HIPAA risk analysis is required, documented and ongoing: include every system that touches e-PHI

HHS guidance says the HIPAA Security Rule’s risk analysis is a required, foundational step that must cover all e-PHI in every electronic medium, document threats, vulnerabilities, likelihood, impact and risk levels, and be repeated as technology, staff, ownership or incidents change.

Source facts

HHS’s risk analysis guidance quotes the required implementation specification: conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of e-PHI. Its scope is all e-PHI an organization creates, receives, maintains or transmits, regardless of the electronic medium, from a single workstation to networks spanning multiple locations.

Organizations must identify and document where e-PHI is stored, received, maintained or transmitted, and identify and document reasonably anticipated threats and vulnerabilities. The guidance also calls for assessing current security measures, likelihood and impact, assigning risk levels, and documenting corrective actions; the Security Rule requires documentation but no specific format.

An addressable implementation specification is not optional: an organization that finds it unreasonable must document why and adopt an equivalent measure if appropriate. The guidance says risk analysis should be ongoing and that the Rule does not specify how often; it lists triggers such as a security incident, a change in ownership, turnover in key staff, or new technology. ONC and OCR offer an SRA Tool for small and medium-sized practices.

Applicability

Use this for any covered entity or business associate. The guidance clarifies HHS expectations without prescribing a single method; state health privacy laws may add requirements.

DSE recommendation

DSE recommends keeping a written HIPAA risk analysis that inventories every system holding e-PHI and is updated whenever technology or operations change. Include cloud services, backups, mobile devices, remote-support tools and the vendors who access them, and consider whether video, intercom or access logs in clinical areas capture patient information. Record decisions on addressable specifications, such as encryption, with the reasoning and any equivalent measure.

Verification

Compare the e-PHI inventory with the IT asset list and vendor contracts each year, confirm each identified risk has an owner and corrective action date, and re-run the analysis within a set period after any incident, acquisition, key staff change or major system introduction.

Official reference

U.S. Department of Health and Human Services, Office for Civil Rights — Guidance on Risk Analysis. Reviewed October 18, 2026.