Skip to main content

HIPAA Risk Analysis: The 9 Elements OCR Looks For in 2026

By Joseph Abear ·
Add as a preferredsource on Google
HIPAA Risk Analysis

Last updated: October 20, 2026

A HIPAA risk analysis is the written assessment of where your electronic protected health information (ePHI) lives and what could go wrong with it. It rates how likely and how bad each failure would be. It is required, not optional, under 45 CFR § 164.308(a)(1)(ii)(A). The HHS Office for Civil Rights (OCR) runs a Risk Analysis Initiative to enforce it. OCR's own guidance calls risk analysis the first step in Security Rule compliance. You will also see it called a security risk assessment or SRA. Same document, same rule. This guide gives you the plain-language definition, the nine elements OCR looks for, and a worked example. It also gives you a step-by-step method a small practice can follow this week, and covers the system that analyses often forget: the website.

TL;DR: Quick answer

  • The HIPAA risk analysis is a required implementation specification (45 CFR § 164.308(a)(1)(ii)(A)). Every covered entity and business associate must have one, in writing, and update it.

  • OCR's guidance names nine elements: scope, data collection, threats and vulnerabilities, current controls, likelihood, impact, risk level, documentation, and periodic review.

  • OCR's Risk Analysis Initiative enforces this one requirement, and its 14th enforcement action came in June 2026. Several of its settlements also require a risk management plan that acts on the findings.

  • A common failure is scope: an analysis that covers the EHR and forgets the website, the forms, the vendors, and the backups.

  • A small practice can build a defensible one with HHS's free Security Risk Assessment Tool, a data-flow map, and the five steps below.

  • If you host with us, we sign a BAA within 24 hours of signup, before patient data moves. Managed plans start at $229 a month, with no long-term contract.

What is a HIPAA risk analysis, in plain terms

Think of a HIPAA risk analysis as a map plus a scorecard. The map shows every place patient data lives and moves. The scorecard rates, for each place, how likely something is to go wrong and how bad it would be. The rule's own words ask for an "accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of ePHI. Three ideas sit inside that sentence, and they map to three plain questions.

  • Confidentiality: could the wrong person see it? (a stolen login, a leaked email, a tracking pixel). The wrong person can also work for you; see how audit logs catch staff snooping.

  • Integrity: could it be changed or corrupted without anyone knowing? (a bad restore, an unlogged edit). Our guide to HIPAA audit logs covers what to record so you would know.

  • Availability: could you lose access to it? (ransomware, an outage, a vendor shutting down)

The risk analysis answers those three questions for every system. It then feeds risk management (§ 164.308(a)(1)(ii)(B)), the required next step where you actually reduce the risks you found. The rule names no method. NIST's risk-assessment framework and OCR's own guidance both describe what any good method must produce, and both are free.

The nine elements OCR looks for

OCR's risk analysis guidance names nine elements a risk analysis must include, whatever method you use. HHS still posts it as current guidance, last reviewed August 12, 2026. Measure your HIPAA risk analysis against all nine. Skip one and it is a finding waiting to happen.

Element

What it means

What it looks like for a practice website

1. Scope

Every system holding ePHI, in every form and place

The site, its forms, its host, its vendors, and any old copies

2. Data collection

Map where ePHI is stored, received, kept, and sent

Intake form to database to notification email to inbox

3. Threats and vulnerabilities

What could go wrong, and the weakness it would use

Threat: an ad pixel. Vulnerability: it runs on the booking page

4. Current security measures

What already protects each system

Host BAA, encryption, MFA, backups, logging

5. Likelihood

How likely each threat is, given the controls

Plaintext form emails: high. Server room fire: low

6. Impact

How bad it would be

Records exposed, notices owed, care disrupted

7. Risk level

Likelihood and impact combined, ranked

Fix the highs first, document the lows

8. Documentation

Written down, dated, kept six years (§ 164.316(b)(2)(i))

