Our Practice Has Never Done the HIPAA Risk Analysis. What Is It, and How Do We Get One Done?

The office manager at a pediatric dental practice in Meadville found the gap on page three of a cyber insurance renewal. The question read: "Date of your most recent HIPAA security risk assessment." She checked the shared drive, the filing cabinet, and the binder the practice bought from a compliance vendor in 2019. The binder had a template with the practice name typed on the cover. Nothing inside it had been filled out.

That is the most common answer we hear when we ask a small practice about its HIPAA risk assessment. Not "we did it badly," but "we bought something once and assumed that counted." This post, built from a composite of what we see at independent medical and dental offices across Crawford, Mercer, Lawrence, and Erie counties and in the Youngstown area, explains what a HIPAA security risk assessment actually is, what it is not, what regulators look for, and how a small practice gets one done without shutting down for a week.

What is a HIPAA security risk assessment?

The HIPAA Security Rule requires every covered entity (and every business associate) to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities" to the electronic protected health information (ePHI) it holds. The regulation calls it a risk analysis. Most people call it a HIPAA security risk assessment or a HIPAA risk assessment. They are the same thing.

In plain English, it answers four questions in writing:

1. Where does patient information live? The practice management system, the imaging software, the EHR, email, the fax server, the scanner that saves to a shared folder, the backup drive, the hygienist's tablet, and the cloud apps nobody remembers signing up for.

2. What could go wrong with it? Ransomware, a stolen laptop, a phished front desk password, a former employee who can still log in, a server that dies with no tested backup, a vendor that gets breached.

3. How likely is each of those, and how bad would it be? A ransomware attack on the only server is both likely and catastrophic. A break-in at a locked office with encrypted machines is unlikely and survivable.

4. What are you doing about it? The safeguards already in place, the gaps that remain, and the plan to close them.

It is the healthcare-specific version of a cybersecurity assessment.

The output is a document, usually 15 to 40 pages for a small practice, plus a risk register: a table of each risk, its rating, and who is fixing it by when. That second part matters. HIPAA requires a risk analysis and a risk management plan. Finding the problems is half the requirement. Showing that you acted on them is the other half.

Is a HIPAA risk assessment the same as a compliance checklist?

No, and this is where most small practices get caught. A checklist asks "Do you have a password policy?" and you tick yes. A risk assessment asks "Which systems hold patient data, who can log into each one, how do they log in, and what happens if one of those passwords is stolen?" The checklist produces a score. The risk assessment produces a picture of your actual office.

Federal regulators have been clear on this for years. The Office for Civil Rights (OCR), the part of the Department of Health and Human Services that enforces HIPAA, has rejected checklists, vendor questionnaires, and network scans submitted as a risk analysis when they did not cover all the ePHI in the practice. A vulnerability scan is useful evidence. It is not the assessment.

The binder in Meadville is a good example. It contained a sample policy set and a 60-question yes/no form. Even if every question had been answered, it would not have identified that the practice's imaging software saved X-rays to a shared folder every workstation could open, or that the front desk shared one login to the practice management system. Those were the two findings that mattered most.

Why does a small practice need a HIPAA risk assessment?

Because it is the requirement every other part of HIPAA security is built on, and because it is the one regulators ask for first.

It is the foundation of enforcement. OCR launched a Risk Analysis Initiative in 2024, and a long run of recent settlements, including several against small and solo practices, cite the same failure: no accurate, thorough risk analysis. When a breach report reaches OCR, the first document requested is usually the risk analysis. A practice that cannot produce one starts the investigation already behind. Insurers ask for it. Cyber liability applications for healthcare now commonly ask for the date of the last risk assessment, and some ask for a copy. A blank answer can raise the premium, narrow the coverage, or end the conversation. Partners ask for it. Hospital systems, larger group practices, and payers increasingly send vendor security questionnaires to the independent practices they work with. The risk assessment answers half of those questions for you. It tells you where to spend. Without one, IT spending in a small practice tends to follow whatever went wrong last. With one, you can rank the gaps and fix the expensive ones first. That is the same logic behind a broader cyber security audit, applied to the specific rules a healthcare office lives under.

The rule is also under revision. HHS proposed an update to the Security Rule that would make several things more explicit, including a written technology asset inventory, a network map, and a risk analysis reviewed at least every 12 months. Whether or not the final version matches the proposal, the direction is plain: more documentation, more often, not less.

What does a real HIPAA risk assessment cover?

