Risk analysis is a process, not a purchased report
A small medical practice may receive a questionnaire, vulnerability scan, or vendor-generated score and assume it has completed a HIPAA Security Rule risk analysis. Those items can contribute useful evidence, but HHS guidance describes a broader requirement: covered entities and business associates must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information, or ePHI, that they create, receive, maintain, or transmit.
For a Central Florida physician office, dental practice, therapy group, diagnostic provider, or other regulated organization, the work should connect technology findings to actual patient-care and business processes. The result should show what ePHI exists, where it flows, which threats and vulnerabilities matter, how risk was evaluated, and what actions management approved.
This article is general operational information, not legal advice or a determination that any organization is compliant.
1. Define the scope of ePHI
Begin with the full environment, not only the electronic health record. HHS states that all ePHI created, received, maintained, or transmitted by the regulated organization is subject to the Security Rule. Inventory places where ePHI may exist or pass through, including:
- Electronic health records and practice-management systems.
- Email, messaging, patient portals, fax services, and call recordings.
- Imaging, laboratory, prescription, and referral systems.
- Laptops, desktops, tablets, phones, servers, and removable media.
- Cloud storage, backups, document scanners, printers, and multifunction devices.
- Billing companies, IT providers, transcription services, and other business associates.
- Remote work locations and home-office equipment.
Record the system owner, vendor, administrator, data types, user groups, interfaces, storage location, and recovery contact. Unknown locations should remain visible as findings rather than being omitted.
2. Map how information moves
A system inventory shows where data rests. A data-flow review shows how it moves. Follow several ordinary workflows from beginning to end: new-patient intake, referral exchange, claims submission, prescription handling, records requests, employee onboarding, remote access, and backup restoration.
For each workflow, identify people, devices, applications, vendors, transmission methods, and temporary copies. This often exposes overlooked risks such as downloaded reports, shared mailboxes, local scanner folders, personal devices, or vendor support tools.
3. Identify threats and vulnerabilities
HHS guidance recognizes that threats may be natural, environmental, human, accidental, or deliberate. In Central Florida, a practice might evaluate hurricanes, extended power loss, water intrusion, equipment failure, ransomware, stolen devices, phishing, workforce mistakes, excessive access, unpatched software, and vendor outages.
The January 2026 HHS OCR cybersecurity newsletter specifically notes that risk analysis includes risks from unpatched software and points organizations toward manufacturer alerts, vulnerability scanning, the NIST National Vulnerability Database, and CISA’s Known Exploited Vulnerabilities Catalog.
A vulnerability scan alone does not assess every risk. It may find missing patches but not an unsafe payment-verification process, absent emergency access procedure, poor vendor termination practice, or backup that has never been restored.
4. Evaluate likelihood and impact consistently
Choose and document a repeatable method. A small practice might rate likelihood and impact as low, moderate, or high, with written definitions. Impact should address confidentiality, integrity, and availability—not only whether information could be disclosed.
For example, an unavailable scheduling platform may delay care; altered medication information may create safety consequences; compromised administrator access may affect many systems; and a lost encrypted device may present different risk from an unencrypted one.
Record existing safeguards and the reasoning behind the rating. Avoid presenting a mathematical score as certainty when the underlying evidence is incomplete.
5. Separate risk analysis from risk management
HHS distinguishes the two. Risk analysis identifies and evaluates risks and vulnerabilities. Risk management is the implementation of security measures to reduce risks to a reasonable and appropriate level.
Create a corrective-action register with:
- The finding and affected ePHI or process.
- The approved response: mitigate, transfer, avoid, or accept where appropriate.
- The responsible person.
- Resources and target date.
- Interim safeguards.
- Evidence required for closure.
- The date and authority for any accepted residual risk.
Prioritize high-impact issues such as administrator access, remote access, unsupported systems, untested backups, exposed ePHI, or missing incident contacts.
6. Preserve evidence
HHS states that risk analysis must be documented but does not prescribe one required format. Keep evidence that allows a reviewer to understand what was evaluated and what management decided. Useful records include inventories, data-flow notes, account reviews, vendor lists, scan summaries, patch reports, backup test results, policy decisions, meeting minutes, and corrective-action updates.
The HHS Security Risk Assessment Tool is intended to help small and medium practices navigate the process, but its own guidance says the tool is not legal advice and is not exhaustive. Use it as an aid, not as an automatic certificate of compliance.
7. Treat reassessment as ongoing
HHS guidance explains that risk analysis should be ongoing and revisited when circumstances change, including new technology, security incidents, ownership changes, or turnover in key personnel. The Security Rule does not impose one universal assessment frequency; the appropriate rhythm depends on the environment.
A practical operating model is to review the risk register quarterly, perform a deeper reassessment on a planned schedule, and trigger targeted updates after major changes. Document why the chosen frequency is reasonable for the practice.
A 30-day starting sequence
- Week 1: Name the security official and inventory systems, vendors, devices, and ePHI locations.
- Week 2: Map high-value workflows and identify missing evidence.
- Week 3: evaluate threats, vulnerabilities, likelihood, impact, and existing safeguards.
- Week 4: approve priorities, owners, deadlines, interim protections, and the next review date.
The goal is not to create a polished binder that goes untouched. It is to maintain a traceable decision process that protects patient information and supports safe, reliable operations.
What is confirmed—and what requires professional review
Confirmed: HHS describes risk analysis as foundational, requires it to address all ePHI, distinguishes analysis from risk management, requires documentation, and expects the process to remain current as the environment changes. HHS and ONC also provide guidance and a small-practice assessment tool.
Requires professional review: whether HIPAA applies to a specific organization or data set, whether a particular safeguard is reasonable and appropriate, breach-notification obligations, contractual duties, and the legal sufficiency of documentation. Those questions depend on facts and should be evaluated with qualified privacy, legal, compliance, and technical advisers.