HIPAA Security Risk Analysis Calculator
Rate likelihood and impact for 12 starter risks, mark the 44 Security Rule specifications, and get a scored risk register to download or email. Do not enter patient information.
Nothing is sent anywhere unless you ask us to email your results, and then only counts and the names of the starter risks you rate High are sent. Text you type is never sent.
How to use this worksheet
- 1. Set the scope. Include every location and system that creates, receives, maintains or transmits ePHI, including acquired practices and new sites (Part 1). OCR's guidance says the scope covers all ePHI, “regardless of the particular electronic medium” or its location.
- 2. Inventory the ePHI. List each system, where it lives, who owns it and which vendor touches it (Part 1).
- 3. Pair threats with vulnerabilities. Use the starter rows in Part 2, then add your own.
- 4. Record current controls. Write down what is actually in place and working today, not what the policy says.
- 5. Rate likelihood and impact. Use the 1-3 scales in Part 2 and multiply for a risk score. HIPAA does not prescribe a scoring method; this is one simple option.
- 6. Plan the fixes. Turn every Medium and High risk into a dated, owned action in Part 3 (risk management, 164.308(a)(1)(ii)(B)).
- 7. Prove you review activity. Fill in the log-review register in Part 4 and keep the evidence.
- 8. Sign, date and keep it. Security Rule documentation must be retained for 6 years (164.316(b)(2)(i)). Update it after incidents, ownership changes, staff turnover or new technology (Part 6).
This web version scores Part 2 (risk ratings), Part 4B (review prompts) and Part 5 (Security Rule quick reference). Use the fillable PDF worksheet for the ePHI inventory, current controls, risk management plan and log register.
Part 2. Threats, vulnerabilities, current controls and risk level
OCR's Guidance on Risk Analysis asks you to document reasonably anticipated threats, the vulnerabilities they could exploit, current security measures, likelihood, impact and a risk level for each threat and vulnerability pair. Rating scale used here: Likelihood 1 = Low, 2 = Medium, 3 = High. Impact 1 = Low, 2 = Medium, 3 = High. Risk score = Likelihood × Impact: 1-2 Low, 3-4 Medium, 6-9 High. This is an Emry example scale. The Security Rule does not prescribe one; NIST SP 800-30 Rev. 1 describes qualitative and quantitative approaches.
Starter rows are common examples, not a complete list. Add threats specific to your practice (for example, a vendor outage, a lost USB drive, or an employee viewing records they do not need).
Part 4. Information system activity review and audit logs
Rules: 164.308(a)(1)(ii)(D) (Required) says to “regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.” 164.312(b) (audit controls) requires mechanisms that “record and examine activity” in systems that contain or use ePHI. 164.308(a)(5)(ii)(C) (Addressable) covers monitoring log-in attempts. The rule does not set a review frequency, so pick one, write it down, and keep proof that each review happened.
4B. Review prompts (check what you looked at; these are Emry suggestions, not rule text)
Part 5. Security Rule quick reference: Required vs. Addressable
From the current text of 45 CFR Part 164, Subpart C (eCFR, current as of October 29, 2026). R = Required, A = Addressable, S = standard with no separate implementation specification (you must still meet it).
Rule: 164.308(a)(1)(ii)(B) (Required) says to “implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.” For an Addressable specification, 164.306(d)(3) says you must assess whether it is reasonable and appropriate, implement it if so, and if not, document why and implement an equivalent alternative measure if reasonable and appropriate. Addressable does not mean optional.
Your results
HIPAA Security Risk Analysis · Generated . Coverage figures are your own self-assessment, not a compliance determination.
Risk register (Part 2)
High risks to fix first
| # | Asset / system | Score |
|---|
Log review and Security Rule quick reference (Parts 4-5)
Coverage = specifications marked In place ÷ specifications you have marked, excluding N/A. Specifications marked N/A: 0
Open specifications (Gaps first)
| Citation | Specification / standard | Status |
|---|
Keep this worksheet, the risk management plan and your log-review evidence for at least 6 years from creation or the date last in effect, whichever is later (164.316(b)(2)(i)).
Want a second set of eyes on your risk analysis?
Emry Networks helps medical groups, dental practices, pharmacies and therapy practices build risk analyses that hold up, with evidence for every control. Call (603) 202-3200 or Book a 30-Minute Risk Assessment.
