How to Do a HIPAA Security Risk Analysis, Plus a Free Worksheet

If an OCR investigator asked for your practice’s HIPAA risk analysis tomorrow, what would you hand over? For a lot of small medical groups, dental offices, pharmacies and therapy practices, the honest answer is a vendor checklist from a few years ago, or a document that covers the main office and nothing else.

That gap shows up again and again in OCR’s enforcement announcements. So we built a free, fillable worksheet that walks you through the risk analysis and risk management the HIPAA Security Rule requires, with every row tied to a Security Rule citation. This guide explains how to use it.

Download the worksheet: HIPAA Security Risk Analysis Worksheet (fillable PDF). It covers scope and ePHI inventory, threats and vulnerabilities, likelihood and impact ratings, a risk management plan with owners and dates, and an audit-log review register.

Key takeaways

• A risk analysis is a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A): “an accurate and thorough assessment of the potential risks and vulnerabilities” to the confidentiality, integrity and availability of your ePHI.
• It has to cover all of your ePHI. OCR’s Guidance on Risk Analysis says the analysis should account for ePHI “regardless of the particular electronic medium in which it is created, received, maintained or transmitted or the source or location of its e-PHI.”
• Finding risks is only half the job. You also have to reduce them (risk management, 164.308(a)(1)(ii)(B)) and regularly review system activity such as audit logs (164.308(a)(1)(ii)(D)).
• On October 29, 2026, OCR announced an $800,000 settlement with Lehigh Valley Health Network that cited both a missing accurate and thorough risk analysis and a failure to regularly review information system activity.
• HHS’s January 2025 proposal to tighten the Security Rule is still proposed, not final. Today’s rule is the one that applies.

What the Security Rule actually requires

The security management process standard has four required implementation specifications. Three of them are the backbone of this worksheet:

• Risk analysis (Required), 164.308(a)(1)(ii)(A). Assess the potential risks and vulnerabilities to all ePHI you hold.
• Risk management (Required), 164.308(a)(1)(ii)(B). “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.”
• Information system activity review (Required), 164.308(a)(1)(ii)(D). “Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.”

The fourth is the sanction policy, 164.308(a)(1)(ii)(C). Alongside these, the audit controls standard at 164.312(b) requires mechanisms that “record and examine activity in information systems that contain or use electronic protected health information.” You cannot review logs your systems never kept.

Two more points trip practices up. First, “addressable” does not mean optional. Under 164.306(d)(3), you must assess each addressable specification, implement it if it is reasonable and appropriate, and if it is not, document why and implement an equivalent alternative measure if that is reasonable and appropriate. Second, the rule does not prescribe a format or a method. OCR’s guidance says the risk analysis must be documented but that the rule “does not require a specific format,” and that there is “no single method or ‘best practice’ that guarantees compliance.”

What OCR keeps citing

OCR now counts many of its settlements as part of its Risk Analysis Initiative, and the recent announcements read like a pattern:

• Lehigh Valley Health Network (announced October 29, 2026): $800,000 and a three-year corrective action plan after a ransomware attack affecting 248,359 individuals. OCR found potential violations including failing to conduct an accurate and thorough risk analysis and failing to regularly review records of information system activity. (HHS)
• Regional Women’s Health Group, d/b/a Axia Women’s Health (announced April 23, 2026): a network of women’s health providers in five states paid $320,000 after a ransomware breach affecting 37,989 individuals. OCR found it failed to conduct an accurate and thorough risk analysis. That release said OCR had completed 13 investigations in its Risk Analysis Initiative. (HHS)
• Top of the World Ranch Treatment Center (announced February 19, 2026): a substance use disorder treatment provider in Illinois paid $103,000 after a phishing attack compromised the ePHI of 1,980 patients. HHS called it the 11th enforcement action in the initiative. (HHS)
• MMG Fusion, LLC (announced March 5, 2026): a Maryland software business associate paid $10,000, an amount OCR set after considering its financial condition. OCR found potential violations including failing to conduct an accurate and thorough risk analysis. (HHS)

Settlements also show what OCR expects a fixed risk analysis to look like. In the Bryan County Ambulance Authority resolution agreement ($90,000), the corrective action plan required a complete inventory of “all electronic equipment, data systems, off-site data storage facilities, and applications that contain or store ePHI,” with the scope and methodology sent to HHS within 30 calendar days. The Lehigh Valley, Top of the World Ranch and MMG Fusion corrective action plans likewise require a new risk analysis and a risk management plan.

For a closer look at the Lehigh Valley case and what it means for multi-location groups, read our briefing on risk analysis and audit log review for medical groups.

How to use the worksheet

The worksheet follows the elements in OCR’s guidance: scope, data collection, threats and vulnerabilities, current security measures, likelihood, impact, risk level, documentation and periodic review.