For a 5 to 30 person medical or dental office, a thorough assessment works through these areas:

• An inventory of every system and device that touches ePHI. Servers, workstations, laptops, tablets, phones that receive patient texts or email, imaging equipment, the fax line, the copier with a hard drive, and every cloud service.
• A data flow map. How patient information moves: from the check-in tablet into the practice management system, out to the lab, to the clearinghouse, to the backup, and to the billing company.
• Access control. Who has an account on each system, whether logins are shared, whether multi-factor authentication is on for email and remote access, and whether former staff are actually removed.
• Device security. Encryption on laptops and portable drives, endpoint protection, automatic screen locks, and patching. Unpatched workstations running imaging software are one of the most common findings in dental offices.
• Backup and recovery. Whether backups exist, whether they are encrypted and kept off-site, and whether anyone has restored one recently. Our guide to disaster recovery planning covers that piece in depth.
• Vendor relationships. A signed business associate agreement (BAA) with every vendor that handles patient data, including the IT company, the cloud backup provider, and the email host.
• Physical safeguards. Where the server sits, who can reach it, and whether screens at the front desk face the waiting room.
• Policies and training. Whether written policies exist, match what the office actually does, and whether staff have been trained on them this year.

Each finding gets a likelihood, an impact, a resulting risk level, and a remediation step with an owner and a date.

How often do you need a HIPAA security risk assessment?

Current HIPAA rules say "periodically" and whenever something significant changes, without naming a number. In practice, the defensible answer is at least once a year, plus an update any time you:

• Switch EHR or practice management systems
• Move from a local server to a cloud-hosted system
• Open a second location or add remote staff
• Change IT providers
• Have a security incident, even a minor one

An assessment from 2021 for an office that has since moved its EHR to the cloud does not describe the practice that exists today, and OCR treats an outdated analysis much like a missing one.

Can we do the HIPAA risk analysis ourselves?

You can. HHS publishes a free Security Risk Assessment Tool designed for small and medium practices, and a practice manager who is comfortable with technology can work through it. Some practices do this well.

The limitation is not the tool. It is that the person filling it out has to know the answers. "Is ePHI encrypted at rest on all workstations?" is a question most practice managers cannot answer without someone checking each machine. Self-assessments tend to be optimistic in exactly the places where breaches happen: shared logins, unpatched imaging PCs, the old laptop in the doctor's bag, and the vendor with no BAA.

The approach that works for most small practices is a split. Your IT provider gathers the technical facts (the device inventory, encryption status, account audit, backup test, and a vulnerability scan), and the practice owner or designated security official makes the risk decisions and signs the plan. HIPAA expects the practice to own the risk. It does not expect the office manager to audit the firewall.

If you already have an IT person on staff, a co-managed arrangement can supply the technical fieldwork while your person stays in charge of the day-to-day.

What happened at the Meadville practice?

The assessment took about three weeks of calendar time and roughly six hours of the office manager's time, most of it in two interviews and a review meeting. The technical fieldwork happened after hours so no patient days were affected.

It produced 23 findings. Five were rated high:

• The front desk shared one login to the practice management system, so nothing in the audit log could be tied to a person.
• X-rays saved to a shared folder every workstation could open, with no access restriction.
• The lead dentist's laptop, which held exported patient reports, was not encrypted.
• The backup ran nightly but had not been test-restored in over a year. The first test restore failed.
• There was no BAA with the cloud backup vendor or the email host.

Within 60 days, every staff member had their own login, the imaging folder was locked down, the laptop was encrypted, the backup was rebuilt and a restore was tested and documented, and both BAAs were signed. The remaining medium and low findings went on a quarterly schedule. The insurance renewal went back with a real date on page three and a copy of the executive summary attached.

That is what a HIPAA security risk assessment is supposed to do for a small practice: turn a blank question on a form into a short list of fixes, done in order, with paper to prove it. For the broader picture of running IT in a medical office, see our guide to managed IT services for healthcare, and for the dental side specifically, our post on dental office IT support.

MCR Business Tech Solutions conducts HIPAA risk assessments and handles the remediation work for medical and dental practices across Crawford, Mercer, Lawrence, Butler, Erie, and Allegheny counties in Western Pennsylvania, and Trumbull and Mahoning counties in eastern Ohio. If an insurer, a hospital partner, or your own conscience is asking when your last risk analysis was done, call 833-859-9021 or Request an IT assessment through our contact page. We will start with what you have, show you what is missing, and give you a plan you can actually finish.