Just as checking your tires prevents a sudden highway blowout, a HIPAA Risk Analysis provides vital preventive cybersecurity maintenance, stopping minor vulnerabilities from becoming catastrophic data breaches.
A Risk Analysis is also mandatory under HIPAA.
In 2020, a phishing email compromised a single employee’s email account at Ambry Genetics. Six years later, the company paid OCR $700,000. OCR found that Ambry had never conducted an accurate, thorough analysis of the risks to its electronic protected health information (ePHI).
OCR enforcement actions cite the same gap repeatedly.
A breach isn’t automatically a HIPAA violation. A missing risk analysis is.
How Ready Are You?
If you are responsible for HIPAA compliance at your organization, here’s a quick test. If OCR called tomorrow and asked for your risk analysis, could you provide three things?
- A current inventory of every system that touches ePHI
- A documented assessment of the threats and vulnerabilities facing each one
- A risk management plan showing what you’ve done about the findings
Hesitated on any of them? This checklist is for you. The OCR won’t accept old templates, dusty spreadsheets, or generic vendor scans. Here is what a bulletproof, up-to-date risk analysis looks like.
A HIPAA risk analysis has always been the foundation of Security Rule compliance. It’s also, consistently, the single most common failure OCR identifies when it investigates a breach. We recently covered why OCR Director Paula Stannard reiterated that risk analysis remains the agency’s top enforcement priority, and why the proposed Security Rule overhaul is set to make several previously flexible safeguards mandatory.
This post takes a different angle: a practical, step-by-step checklist for conducting a risk analysis that would hold up under an OCR review today, updated to reflect where the requirements are headed.
What a Risk Analysis Actually Requires
Under 45 CFR § 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) they create, receive, maintain, or transmit. That sounds broad because it is.
A compliant risk analysis isn’t a generic template or a vendor-supplied questionnaire you fill out once and file away. It’s an organization-specific, enterprise-wide assessment that you revisit as systems, vendors, and threats change.
Step 1: Build a Complete IT Asset Inventory
You can’t protect ePHI you don’t know you have. Start with a written inventory of every location that creates, stores, processes, or transmits ePHI. This includes servers, workstations, mobile devices, EHR systems, cloud platforms, and, increasingly, AI tools used anywhere in your organization.
A generic description like “we use an EHR and some cloud storage” is not enough; OCR expects a documented, current inventory specific to your environment.
Step 2: Map How ePHI Moves
Once you know what you have, map how ePHI flows through it. Where does data enter your systems? Where is it stored? Which vendors or business associates receive it, and through what channel? A network map showing this movement is now an explicit expectation, not an optional nice-to-have, particularly as organizations add more third-party integrations and cloud services to their environment.
Step 3: Identify Threats and Vulnerabilities
With your inventory and data flows documented, identify realistic threats to each system and location where ePHI lives. This includes traditional risks like unpatched software, weak access controls, and unencrypted devices, but should also explicitly account for AI-specific risks.
Examples include workforce members entering PHI into public or unvetted AI tools; AI vendors with inadequate data protections; and business associates using AI systems. If a tool touches ePHI, it belongs in this step, regardless of whether it was formally “IT-approved” or adopted informally by a department.
Step 4: Assess Likelihood and Impact
HIPAA regulations allow you to use your judgment. You don’t need to address every threat.
For each identified threat, assess how likely it is to occur and how severe the impact would be if it did. This step separates a real risk analysis from a checklist exercise: it produces a prioritized list of risks that need the most urgent attention, rather than treating every gap as equally important.
Step 5: Implement the Safeguards That Are No Longer Addressable
In 2026, the checklist requires more. Under the traditional framework adopted in 2003, some Security Rule specifications have been labeled “addressable,” which many organizations mistakenly treated as optional. The proposed Security Rule update eliminates that distinction.
For example, safeguards such as multi-factor authentication (MFA) and encryption of ePHI at rest and in transit are now standard expectations for OCR. If your risk analysis identifies a gap in either of these, “we assessed it and took a different path” is no longer defensible without an extremely strong justification.
Step 6: Document Everything
Written documentation is a requirement, not a best practice. That includes your risk analysis findings, the risk management plan that addresses them, records of implemented safeguards, and the rationale for any decision not to implement a particular control. If you don’t document it, OCR will treat it as if it didn’t happen.
Step 7: Build (and Actually Use) a Risk Management Plan
A risk analysis that identifies problems but never leads to action provides little real protection and won’t satisfy OCR either. Every identified risk should feed into a risk management plan with specific remediation steps, owners, and timelines. Enforcement has shifted toward evaluating whether organizations are actively executing on their risk management plans, not just whether the original analysis document exists.
Step 8: Confirm BAAs Are in Place for Every AI and Cloud Vendor
As part of your risk analysis, verify that every third-party platform, including AI tools, that receives, processes, or transmits ePHI has a signed Business Associate Agreement. This is a common gap because organizations adopt AI features embedded in existing software or try new AI vendors without a formal procurement review.
Step 9: Revisit It at Least Once a Year
A risk analysis isn’t a one-time project. New vendors, AI tools, remote work arrangements, and threats all change your risk picture. Review and revise the risk analysis at least annually, and add it to your compliance calendar whenever you adopt a significant new system or vendor.
Why This Matters Heading Into 2027 and Beyond
The proposed Security Rule changes aren’t finalized yet, and the timeline has already shifted once. But OCR’s enforcement posture in the meantime is clear, and it isn’t waiting for the final rule to start evaluating organizations against these expectations. A thorough, current, well-documented risk analysis is the single best protection against both a future breach and potential civil penalties for noncompliance.
The HIPAA E-Tool® Delivers
Whether you do this in-house or bring in outside help, a few things separate a risk analysis that protects you from one that fills a binder:
- It’s specific to your organization, reflecting your systems, vendors, and workflows rather than a generic template.
- It produces documentation you could hand to OCR, not just a score or a dashboard.
- It connects findings to action, with owners and timelines for each risk, not just a list of problems.
- It stays current, updating as you add vendors, adopt AI tools, or as regulations change.
The HIPAA E-Tool® makes all of this manageable. A step-by-step guide, interactive forms for your PHI inventory, and a Security Rule checklist walk you through the analysis. The E-Tool then builds a risk management plan from your answers and automatically documents everything, so you’ll have the records ready if OCR ever asks.
