What Is a HIPAA Security Risk Analysis?

A security risk analysis is a required Security Rule implementation specification. Covered entities and business associates must conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI they hold. Risk analysis identifies and assesses risks; the separate risk-management implementation specification requires measures reducing those risks to a reasonable and appropriate level.

Rule. The risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and risk management (164.308(a)(1)(ii)(B)) specifications are part of the security management process standard, the first administrative safeguard.

Scope. HHS guidance explains that the analysis should cover all ePHI the organization creates, receives, maintains, or transmits, regardless of the media, and should identify threats and vulnerabilities, assess current security measures, determine the likelihood and potential impact of threats, assign risk levels, and be documented.

Not one-time. The Security Rule requires covered entities and business associates to review and modify security measures as needed (164.306(e)), and HHS guidance describes risk analysis as an ongoing process. The rule does not set a specific frequency.

Tools. HHS, through ONC and OCR, offers a downloadable Security Risk Assessment Tool for small and medium-sized providers. HealthIT.gov states that use of the tool is neither required by nor guarantees compliance with federal, state or local laws.

Enforcement. OCR enforces this requirement through its Risk Analysis Initiative, which was "created to focus select investigations on compliance with the HIPAA Security Rule Risk Analysis provision." A March 21, 2025 HHS release described the Health Fitness Corporation settlement as the initiative's fifth enforcement action.

Proposed changes (status as of November 7, 2026). HHS published a Security Rule proposed rule on January 6, 2025 (90 FR 898). As of November 7, 2026, it remains a proposal: the current eCFR 164.308 is unchanged, and the Unified Agenda lists RIN 0945-AA22 as a long-term action with a projected final action date of July 2027, a projection rather than an effective date. The proposal does not itself impose new current obligations; existing Security Rule requirements remain applicable.

Note. Learn Laws® is a training company, not a law firm. This FAQ summarizes federal rules for general information and is not legal advice. HHS and OCR do not endorse any private consultants' or education providers' seminars, materials or systems, and do not certify any persons or products as "HIPAA compliant."