HIPAA Security Risk Assessment Template

The requirement is one sentence: an accurate and thorough assessment¹ of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic patient information you hold. The next requirement, risk management, asks for security measures that bring those risks down to a reasonable and appropriate level.

The rule doesn't prescribe a method, but HHS's guidance on risk analysis² lists what any method must cover. That means where the data is, its threats and vulnerabilities, current safeguards, likelihood, impact, a risk level for each threat and vulnerability pair, written results and regular updates.

For small and medium practices, HHS offers a Security Risk Assessment Tool³ as a Windows app or an Excel workbook. NIST, the federal standards agency, says in its HIPAA guide that a questionnaire like this cannot identify technical vulnerabilities⁴ and should be paired with vulnerability scanning.

Build the inventory before you rate anything. NIST calls this the preparation step and warns that if you miss a system the data flows to, you may not be able to identify all the relevant threats⁴. It says the scope should take in laptops, phones, removable media, medical devices, remote staff and vendors with remote access.

1. 1

   Read 18 months of payments

   Export recurring charges from card and bank statements. Any subscription that touches patients is a candidate.

2. 2

   List what staff log into

   Check a single sign-on report, a password manager export or browser bookmarks. Free tools never appear on a statement.

3. 3

   Collect the technical lists

   Get the device and network list from your IT provider, plus your records system's users and connections.

4. 4

   Ask about forgotten places

   Old file shares, exports from a replaced system, copiers that store scans, USB drives and phones with work email.

Give each asset a row with its record count and where the count came from, such as a patient total or an export's row count. A backup holds what its source holds, so give it the same count. Add the date each asset came into use, so you can tell later whether an analysis covered it.

Go asset by asset and decide which threats reach each one. NIST's guide says to consider phishing, ransomware and insider threats⁴. Describe each weakness in your practice's own terms: not "credential theft" but "one front desk login shared by four people, with no second factor."

Not every threat reaches every asset: an office fire threatens the server in the closet, not the portal your vendor hosts. Give each ruled-out threat a one-line reason, or it looks like one nobody considered.

Any consistent scale works. A common one scores likelihood and impact from 1 to 5 and multiplies them, for a risk out of 25. Rate each pair twice, without and then with today's safeguards. HHS says to check whether safeguards are configured and used properly², so treat one that exists only in a policy as missing.

Base impact on what the asset holds, not how important it feels. Start from the record count, then ask which of confidentiality, integrity and availability the threat hits.

Risk management is the half that gets skipped. In its 2025 proposed rule, HHS reported that 94% of the covered entities it audited in 2016 and 2017 had failed to implement appropriate risk management⁵. Rather than working down the scores, group pairs by the control that would fix them, total the risk each removes, and divide by the days of work.

NIST's HIPAA guide recommends a cost-benefit analysis⁴ for proposed controls. Ranked by top score and by risk removed per day, the two lists often disagree. An old imaging server may own the worst score and take weeks to replace, while multi-factor sign-in might take 3 days and close rows on six systems. Keep both lists in the plan, with an owner, a date and the proof each fix will leave.

Encryption barely changes the odds of losing a laptop, but it changes what the loss exposes. Deleting data past its retention period lowers the impact of every threat to that asset. HIPAA requires a business associate agreement¹ before a vendor handles patient data for you, but signing one doesn't make a breach there less likely. Rate each vendor on the safeguards it can show you.

Cheap fixes often include unique logins with multi-factor sign-in and an employee offboarding checklist that shuts a leaver's accounts on their last day. If you accept a risk, write down why, who decided and when you'll revisit it. Your HIPAA policies and procedures should then describe the safeguards you chose.

Keep the analysis in writing, with every version, for 6 years⁶ from when it was created or last in effect, whichever is later. Date each asset's assessment, not just the report: a system adopted after your last analysis was never in it.

The Security Rule sets no fixed schedule, and HHS says frequency varies: some organizations review annually or as needed². HHS also names events that should prompt a fresh look, such as a security incident, new owners, turnover in key staff or new technology.

For 2026, clinicians in Medicare's MIPS program must attest that they conducted or reviewed a risk analysis that year and managed its risks, or score zero for Promoting Interoperability. In July 2026, CMS proposed dropping that measure from 2027⁷, though the HIPAA requirement would remain.

If the work uncovers a breach or attack, a security incident response plan sets out who acts and which notices fall due. This assessment covers patient data, not staff safety, which falls under OSHA and has its own OSHA safety checklist for medical offices. To build this analysis from your own records, open this template in River.