The report plus the risk management plan

9. Periodic review

Repeated on a schedule and after any material change

Yearly, plus after a redesign, new form, or new vendor

A worked example: one intake form

Here is what one row of a HIPAA risk analysis looks like, so the nine elements stop being abstract. The system: the new-patient intake form on the practice website. Data flow: the patient types symptoms and insurance details, the form plugin stores them in the site database and emails a copy to the front desk. Threats and vulnerabilities: the email travels in plain text, and the database sits on a shared host with no BAA. An analytics tag also fires on the form page. Current controls: HTTPS on the page, nothing else. Likelihood: high, because every submission repeats the exposure. Impact: high, because every submission is identifiable health information. Risk level: high. Risk management plan: move the form to BAA-covered hosting with encrypted storage, switch to content-free notification emails, remove the tag. Review date: one year, or sooner if the form changes. That paragraph is one complete HIPAA risk analysis entry. Multiply it by every system that touches ePHI and you have the document. Your EHR gets rows too, covering restore tests and the exit plan, as our guide to HIPAA compliant EHR hosting advises.

The scope failure that catches many practices

Here is a pattern that repeats. A practice runs a HIPAA risk analysis on the EHR and the office network. The document looks complete. Then a breach or complaint arrives through a system the analysis never named: the practice website. Its intake forms, its booking flow, its notification emails, its analytics tags, the host with no BAA, the staging copy nobody deleted. Every one of those is an ePHI system under element one, and every one was out of scope. Website tracking has also cost health systems in private class actions, separate from any OCR finding. Courts approved class settlements with Novant Health in June 2024, Advocate Aurora Health in July 2024, and Kaiser Foundation Health Plan in July 2026. Kaiser had sent notices to nearly 13.4 million members about its tracking. Each turned on tracking code, a website system a thorough analysis should name. If your website collects patient data, it belongs in the HIPAA risk analysis by name, with its own rows. What that system needs to look like is mapped in our HIPAA compliant website guide, and the tickable version is our HIPAA compliance checklist.

Whether your site is in scope at all is settled in who needs HIPAA-compliant hosting. Website systems that are in scope belong on HIPAA hosting services that sign a BAA, so the host row in your analysis has a real answer.

How to do a HIPAA risk analysis: five steps

A small practice can build a HIPAA risk analysis it can defend in a few working sessions. Follow the five steps in order.

  1. Inventory every ePHI system. List them all: the EHR, the website, every form tool, the scheduler, the email, the backups, the laptops, and each vendor with its BAA status. The vendor side is explained in our HIPAA business associate agreement guide. If a system is not on this list, it is not in the analysis. To see who hosts each system and whose BAA covers it, use our system-by-system hosting map.

  2. Map the data flows. For each system, write where patient data enters, where it travels, where it rests, and where it leaves. A one-page diagram is enough. This is element two, and it is where the website surprises people. Map AI workflows that handle patient data too; they need a BAA for the model service and one for their hosting.

  3. List threats, vulnerabilities, and current controls per system. Use the worked example above as the template. Be honest about the controls that exist versus the ones you assume exist. Whether your authentication passes that test is the subject of HIPAA MFA requirements.

  4. Rate likelihood and impact, then rank. Low, medium, high is fine. Combine them into a risk level and sort. The highs become your risk management plan with an owner and a date each.

  5. Document, date, and calendar the review. Store the report and the plan together, and keep them for six years from the date they were last in effect. Set a yearly review, plus a trigger for any material change: a redesign, a new form, a new vendor, an incident. That schedule is what keeps a HIPAA risk analysis current instead of historic.

HHS publishes a free Security Risk Assessment Tool, built for small and medium providers. It walks you through multiple-choice questions, threat and vulnerability ratings, and asset and vendor lists. Use it, but feed it the website systems it will not know to ask about. Otherwise the HIPAA risk analysis it produces will have the same scope hole as so many others. Add the framework your site or portal runs on, with its support dates. A Yii HIPAA compliant app, for example, has a dated support window. Yii 2.0.50 and later moves to security fixes only on November 23, 2026, and reaches end of life on November 23, 2027.