Part 6. What OCR keeps citing, and when to redo the analysis
- Lehigh Valley Health Network (announced October 29, 2026). $800,000 and a three-year corrective action plan after a ransomware attack that affected the PHI of 248,359 individuals. OCR found potential violations including failing to conduct an accurate and thorough risk analysis and failing to implement procedures to regularly review information system activity, such as audit logs. HHS press release
- Regional Women's Health Group, d/b/a Axia Women's Health (announced April 23, 2026). A network of women's health providers in five states paid $320,000 after a ransomware breach affecting 37,989 individuals; OCR found it failed to conduct an accurate and thorough risk analysis. The same release counted 13 completed investigations in OCR's Risk Analysis Initiative. HHS press release
- Top of the World Ranch Treatment Center (announced February 19, 2026). $103,000 and a two-year corrective action plan after a phishing attack compromised the ePHI of 1,980 patients; OCR's investigation found evidence that it failed to conduct an accurate and thorough risk analysis. HHS called it the 11th enforcement action in its Risk Analysis Initiative. HHS press release
- MMG Fusion, LLC (announced March 5, 2026). A business associate whose software is used to communicate with patients paid $10,000 (OCR considered its financial condition). OCR found potential violations including failing to conduct an accurate and thorough risk analysis. HHS called it the 12th Risk Analysis Initiative action. HHS press release
- What a corrective action plan looks like. In the Bryan County Ambulance Authority resolution agreement ($90,000), OCR required a risk analysis covering a complete inventory of electronic equipment, data systems, off-site data storage facilities and applications that contain or store ePHI, with the scope and methodology submitted to HHS within 30 calendar days. HHS resolution agreement
When to update your risk analysis
OCR's risk analysis guidance says the process should be ongoing and that the Security Rule does not specify how often to perform it. It gives examples of when to analyze risk again: a security incident, a change in ownership, turnover in key staff or management, or plans to adopt new technology. Our recommendation: treat a newly acquired practice or a new location as one of those triggers and add it to the analysis before connecting it to your network.
Proposed HIPAA Security Rule changes
Free government resources
- Security Risk Assessment (SRA) Tool v3.7, developed by ONC with HHS OCR: available at no cost as a Windows application or an Excel workbook, aimed at small and medium-sized providers. Information you enter is stored locally; HHS says it does not collect it. Version 3.7 added an assessment-scope question so the analysis accounts for every location that handles ePHI. https://healthit.gov/privacy-security/security-risk-assessment-tool/
- OCR Guidance on Risk Analysis: the elements a risk analysis must include. https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html
- NIST SP 800-66 Rev. 2 (February 2024), Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. https://csrc.nist.gov/pubs/sp/800/66/r2/final
- NIST SP 800-30 Rev. 1 (September 2012), Guide for Conducting Risk Assessments. https://csrc.nist.gov/pubs/sp/800/30/r1/final
This worksheet is an educational self-assessment aid. It is not legal advice, not a certification, and not a substitute for the regulation, OCR guidance, or advice from qualified counsel. Completing it does not by itself establish HIPAA compliance. Citations reflect 45 CFR Part 164, Subpart C as published on eCFR (current as of October 29, 2026). © 2026 Emry Networks.
Sources- 45 CFR 164.308 Administrative safeguards (eCFR)
- 45 CFR 164.306 General rules, incl. addressable (eCFR)
- 45 CFR 164.310 Physical safeguards (eCFR)
- 45 CFR 164.312 Technical safeguards (eCFR)
- 45 CFR 164.316 Documentation (eCFR)
- HHS OCR Guidance on Risk Analysis
- HHS/ONC Security Risk Assessment Tool
- SRA Tool v3.7 User Guide
- NIST SP 800-66 Rev. 2
- NIST SP 800-30 Rev. 1
- HHS: Lehigh Valley Health Network settlement (Oct 29, 2026)
- HHS: Four ransomware settlements (Apr 23, 2026)
- HHS: Top of the World Ranch Treatment Center (Feb 19, 2026)
- HHS: MMG Fusion (Mar 5, 2026)
- HHS: Bryan County Ambulance Authority resolution agreement
- Federal Register: Proposed Security Rule (Jan 6, 2025)
- Unified Agenda: RIN 0945-AA22
Get audit ready now
Schedule your compliance readiness assessment with our team today.