The HIPAA Security Rule requires every covered entity and business associate to carry out an accurate and thorough risk analysis of the electronic protected health information (ePHI) it holds, and then to manage the risks it finds. This free HIPAA security risk assessment checklist runs that yearly exercise from start to finish: scoping every system that touches ePHI, identifying threats and vulnerabilities, rating likelihood and impact, building the risk register, writing the risk management plan and keeping the evidence. It is deliberately narrow. Our HIPAA Compliance Audit Checklist checks your whole programme against the Privacy, Security and Breach Notification Rules, and our HIPAA compliance guide explains the rules themselves. This template is the risk analysis workflow that both of them assume you have already done.
Two implementation specifications sit at the very start of the Security Rule’s administrative safeguards, and both are required rather than addressable. Under 45 CFR 164.308(a)(1)(ii)(A), you must assess the potential risks and vulnerabilities to the confidentiality, integrity and availability of all the ePHI you create, receive, maintain or transmit. Under 164.308(a)(1)(ii)(B), you must then put security measures in place that reduce those risks to a reasonable and appropriate level. Every other safeguard decision in the rule, from encryption to audit logging, is supposed to follow from that analysis.
The rule does not prescribe a method. HHS’s guidance on risk analysis sets out the elements OCR expects to see: a scope that covers all ePHI, data collection, identified threats and vulnerabilities, an assessment of current security measures, likelihood and impact, a level of risk, documentation and periodic review. NIST SP 800-30 and SP 800-66 Rev. 2 describe methods that satisfy those elements. OCR has made weak risk analyses an enforcement priority: its Risk Analysis Initiative had produced at least 14 enforcement actions by mid-2026, and most ransomware settlements cite the same failure.
Rule: 164.308(a)(1)(ii)(A), required.
Output: an ePHI inventory, threat and vulnerability pairs, likelihood and impact ratings, and a risk register.
Covered by: Phases 1–4 of this template.
Rule: 164.308(a)(1)(ii)(B), required.
Output: a treatment decision, owner and date for every risk, with remediation tracked to closure.
Covered by: Phases 5–7 of this template.
Rule: all three HIPAA Rules, standard by standard.
Output: findings against the Privacy, Security and Breach Notification Rules.
Covered by: the HIPAA Compliance Audit Checklist.
Six phases take the assessment from scoping to a signed report. A seventh phase switches on automatically when any risk is rated High.
The most common reason OCR rejects a risk analysis is scope. If a system holds ePHI and is not in the inventory, it is not in the analysis.
Shown only when Phase 4 records at least one High risk. Conditional logic keeps these tasks out of the way when there is nothing urgent to fix.
Assigned to the Security Official by name. The analyst who compiled the register should not approve it.
A risk register is only useful if two people would rate the same risk the same way. Agree the scale before Phase 4 starts and keep it for the whole assessment. The three-point scale below matches the Low, Moderate and High language used in the HHS SRA Tool, and it is simple enough for a small practice to apply consistently. Larger organisations often use five points, which also works, provided the definitions are written down.
| Likelihood ↓ Impact → | Low impact | Moderate impact | High impact |
|---|---|---|---|
| High likelihood | Moderate | High | High |
| Moderate likelihood | Low | Moderate | High |
| Low likelihood | Low | Low | Moderate |
| Level | Likelihood means | Impact means | What the checklist does next |
|---|---|---|---|
| High | Expected within the year, or has already happened here or at a peer | Harm to patients, a reportable breach of many records, or days of downtime | Phase 6 opens: interim safeguards, a remediation project and leadership escalation |
| Moderate | Plausible within the year, with some controls in place | A limited breach, hours of disruption or a regulatory finding | Mitigation with an owner and a date in the risk management plan |
| Low | Unlikely, with strong controls in place | Minimal records affected and no effect on care | Accept with a documented rationale, or monitor at the next review |
The proposed Security Rule update. HHS published a proposed overhaul of the Security Rule in the Federal Register on 6 January 2025. As of September 2026 it is still a proposal: OCR has not issued a final rule, and the content and timing could change. As drafted, it would require a written risk analysis reviewed at least every 12 months, a technology asset inventory and network map on the same cycle, and would remove the distinction between required and addressable specifications. Phases 1, 3 and 7 of this template already produce those documents, so an organisation using it would have little to change if the rule is finalised as proposed.
A recurring schedule opens the assessment on the same date each year and assigns Phase 1 to the assessment lead. If a trigger event happens mid-year, such as a new EHR or a merger, you start an extra run from the same template.
Answer “yes” to the High-risk question in Phase 4 and the remediation phase appears, with its own owners and due dates. The risk management plan becomes a set of tracked tasks rather than a table in a report nobody reopens.
Scan reports, the inventory, the register and the signed report are attached to the tasks they support, each with a name and a timestamp. When OCR asks for your risk analysis history, you export past years’ completed checklists instead of searching shared drives.
CheckFlow does not scan your network or replace the HHS SRA Tool. It runs the human side of the assessment around them: who does what, by when, with what evidence, and who signed it off. CheckFlow’s healthcare checklist software shows how the same approach handles credentialing, incident reporting and the rest of a practice’s compliance calendar.
The risk analysis is one requirement among many. For the full picture of the Privacy, Security and Breach Notification Rules, read our HIPAA compliance checklist guide, then use the HIPAA Compliance Audit Checklist to test the whole programme once the risk analysis is done.
It is the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A) of the HIPAA Security Rule: an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of all the ePHI an organisation holds. In practice it means listing every system and vendor that touches ePHI, identifying what could go wrong with each, rating how likely and how damaging each risk is, and recording the result in a risk register. The companion requirement in 164.308(a)(1)(ii)(B) is to manage those risks down to a reasonable and appropriate level.
The current rule does not set a fixed interval. It requires the analysis to be kept current and documentation to be reviewed periodically and updated when environmental or operational changes affect the security of ePHI. Most organisations, and most auditors, treat once a year as the baseline, with an extra update after a major change such as a new EHR, a new location or a merger. HHS’s proposed Security Rule update would make a 12-month review explicit, but as of September 2026 it has not been finalised.
A risk assessment asks what could happen to your ePHI and how serious it would be. A compliance audit asks whether your policies and practices meet each HIPAA standard. The risk assessment comes first, because many Security Rule decisions, especially on addressable specifications, are meant to be based on it. Use this template for the risk analysis and the HIPAA Compliance Audit Checklist for the programme-wide audit.
Yes. The Security Risk Assessment Tool from ONC and OCR is free, and version 3.7, released in September 2026, is designed for small and medium-sized providers. It guides you through the questions and produces a report. This checklist runs the work around it: assigning the inventory, collecting scan results, getting ratings reviewed, tracking remediation and recording sign-off. Attach the SRA Tool report to the Phase 7 report task. HHS notes that using the tool does not by itself guarantee compliance.
Security Rule documentation must be retained for six years from the date it was created or the date it was last in effect, whichever is later, under 45 CFR 164.316(b)(2)(i). Keep each year’s report, the risk register, the risk management plan and the supporting evidence. Older assessments also show OCR that the analysis has been kept current over time, which is often exactly what an investigation asks for.
Yes. Business associates, such as billing companies, IT providers and cloud vendors that handle ePHI, are directly subject to the Security Rule and must carry out their own risk analysis. A covered entity cannot rely on a vendor’s assessment in place of its own, but it should record each business associate in its ePHI inventory and confirm a current business associate agreement is in place.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