Why 2026 is the year to have one

OCR runs a Risk Analysis Initiative to enforce this one requirement directly. Its 14th enforcement action came in June 2026: a $450,000 settlement with the Spencer Gifts LLC health plans. Its earlier 2026 settlements with Top of the World Ranch and MMG Fusion required a risk management plan that acts on the findings. Ransomware cases show the same gap. In all four ransomware settlements announced on April 23, 2026, OCR found each organization had failed to conduct an accurate and thorough HIPAA risk analysis. Our healthcare data breach statistics track the settlement figures. Civil money penalties, as adjusted in January 2026, run from $145 to $2,190,294 per violation. The document is cheap. Its absence is not. When the analysis turns up an incident you did not know about, accidental HIPAA violation covers the response.

The part practices cannot see from the inside

Here is the honest pain point. Steps three and four are easy for systems you understand. They are hard for the website, because its threats live where an office cannot easily look. Think of the scripts firing in visitors' browsers, the mail path the form plugin uses, the vendor chain behind the booking widget, and the server logs. If you want outside help with that gap, ask about our client-side compliance review. Whoever checks it, give each website finding its own row in your HIPAA risk analysis, with a risk level and a fix.

Element four of your HIPAA risk analysis also asks what protects the host. Our healthcare hosting runs on single-tenant AWS with encryption at rest and in transit, six-year audit logging, and tested encrypted backups. We sign a BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run, so your other vendors still need their own. Managed plans start at $229 a month, with 4 hours of migration and configuration included in the first month. We sell both, so weigh that as a disclosure. The five steps above are yours either way. Tell us what your analysis covers today if you want a second look at the website and host rows.

Frequently asked questions

Is a HIPAA risk analysis required?

Yes. It is a required implementation specification under 45 CFR § 164.308(a)(1)(ii)(A), not an addressable one. Every covered entity and business associate must conduct and document one. OCR's guidance calls risk analysis the first step in Security Rule compliance.

How often should a HIPAA risk analysis be done?

The Security Rule does not set a fixed schedule. OCR's guidance says the process should be ongoing, and that some organizations repeat it annually while others do it as needed. Yearly is a sensible default, plus a fresh look after any material change: a new system, a new vendor, a redesign, or an incident. Element nine of the guidance is periodic review for exactly this reason.

Is a risk analysis the same as a risk assessment?

In HIPAA usage they are the same thing; HHS's free tool is even called the Security Risk Assessment Tool, or SRA Tool. Risk management is the different step: acting on what the analysis found, required under § 164.308(a)(1)(ii)(B).

Does my website need to be in the risk analysis?

If it collects, stores, or sends patient data, yes, by name. Forms, booking flows, portals, notification emails, analytics tags, and the host itself are all ePHI systems under the scope element. Leaving them out of a HIPAA risk analysis is a common scope gap.

Can I use a template?

As a starting structure, yes. As the finished product, no. OCR requires an accurate and thorough analysis of your systems, and a template filled with generic answers fails the accuracy test. HHS's SRA Tool is the safest scaffold because it forces you to answer about your own environment.

What is the difference between a threat and a vulnerability?

A threat is the thing that could go wrong: an attacker, a staff mistake, an outage. A vulnerability is the weakness it would use: an unpatched plugin, a shared login, a pixel on a patient page. The analysis pairs them, then rates the pair.

Recap: HIPAA risk analysis

To recap, a HIPAA risk analysis is the required, written assessment of every ePHI system's threats, controls, likelihood, and impact, ranked and reviewed. OCR's guidance names nine elements, and OCR enforces the requirement through its Risk Analysis Initiative. Settlements can also require a risk management plan that acts on the findings. Scope is a common failure, and the website is easy to leave out. Inventory everything, map the flows, rate honestly, fix the highs, write it down, and repeat yearly.

This article is general information, not legal advice. Regulatory citations reflect 45 CFR Part 164 and OCR's risk analysis guidance as of October 2026; enforcement details reflect public OCR announcements through October 20, 2026. Confirm your obligations with qualified counsel. We sell HIPAA compliant hosting and compliance reviews. Reviewed October 2026.

Sources

Read full definition

View link to copy manually
← Back to all posts

Stay current on HIPAA hosting

Practical guidance on compliance, hosting and the rules that actually apply to your practice.

Email me occasional updates about HIPAA hosting and compliance. No more than a few times a month, and you can unsubscribe at any time.