it as a box checked once years ago.
Getting This Right Without an Internal Compliance Team
Most small and mid-sized practices don’t have a dedicated compliance officer capable of running this process independently, and that’s a reasonable limitation given everything else a practice has to manage. Working with a provider that understands both the technical and regulatory side of this process can help a practice build a risk assessment that actually reflects its environment, rather than a generic template that leaves real gaps unaddressed.
Building Documentation That Actually Protects the Practice
A HIPAA risk assessment isn’t just a regulatory formality. Done properly, it’s a genuine roadmap for reducing the risk of the kind of incident that disrupts patient care and damages trust. Practices that treat it as ongoing infrastructure, kept current and properly documented, are the ones best positioned if an audit, an incident, or simply a routine review ever puts that documentation to the test.
About the Author
