# HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI > HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change. - Canonical URL: https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:01:03+00:00 - Modified: 2026-10-18T22:22:08+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Guide - DSE priority: Important - Topics: Business Continuity, Cybersecurity - Reading time: 2 minutes ## What you need to know HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change. ## Potentially affected HIPAA covered entities and business associates, including clinics, dental and specialty practices, and the IT, security and integrator vendors that create, receive, maintain or transmit e-PHI for them. ## DSE recommendation DSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. ## Article HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change. ## Source facts HHS’s [risk analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations. Organizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format. An addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices. ## Applicability Use this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements. ## DSE recommendation DSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure. ## Verification Compare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction. ## Official reference [U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html). Reviewed October 18, 2026. ## Primary reference - Name: U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis - Authority: www.hhs.gov - URL: https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI,” DSE Security, https://update.dsesecurity.com/updates/hipaa-security-rule-risk-analysis-required-elements-ongoing-updates/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.