HIPAA Risk Analysis: Requirements, Steps, and Compliance Checklist

What Is HIPAA Compliance and Who Must Follow It?

HIPAA compliance means meeting the requirements of the Privacy, Security, and Breach Notification Rules to protect protected health information (PHI). It applies to covered entities, which include health plans, healthcare clearinghouses, and providers that conduct standard electronic transactions, and to the business associates that handle PHI on their behalf.

Our guide to covered entities and business associates explains how responsibilities divide.

What Are the Main HIPAA Rules?

The four main rules are the Privacy Rule, Security Rule, Breach Notification Rule, and Enforcement Rule. Each addresses a different part of the compliance lifecycle.

Rule	What It Covers
Privacy Rule	How PHI may be used and disclosed, and the rights individuals have over their information
Security Rule	Administrative, physical, and technical safeguards for electronic PHI (ePHI)
Breach Notification Rule	Notice to affected individuals without unreasonable delay and within 60 days of discovery, with HHS and media notice for larger breaches and notice from business associates to covered entities
Enforcement Rule	Investigations, penalties, and resolution agreements, with penalty tiers based on culpability

The HITECH Act strengthened breach reporting and extended direct liability to business associates, as discussed in our article on HIPAA and the HITECH connection.

What Does the HIPAA Security Rule Require?

The Security Rule requires covered entities and business associates to protect the confidentiality, integrity, and availability of electronic protected health information through administrative, physical, and technical safeguards. The rule is scalable, so the measures should fit the size, complexity, and risks of the organization. Some specifications are required and others are addressable, which means they must be implemented or replaced with a documented, reasonable alternative.

Administrative safeguards: Security management process, assigned security responsibility, workforce security, information access management, training, incident procedures, contingency planning, periodic evaluation, and business associate contracts.
Physical safeguards: Facility access controls, workstation use and security, and device and media controls.
Technical safeguards: Access control, audit controls, integrity controls, person or entity authentication, and transmission security.

The security management process is where risk analysis and risk management sit, and OCR treats them as the foundation for every other safeguard.

What Is a HIPAA Risk Analysis and How Should Organizations Perform One?

A HIPAA risk analysis is an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI, required under 45 CFR 164.308(a)(1)(ii)(A). OCR guidance states that no single method guarantees compliance, and it points to NIST resources as useful references. It also does not prescribe a fixed frequency, so organizations should repeat the analysis when circumstances change and at intervals that match their risk. A practical process follows OCR’s elements:

Define scope to include ePHI in every form and location, including cloud services, mobile devices, medical devices, and systems run by business associates.
Collect data on where ePHI is created, received, maintained, and transmitted, using interviews, documentation review, and technical discovery.
Identify reasonably anticipated threats and vulnerabilities, such as ransomware, credential abuse, misconfiguration, and unsupported devices.
Assess current security measures and confirm they are configured and operating as intended.
Determine the likelihood that each threat will exploit each vulnerability.
Determine the impact if it does, using qualitative, quantitative, or combined methods.
Assign a risk level based on likelihood and impact.
Document the results and the decisions that follow.

How Is Risk Analysis Different From Risk Management?

Risk analysis finds and rates the risks, while risk management implements measures to reduce them to a reasonable and appropriate level. A gap analysis against the rule text is not a substitute for either one. Secondary reports on OCR enforcement indicate that regulators now look for evidence that identified risks were acted upon, so a risk register with no remediation record is a weak position.

What Evidence Do Auditors and OCR Expect to See?

Reviewers expect proof that the risk analysis is current, complete, and linked to action. Keep these items ready:

An ePHI inventory covering systems, locations, and data flows
A documented risk analysis with threats, vulnerabilities, likelihood, impact, and risk ratings
A risk management plan with owners, deadlines, and completion records
Business associate agreements and records of vendor risk review
Training records, access review logs, and audit log reviews
Incident response and contingency plans with test results

Is the HIPAA Security Rule Being Updated?

Yes, but the final rule is not in effect. OCR proposed a major update, published in the Federal Register on January 6, 2025, and the OMB regulatory agenda now lists the final rule for July 2027, later than the original May 2026 target. The proposal drew nearly 5,000 comments, and some hospital groups opposed it on cost and timeline grounds. Until a final rule issues, the current Security Rule remains the legal standard.

The proposal signals where expectations are heading. It includes encryption of ePHI, multifactor authentication, network segmentation, annual penetration testing, more detailed risk analyses, written incident response plans tested annually, and verification of business associate safeguards. Organizations that adopt these practices now reduce risk today and avoid a compressed project later. Final requirements may change, so treat them as planning inputs, not obligations.

Where Do Healthcare Organizations Commonly Fall Short?

Most gaps appear where documentation and daily operations diverge. Common examples include:

Narrow risk analyses: The analysis covers on-premises systems but misses cloud services, APIs, and vendor-managed environments where PHI now flows.
Contract-only vendor oversight: A signed business associate agreement exists, but no one validates how the vendor accesses, stores, and monitors PHI.
Access drift: Former employees and service accounts keep access, and exceptions to multifactor authentication become routine.
Unwatched logs: Audit controls are enabled, yet alerts are not triaged or escalated.
Legacy devices: Medical devices run unsupported software under documented exceptions that record the risk but do not reduce it.

Each of these appears in compliant organizations that later suffer breaches, so treat HIPAA as a baseline, not a measure of resilience.

What Should Healthcare Organizations Do Next?

Update the risk analysis if it is more than a year old or predates major system changes, then close the highest-rated risks and document the work. A focused sequence works well:

Refresh the ePHI inventory, including cloud, mobile, and vendor systems.
Perform or update the risk analysis and rank findings by likelihood and impact.
Build a risk management plan with named owners and dates.
Prioritize multifactor authentication, encryption, segmentation, and logging, since the proposed rule points toward them.
Review business associate risk beyond the contract, starting with vendors that hold the most PHI.
Test incident response and recovery and record the results.

Ampcus Cyber supports healthcare organizations through HIPAA compliance services, including risk analysis, gap assessment, remediation planning, and audit readiness.

Conclusion

HIPAA compliance rests on a documented, current risk analysis and a record of acting on it. The Security Rule overhaul is delayed, yet OCR enforcement and the direction of the proposal both point toward stronger, evidence-based controls. Healthcare leaders who refresh their risk analysis, verify business associate safeguards, and prepare for the proposed requirements will be better placed under either the current rule or its replacement.

Find out whether your HIPAA risk analysis would hold up in an OCR review.

Speak with Ampcus Cyber’s specialists to review your ePHI inventory, risk analysis, and remediation records, and leave with a prioritized action plan.