How to Conduct a HIPAA Security Rule Risk Assessment (2025 Guide)

So far in 2025, the healthcare sector has reported over 311 data breaches, affecting more than 23 million individuals. Nearly 80 percent of these incidents were caused by hacking and IT-related attacks, many of them preventable.

There’s a reason the HIPAA Security Rule requires regular risk assessments. Required under §164.308(a)(1), this process identifies vulnerabilities in how organizations store, access, and protect electronic protected health information (ePHI).

The HIPAA Security Rule is not a checkbox. It is the foundation of every effective HIPAA security program.

With stricter safeguards and faster response expectations coming in the 2025 HIPAA Security Rule updates, covered entities and business associates must act now. A documented, repeatable, and regularly reviewed ePHI risk assessment reduces breach exposure, strengthens compliance, and supports long-term security readiness.

This guide explains how to complete a HIPAA Security Rule risk assessment using proven methodologies and the right compliance tools, whether you are building a new program or scaling existing efforts.

What is a HIPAA Security Rule Risk Assessment?

A HIPAA Security Rule risk assessment is a required process to identify and evaluate risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI). It helps organizations understand where their safeguards may fall short, analyze the likelihood and impact of potential threats, and guide mitigation efforts that reduce exposure to breaches and support compliance under §164.308(a)(1).

Using a Risk Assessment Methodology

Risk assessments should follow a proven methodology. The most widely accepted approach is NIST SP 800-30, which guides organizations to:

• Identify threats and vulnerabilities
• Determine the likelihood and impact of each risk
• Score and prioritize risks across systems, business units, and third-party vendors
• Recommend and document appropriate mitigation actions

NIST SP 800-30 provides the how, but it does not prescribe what to assess. To complete the process, organizations must select a controls framework that defines the security requirements they’re measuring against.

Selecting the Right Controls Framework

HIPAA does not mandate a specific controls framework. Instead, it requires a tailored and justifiable approach based on your organization’s size, risk profile, and regulatory exposure.

If you’re starting from scratch:

• NIST SP 800-66r2 is the official implementation guide for the HIPAA Security Rule. It maps HIPAA requirements to actionable safeguards.
• The HIPAA Security Risk Assessment (SRA) Tool, provided by HHS and ONC, offers a free, guided option for small to mid-sized healthcare organizations.

If you’re managing a broader cybersecurity program:

• NIST SP 800-53 provides a comprehensive set of federal controls for complex environments.
• The NIST Cybersecurity Framework (CSF) offers a high-level, risk-aligned structure used across industries.
• HITRUST CSF integrates HIPAA, NIST, ISO, and other standards into a certifiable control set often used in vendor risk programs.

Whichever framework you choose, be sure to crosswalk back to NIST SP 800-66r2 to ensure alignment with HIPAA-specific requirements.

Summary of Common Frameworks

GRC Assessment Platform for HIPAA Security Rule

Keep private health data private

Work together across your organization to comply with the HIPAA Security Rule. Assess and manage information security risk in Isora.

Learn More

What Are the 2025 HIPAA Security Rule Updates?

The 2025 HIPAA Security Rule updates propose a shift from flexible “addressable” safeguards to mandatory, standardized cybersecurity requirements. These changes align with the HHS Cybersecurity Performance Goals and introduce stricter expectations around ePHI system inventory, MFA, patching, and third-party oversight.

Step-by-Step: HIPAA Security Rule Risk Assessment

Step 1: Identify and Scope All ePHI Systems

The foundation of any HIPAA Security Rule risk assessment is a clear understanding of where ePHI lives, moves, and is accessed within your organization.

• Inventory all systems, applications, devices, and third-party services that create, receive, maintain, or transmit ePHI. This includes cloud platforms, on-premise infrastructure, medical devices, mobile apps, and legacy systems.
• Map data flows to document how ePHI moves between departments, systems, and external partners. Don’t overlook shadow IT or unmanaged endpoints.
• Catalog all vendors and business associates involved in handling ePHI, including SaaS tools, billing processors, and IT service providers.

Step 2: Assess Current Controls and Identify Gaps

After defining your ePHI environment, evaluate whether current safeguards meet HIPAA Security Rule requirements. This includes administrative, physical, and technical controls as outlined in 45 CFR §§ 164.308, 164.310, and 164.312.

