Guide · Published Oct 26, 2026 · Updated Oct 2026
HIPAA Security Risk Assessment for Small Practices (Using the Free HHS Tool)
Every practice that holds electronic patient data must assess its security risks, and OCR keeps fining small practices that did not. HHS gives you a free tool to do it. Here is how to prepare, how to work through the tool in four sittings, and what to do with the report.
A HIPAA security risk assessment identifies the risks to the electronic patient data your practice creates, receives, stores, or sends, rates them, and feeds a plan to reduce them. Every covered entity must do one. Small practices can use the free HHS Security Risk Assessment Tool, version 3.7 as of October 2026: build the asset and vendor list first, answer seven sections, then turn the risk report into owned tasks.
Key takeaways
- Required for every covered entity, any size: 45 CFR 164.308(a)(1)(ii)(A).
- OCR fined a small New York neurology practice $25,000 in April 2025 for no accurate, thorough risk analysis.
- The free HHS SRA Tool is at version 3.7 (HealthIT.gov, September 2026). It does not guarantee compliance.
- Do it in four sittings: inventory, sections 1 to 3, sections 4 to 7, then the risk management plan.
- The Security Rule update proposed in January 2025 was still not final as of October 2026.
On April 25, 2025, HHS announced that a small New York neurology practice would pay $25,000 and accept a two-year corrective action plan. The core finding was not a sophisticated hack. It was that the practice had failed to conduct an accurate and thorough risk analysis. It was the eighth enforcement action in OCR's Risk Analysis Initiative.
What the HIPAA risk assessment rule requires of a small practice
The HIPAA Security Rule lists risk analysis as a required implementation specification: covered entities must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information they hold (45 CFR 164.308(a)(1)(ii)(A)). The next specification requires risk management: implementing security measures that reduce those risks to a reasonable and appropriate level. Size changes how elaborate your safeguards need to be. It does not change whether you must assess.
The free Rescue Kit includes the recurring-task tracker where the annual risk assessment, quarterly access reviews, and BAA renewals live, with owners and alarms.
Get the free Rescue Kit| Requirement | What it means in practice | Evidence to keep |
|---|---|---|
| Risk analysis | Find where ePHI lives and what could go wrong, and rate each risk | The completed assessment and reports, dated |
| Risk management | Decide and carry out fixes for the risks you found | A plan with owners, dates, and completion notes |
Why small practices get fined
OCR's enforcement announcements repeat a pattern: after a breach or complaint, investigators ask for the risk analysis, and the practice cannot produce an accurate, current one. OCR's Risk Analysis Initiative focuses on exactly that failure. The penalty in the neurology case was modest next to the corrective action plan, which means two years of documented remediation and reporting. An assessment done each year, with a plan behind it, is the cheapest protection a small practice has.
The free HHS SRA Tool
| Item | Detail |
|---|---|
| Current version | 3.7 (page last updated September 18, 2026) |
| Formats | Windows desktop application (64-bit Windows 7, 8, 10, 11) and an Excel workbook |
| Built for | Small and medium providers; HHS says it may not suit larger organizations |
| What it covers | Administrative, physical, and technical safeguards, via multiple-choice questions, asset and vendor lists, threat ratings, and reports |
| New in 3.7 | Assessment-scope question for every location handling ePHI; remote access and telework; modernized asset inventory; system-activity logging; review triggers |
| Your data | HHS does not collect, view, store, or transmit anything you enter |
| Limits | Neither required by nor a guarantee of compliance; may not identify every risk |
The user guide (version 3.6.1, May 2026) lays the assessment out in seven sections: Security Risk Assessment Basics; Security Policies, Procedures, and Documentation; Security and Your Workforce; Security and Your Data; Security and Your Practice; Security and Your Vendors; and Contingency Planning. After each section, you select the vulnerabilities that apply and rate each threat's likelihood and impact as low, moderate, or high. The tool then produces a detailed report, a risk report, and a remediation report.
Before you open it: the inventory
The assessment is only as accurate as your list of where patient data lives. Version 3.7 added an assessment-scope question for exactly this reason. Build the inventory first, in a spreadsheet, and import it.
| Category | Examples |
|---|---|
| Clinical and billing systems | EHR, practice management, clearinghouse, patient portal |
| Devices | Workstations, laptops, phones, tablets, scanners, copiers with storage |
| Communication | Email, fax service, phone system and voicemail, texting platform |
| Cloud and office apps | File storage, office suite, scheduling, website forms |
| Operational tools | Project tools such as ClickUp, Monday, or Asana, listed as "chart numbers only by policy," with BAA status noted |
| Vendors and business associates | Each vendor, what it touches, and whether a BAA is signed |
| Locations and remote work | Every office, plus any staff who work from home |
Listing your project tool as an asset with "chart numbers only by policy" is not a formality. It documents a decision, and it gives you something to check: a quarterly look for names or diagnoses that crept onto a board. That design is laid out in the chart-numbers-only setup for ClickUp, Monday, and Asana.
Do not list it as "no PHI," though. A chart number is a medical record number, which HIPAA lists among the identifiers (45 CFR 164.514(b)(2)(i)(H)), so a chart-number board holds minimized data, not de-identified data. Keep cards minimal, note whether the tool has a BAA, and confirm with your compliance advisor whether it needs one. Website contact and intake forms are another place data leaks without anyone noticing; the website forms guide covers them.
