{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
        "slug": "hipaa-security-rule-risk-analysis-required-elements-ongoing-updates",
        "url": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/"
        },
        "title": "HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI",
        "summary": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "important",
            "name": "Important"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-18T21:01:03+00:00",
        "modified_at": "2026-10-18T22:22:08+00:00",
        "reviewed_on": "2026-10-18",
        "reading_minutes": 2,
        "word_count": 380,
        "potentially_affected": "HIPAA covered entities and business associates, including clinics, dental and specialty practices, and the IT, security and integrator vendors that create, receive, maintain or transmit e-PHI for them.",
        "dse_recommendation": "DSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change.",
        "primary_source": {
            "name": "U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis",
            "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html",
            "published_on": null,
            "authority": "www.hhs.gov"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.</p>\n<h2>Source facts</h2>\n<p>HHS’s <a href=\"https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html\">risk analysis guidance</a> quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations.</p>\n<p>Organizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format.</p>\n<p>An addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices.</p>\n<h2>Applicability</h2>\n<p>Use this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure.</p>\n<h2>Verification</h2>\n<p>Compare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html\">U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis</a>. Reviewed October 18, 2026.</p>",
        "content_text": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.\nSource facts\nHHS’s risk analysis guidance quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations.\nOrganizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format.\nAn addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices.\nApplicability\nUse this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements.\nDSE recommendation\nDSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure.\nVerification\nCompare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction.\nOfficial reference\nU.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis. Reviewed October 18, 2026.",
        "content_markdown": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.\n\n## Source facts\n\nHHS’s [risk analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations.\n\nOrganizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format.\n\nAn addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices.\n\n## Applicability\n\nUse this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements.\n\n## DSE recommendation\n\nDSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure.\n\n## Verification\n\nCompare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction.\n\n## Official reference\n\n[U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html). Reviewed October 18, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
                "url": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-18"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI",
                        "item": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/#article",
                "identifier": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
                "url": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/",
                "headline": "HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI",
                "description": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium…",
                "abstract": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.",
                "articleBody": "HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.\nSource facts\nHHS’s risk analysis guidance quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations.\nOrganizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format.\nAn addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices.\nApplicability\nUse this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements.\nDSE recommendation\nDSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure.\nVerification\nCompare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction.\nOfficial reference\nU.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis. Reviewed October 18, 2026.",
                "datePublished": "2026-10-18T21:01:03+00:00",
                "dateModified": "2026-10-18T22:22:08+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "Guide",
                    "Important priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    }
                ],
                "wordCount": 380,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis",
                    "url": "https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html"
                }
            }
        ]
    }
}