Glossary
Security risk assessment
Also called: HIPAA risk analysis, SRA
In one sentence
A security risk assessment is a structured review of where your sensitive data lives, what could go wrong with it, how likely and harmful that would be, and what you'll do about it.
For healthcare practices, this is a legal requirement: the HIPAA Security Rule requires an “accurate and thorough” assessment of the risks to the confidentiality, integrity and availability of ePHI (45 CFR 164.308(a)(1)(ii)(A)), followed by risk management — actually reducing the risks you find. HHS's Office for Civil Rights has repeatedly cited a missing or outdated risk analysis in its enforcement actions.
A useful assessment answers a handful of plain questions. Where does patient (or client) data live — every system, device and vendor? What threats apply — ransomware, a stolen laptop, a phishing email, a hurricane, a former employee who still has a login? What protections are already in place? How likely is each problem and how bad would it be? What will you fix, by when, and who owns it?
Why it matters beyond HIPAA: cyber insurers, CPA-firm regulators and larger clients increasingly ask the same questions. A good assessment becomes your to-do list and your evidence that you take security seriously. It isn't a one-time exercise; redo it at least yearly and whenever something big changes, like a new EHR or a move to the cloud.
Example: a dental office's assessment finds that the imaging PC still runs an unsupported Windows version, the Wi-Fi password hasn't changed in five years and nobody tests restoring backups. None of these were secret — but writing them down with an owner and a date is what gets them fixed.
HHS and ONC publish a free SRA Tool for small practices. Our risk assessment guide walks through the process step by step.
Related terms
- HIPAA Security RuleThe HIPAA Security Rule is the federal regulation that sets the administrative, physical and technical safeguards healthcare providers and their vendors must use to protect electronic patient information.
- ePHI (electronic protected health information)ePHI is protected health information that is created, stored, received or sent in electronic form — the data the HIPAA Security Rule exists to protect.
- Vulnerability scanAn automated check of your computers, network and software for known security weaknesses such as missing updates or risky settings.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.
- WISP (written information security plan)A written document describing how your business protects sensitive customer information — required for tax and accounting professionals under federal rules.