SRA asset inventory, ready to import
| Asset | Category | Touches patient data | BAA status | Notes |
|---|---|---|---|---|
| EHR | Software | Yes | Signed | MFA on |
| Fax service | Vendor | Yes | Signed | |
| Software | Yes | Accepted | MFA on | |
| Laptop 3 | Device | Yes | Not applicable | Encryption: no |
| ClickUp | Software | Chart numbers only, by policy | None | Compliance advisor review scheduled |
| Website intake form | Vendor | Yes | Pending | Follow up with vendor |
Four sittings, start to finish
| Sitting | Work | Who |
|---|---|---|
| 1. Inventory and setup | Install or open the workbook; enter practice info; import assets and vendors | Practice manager, with IT support |
| 2. Sections 1 to 3 | Assessment basics, policies and documentation, workforce | Practice manager, privacy or security officer |
| 3. Sections 4 to 7 | Data, physical practice, vendors, contingency planning | Practice manager, IT, one physician owner |
| 4. Risk plan | Review the risk report; assign every high and moderate risk an owner and date | Practice manager and owner |
Answer honestly. The tool flags weak answers as areas for review, and those flags are the point; an assessment with no findings is the one OCR will doubt. Use the notes fields to record why you answered as you did and what evidence exists. Save the file somewhere secure and backed up, because it is a map of your weaknesses.
From report to risk management plan
The report is not the deliverable. The deliverable is the plan that comes out of it. Take every high and moderate risk from the risk report and turn it into a task: what will change, who owns it, and by when. Typical small-practice items include turning on multifactor authentication for email and the EHR, encrypting laptops, removing former staff accounts and shared logins (the payer portal access sheet helps here), signing missing BAAs, testing backups, and writing a downtime procedure.
Track those tasks on your operations board with a description of the safeguard, never patient details. Mark each one done with a date and a short note on what was done. A year later, that log plus the next assessment is your evidence of ongoing risk management.
Risk management plan board, demo
To do
In progress
Done, with date
The proposed Security Rule update
HHS published a proposed overhaul of the Security Rule in the Federal Register on January 6, 2025; comments closed March 7, 2025. As of October 2026 it remains a proposal. HIPAA Journal reported on October 6, 2026 that OCR's earlier May 2026 target had passed and the regulatory agenda now lists July 2027. The 2003 rule is what OCR enforces today.
| Proposed change | What to do now |
|---|---|
| Written technology asset inventory and network map | Build the inventory above; it is good practice regardless |
| Multifactor authentication, with limited exceptions | Turn it on for email, EHR, and remote access |
| Encryption of ePHI at rest and in transit | Encrypt laptops and phones; confirm vendor encryption |
| Compliance audits at least every 12 months | Keep the annual assessment on the calendar |
| Removing the required vs addressable distinction | Document why any safeguard is not in place |
Do not treat proposed requirements as current law, and do not ignore them either. Most of them are things a careful practice does anyway.
Put it on the calendar
Schedule the assessment every year in the same month, and add review triggers: a new EHR or major system (see the EHR migration guide), a new location, remote staff, a new vendor that touches patient data, or any security incident. Put it on the compliance calendar next to HIPAA training and OSHA dates, with the practice manager as owner. That is how the assessment stops being a scramble after a breach and becomes a routine nothing slips past.
For the wider operations library, see medical practice operations; for recurring compliance tasks with owners, the recurring tasks template. Every free tracker and SOP template we publish is indexed in the free ClinicOps Template Library. If you prefer a number on what operational gaps cost before you start, the free Leak Audit gives you one.
- Find your last risk assessment and write its date down. If there is none, this hour is sitting one.
- Start the inventory: every system, device, and vendor that touches patient data, with its BAA status.
- Download the current SRA Tool from HealthIT.gov, either the Windows application or the Excel workbook.
- Book the four sittings on the calendar over the next four weeks, with the owner-physician in sitting four.
Find your leak before you fix it
Two ways to start, both free. Take the tracker and denial log and run it yourself, or get a 20-minute Leak Audit where we put a real number on what your operations are costing, using your own practice.
Frequently asked questions
Is a HIPAA security risk assessment required for small practices?
Yes. The HIPAA Security Rule requires every covered entity, regardless of size, to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the electronic protected health information it holds (45 CFR 164.308(a)(1)(ii)(A)), and to manage the risks it finds.
What is the HHS Security Risk Assessment Tool?
A free tool from HHS (ONC with OCR) that walks small and medium practices through a security risk assessment with multiple-choice questions, asset and vendor lists, threat ratings, and reports. As of October 2026, HealthIT.gov offers version 3.7 as a Windows application and an Excel workbook.
Does using the SRA Tool make my practice HIPAA compliant?
No. HHS states that using the tool is neither required by nor guarantees compliance with federal, state, or local laws. It is a structured way to do the assessment, and you still have to act on the findings with a risk management plan and keep documentation.
How often should a small practice do a security risk assessment?
The current rule requires the assessment and ongoing risk management but does not set a fixed interval. Most practices review it at least once a year and whenever something material changes, such as a new EHR, a new location, remote staff, a new vendor, or a security incident.
Is the HIPAA Security Rule update final?
Not as of October 2026. HHS published a proposed rule on January 6, 2025, and as of mid-October 2026 reporting indicated the final rule had not been issued, with the regulatory agenda target moved to July 2027. The 2003 rule remains in effect.
Does HHS see the data I enter in the SRA Tool?
No. HealthIT.gov states that HHS does not collect, view, store, or transmit any information entered into the SRA Tool. The file stays on your computer, so store it securely and back it up, because it describes your vulnerabilities.