1. Part 1, Scope and ePHI inventory. List every location first, including acquired practices and newly opened sites, then every system and device that creates, receives, maintains or transmits ePHI. Note the vendor and whether a business associate agreement is on file.
2. Part 2, Threats, vulnerabilities and risk level. Twelve starter rows cover common gaps such as email without multi-factor authentication, untested backups, shared logins, unencrypted laptops and vendors without a business associate agreement. Each row lists its Security Rule citation. Record what is actually in place today, then rate likelihood and impact from 1 to 3 and multiply them. HIPAA does not prescribe a scoring scale; this is a simple example you can replace with your own.
3. Part 3, Risk management plan. Turn every Medium and High risk into a dated action with a named owner. For addressable specifications, record your decision and the reasoning.
4. Part 4, Information system activity review. Register each log source, who reviews it, how often, and when it was last reviewed. The rule says “regularly” without setting a frequency, so choose one, write it down and keep proof that each review happened.
5. Part 5, Quick reference. 44 implementation specifications and standalone standards from 164.308, 164.310, 164.312 and 164.316(b)(2) that apply to a provider practice, each marked Required, Addressable or Standard, with a status column. (It leaves out 164.308(a)(4)(ii)(A), which applies only when a health care clearinghouse is part of a larger organization.)
6. Parts 6 and 7, Enforcement notes, sign-off and retention. Sign and date the analysis and keep it. Under 164.316(b)(2)(i), Security Rule documentation must be kept for six years from the date it was created or the date it was last in effect, whichever is later.

Do not forget acquired practices and new locations

Growth is where risk analyses go stale. A practice you bought may still run its own EHR, email domain, backup drive or firewall, and none of it may appear in your last assessment. OCR’s guidance lists a change in ownership, turnover in key staff or management, a security incident and plans to adopt new technology as examples of when risk should be analyzed again. Our recommendation is to treat every acquisition and new site the same way: add it to the scope before you connect it to your network.

The government’s own tool now asks about this. The Security Risk Assessment Tool version 3.7 added a “new assessment-scope question to ensure SRAs account for every location that creates, receives, maintains, or transmits ePHI,” along with a modernized system-activity logging question.

Free government resources

• The SRA Tool, developed by ONC in collaboration with OCR, is aimed at small and medium-sized providers. It is available as a Windows application or an Excel workbook, and the version 3.7 user guide says it is available at no cost. HHS says it does not collect, view, store or transmit anything you enter.
• NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide (February 2024).
• NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments (September 2012). OCR’s risk analysis guidance draws its definitions of threat, vulnerability and risk from NIST SP 800-30.

The worksheet complements these tools. The SRA Tool’s own page notes that using it “is neither required by nor guarantees compliance,” and the same is true of any worksheet, including ours.

The proposed Security Rule changes: still proposed

On January 6, 2025, HHS published a notice of proposed rulemaking to modify the Security Rule (90 FR 898). Comments closed March 7, 2025. Among other changes, it proposes to:

• Remove the distinction between required and addressable implementation specifications.
• Require a written technology asset inventory and network map, reviewed at least once every 12 months.
• Require encryption of all ePHI at rest and in transit, with limited exceptions.
• Require multi-factor authentication, with limited exceptions.

As of November 1, 2026, no final rule has been issued. The current Unified Agenda entry (RIN 0945-AA22) lists it as a long-term action with final action projected for July 2027, an estimate rather than a deadline. Until a final rule takes effect, the current Security Rule is what applies. Building an asset inventory and turning on multi-factor authentication now is still good practice, because both reduce real risk today.

Frequently asked questions

How often do we have to update our risk analysis?

The Security Rule does not set a frequency. OCR’s guidance says the process should be ongoing and that some organizations update annually or as needed, depending on their environment. Bryan County’s corrective action plan, for example, required an annual risk analysis during its three-year term.

Is the HHS SRA Tool enough by itself?

It is a solid starting point, especially for smaller practices. Version 3.7 itself reminds users that the survey alone may not identify every risk in an organization. Whatever tool you use, the analysis has to reflect your actual systems, locations and vendors.

Does addressable mean we can skip it?

No. You must assess it, implement it if reasonable and appropriate, and otherwise document why and adopt an equivalent alternative if that is reasonable and appropriate (164.306(d)(3)).

Where does this fit with the rest of our HIPAA program?

Use our HIPAA security checklist for dental and medical practices for day-to-day controls, and this worksheet to document the analysis behind them. More free tools are on our resources page.

Get a second set of eyes

Emry Networks helps medical practices, dental practices and pharmacies build risk analyses they can defend, with evidence behind every control. Call (603) 202-3200.

Book a 30-Minute Risk Assessment

This guide and worksheet are a self-assessment aid, not legal advice. Completing them does not by itself establish HIPAA compliance. Consult qualified counsel about your specific obligations. Sources verified November 1, 2026.