For covered entities and business associates that need the Security Rule risk analysis done properly, not filled in. We inventory where your ePHI lives, rate each threat and vulnerability by likelihood and impact, and hand over a risk register and remediation plan your team can act on and an investigator can follow.
One finding recurs across OCR's recent resolution agreements: no accurate and thorough risk analysis.
Our HIPAA compliance consultants run the analysis with your IT, clinical and operations leads, then help close the gaps it finds. You get a document your security officer can defend, not a score.
Required: an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold. HHS guidance says scope covers ePHI on every kind of electronic media, from a single workstation to networks spanning several sites.
Also required: security measures sufficient to reduce those risks and vulnerabilities to a reasonable and appropriate level. The analysis is the input; risk management is the work that follows it.
The assessment must be in writing, available to the people who act on it, reviewed when operations change, and kept for six years from creation or the date it was last in effect.
HHS states the Rule does not prescribe a methodology or a frequency. Its guidance treats the process as ongoing, notes that some entities repeat it annually or as needed, and expects new analysis after incidents, ownership changes or new technology.
OCR created the initiative to focus selected investigations on the risk analysis provision. Three resolutions show the pattern.
A small New York practice hit by ransomware that made ePHI for about 6,800 people inaccessible. OCR found no accurate and thorough risk analysis. Settlement: $25,000 and two years of monitored corrective action, the initiative's 8th action.
A software business associate breached in 2020, exposing data on about 15 million people. Findings included the missing risk analysis and failure to notify affected covered entities. Payment: $10,000, with a three-year plan requiring a new risk analysis and a risk management plan.
An employer-sponsored group health plan hit by ransomware, potentially affecting PHI of 10,023 people. OCR cited the lack of an accurate risk analysis before the attack. Settlement: $450,000 and a two-year plan, the initiative's 14th action.
Entity type made no difference: a practice, a software vendor and an employer health plan were all asked for the same document, and OCR reached the same finding each time.
| Aspect | SRA Tool or template alone | Facilitated risk assessment |
|---|---|---|
| Designed for | Small and medium providers, per HealthIT.gov | Any size, including business associates and health plans |
| Finding ePHI | Whatever the respondent remembers | Interviews, system walk-throughs and data-flow mapping |
| Technical evidence | Self-reported answers | Configuration reviews plus scan and test results |
| Threat-vulnerability pairs | Generic question bank | Specific to your systems, vendors and sites |
| Output | Score and report | Risk register and dated remediation plan |
| Official standing | Neither required nor a guarantee of compliance | Built to the elements HHS guidance lists |
The SRA Tool, now at version 3.7, is a reasonable starting point for a small practice, and HealthIT.gov itself warns that the survey alone may not identify every risk. Its limit is that it records what people tell it. We often keep its structure, then test the answers against the systems.
NIST published SP 800-66 Revision 2 in February 2024 as its resource guide for implementing the Security Rule. We follow its seven risk assessment steps and use NIST SP 800-30 Rev. 1 for rating scales.
Scope, asset list and data-flow map covering every system, device, vendor and location that creates, receives, maintains or transmits ePHI.
Ransomware, phishing, vendor compromise, insider misuse, outages and natural events, chosen for your environment.
Configuration reviews, scan output and any penetration test findings, alongside policy and process gaps.
How probable each threat-vulnerability pair is, given the controls already in place.
What exploitation would mean for patients, operations, finances and breach reporting.
A likelihood-by-impact matrix, with your risk tolerance agreed before ratings begin.
A risk register of every pair and rating, and a risk management plan for anything above tolerance.
On the proposed rule: HHS's January 6, 2025 proposal would require a written technology asset inventory and network map, and a written risk analysis reviewed at least every 12 months. It remains a proposal. HHS's regulatory agenda moved it to long-term actions with final action projected for July 2027, so today's rule is the one that applies.
Systems, vendors, devices and locations, showing how ePHI enters, moves and leaves.
Every threat-vulnerability pair with likelihood, impact, risk level, owner and status.
Prioritized remediation with owners and target dates, plus documented acceptance where a risk is kept.
A short briefing for leadership on the highest risks and the decisions they require.
Interview notes, configuration evidence and scan references that show how each rating was reached.
Optionally, the register runs in our GRC Compliance Platform, with recurring reviews scheduled so the analysis stays current.
Clinics that worked through the SRA Tool and want their answers checked against real systems.
Business associates that need an analysis covering their platform, subcontractors and staff access to customer data.
Group health plans and their administrators, a category OCR has penalized for missing analyses.
Teams recovering from ransomware or a breach, where investigators will ask for the analysis that existed beforehand.
Ownership changes, EHR migrations and new technology, which HHS guidance names as reasons to revisit risk.
Our assessors sit beside security testers and cloud engineers, so technical findings are verified rather than assumed.
We support remediation afterward, from policy rewrites to configuration changes, instead of handing over a document and leaving.
If you also pursue SOC 2 readiness or ISO 27001, overlapping controls and evidence are mapped once.
Founded in 2008, with 16+ partners and solution architects and an architect-led model that keeps senior staff on each assessment.
Tell us your size, systems and the date of your last analysis. We will propose a scope, the people we need to interview and the deliverables you will receive.
Prefer email? info@xcodefixglobal.com
Talk to the specialist who would scope the work — not a call-centre script.
Ask us directlyIt is the written analysis the Security Rule requires at 45 CFR 164.308(a)(1)(ii)(A): an accurate and thorough review of risks and vulnerabilities to the confidentiality, integrity and availability of your ePHI. It shows where ePHI lives, what could go wrong, how likely and harmful each scenario is, and it feeds the required risk management plan.
Yes. Risk analysis and risk management are both required implementation specifications in the Security Rule, for covered entities and business associates alike. OCR runs a Risk Analysis Initiative to enforce the provision, and the three settlements described on this page range from $10,000 to $450,000, each with a multi-year corrective action plan.
You can, and small practices often start there. HealthIT.gov says the SRA Tool targets small and medium providers, that using it is neither required nor a guarantee of compliance, and that the survey alone may not find every risk. A template only works when someone checks the answers against the actual systems.
The current rule sets no fixed interval. HHS guidance calls the process ongoing, mentions annual or as-needed reviews, and expects fresh analysis after incidents, ownership changes or new technology. The January 2025 proposal would require review at least every 12 months, but it has not been finalized; final action is currently projected for July 2027.
At minimum: scope covering all ePHI, an asset and data-flow inventory, threats and vulnerabilities, current security measures, likelihood and impact ratings, a risk level for each pairing, and written results. A risk management plan follows. A checklist keeps you from skipping steps; it does not replace evidence for each answer.
Yes. The Security Rule applies to business associates directly, and OCR acts against them. MMG Fusion, a software vendor serving covered entities, settled in March 2026 after OCR found no accurate and thorough risk analysis. A vendor's analysis should cover its platform, subcontractors and staff access to customer data.
A risk assessment asks what could happen to your ePHI and how serious it would be. An audit or gap assessment asks whether each required safeguard is in place and documented. The Security Rule demands the first; the second is useful before customer reviews or an OCR inquiry. We run both, often together.
It depends on the number of sites, systems and vendors, and on how quickly your staff can join interviews. A single-site practice moves far faster than a multi-state group or a SaaS platform. We give a schedule after scoping; collecting evidence from outside vendors often takes the longest.