• Select a control framework—such as NIST SP 800-66r2, HITRUST CSF, or the HIPAA SRA Tool—to evaluate your program against recognized standards.
• Use structured methods like questionnaires, stakeholder interviews, system owner surveys, and documentation reviews to assess control effectiveness.
• Apply a maturity model where possible to evaluate not just whether a control exists, but how well it is documented, implemented, and measured.
• Collect supporting evidence such as policies, configurations, training records, access logs, or screenshots to validate each control.
• Include third-party safeguards by reviewing contracts, certifications, or past vendor assessments.

Step 3: Analyze, Prioritize, and Document Risks

After identifying control gaps and vulnerabilities, translate them into formal risk statements and log them in a centralized risk register.

• Use a risk analysis methodology such as NIST SP 800-30 to evaluate each risk.
• Determine the likelihood of a threat exploiting the vulnerability and the impact on ePHI.
• Score each risk using a standardized model and assign a qualitative level (e.g., high, medium, low).
• Document each risk in a register with affected systems, threat source, control gap, owner, and mitigation plan.
• Prioritize remediation based on risk severity and your organization’s tolerance.

Step 4: Implement and Track Mitigations

Once risks are prioritized, take action to reduce them to acceptable levels. Mitigation efforts should be risk-based, time-bound, and clearly documented.

• Assign mitigation tasks to responsible owners or teams.
• Implement technical, administrative, or physical safeguards depending on the risk—such as MFA, encryption, patching, policy updates, or training.
• Validate that mitigation steps are completed and effective through testing, evidence collection, or review.
• Update the risk register to reflect status changes and completed actions.

Step 5: Validate, Review, and Maintain Documentation

HIPAA risk management is not a one-time exercise. Organizations must review their risk posture regularly and ensure documentation remains accurate, complete, and accessible.

• Validate that implemented safeguards are functioning as intended. Conduct follow-up testing or reviews where needed.
• Review and update your risk assessment at least annually or whenever significant changes occur (e.g., new systems, breaches, vendor onboarding).
• Test your incident response and contingency plans to ensure they meet HIPAA expectations.
• Maintain all risk analysis, mitigation, and training documentation for a minimum of six years.
• Keep records organized and audit-ready with clearly assigned owners, version history, and status updates.

Why Use HIPAA Security Rule Compliance Software?

HIPAA compliance often breaks down in two common ways: teams manage risk assessments and vendor reviews in spreadsheets, or they rely on bloated GRC tools that are too complex to use consistently. In both cases, key safeguards required under 45 CFR Part 164 Subpart C go unmanaged, and compliance becomes reactive.

Most general-purpose GRC platforms aren’t built for the day-to-day work of security and compliance teams. What’s needed is a purpose-built system that supports structured workflows for risk analysis, control evaluation, vendor oversight, and documentation.

HIPAA compliance software designed for security teams helps organizations:

• Build and maintain a structured inventory of systems, vendors, and units in scope for HIPAA compliance
• Deploy and track assessments across those assets and third parties
• Identify, score, and manage risks in a centralized risk register
• Collect and link evidence to controls, systems, and risk records
• Track mitigation and reassessment workflows over time

Why Choose Isora GRC for HIPAA Security Rule Compliance

Isora GRC helps healthcare organizations translate HIPAA Security Rule requirements into structured, repeatable workflows.

Instead of relying on static spreadsheets or complex legacy tools, security teams use Isora to meaningfully engage their organization with risk assessments, inventory management, third-party reviews, and compliance documentation in one centralized system.

Here’s how Isora supports the four core programs needed for HIPAA Security Rule compliance:

Information Security Risk Management Program

Isora enables teams to conduct structured security risk assessments using built-in questionnaires. Assessments can be tailored to HITRUST CSF, NIST CSF, CIS Controls, or used to complete a HIPAA Security Risk Assessment (HIPAA SRA). Findings are scored and published to a collaborative risk register where they can be managed.

Third-Party Security Risk Management

Isora provides a centralized program for vendor risk, including business associate inventory and evidence collection. Teams can send BAAs, deploy frameworks like HECVAT, CAIQ, or SIG, collect responses, and assign risk levels. Results are tied to vendors and retained for annual reviews and audits.

Risk Register

Isora automatically publishes risks identified during assessments to a collaborative risk register. Each risk includes scoring, ownership, status, and remediation plans. The platform supports periodic reevaluation and system change tracking to ensure ongoing compliance and internal accountability.

Asset and Vendor Inventory

Isora consolidates all systems, applications, and vendors interacting with ePHI into one searchable inventory. Metadata fields such as ownership, data classification, and deployment location make it easy to scope HIPAA compliance assessments accurately and maintain readiness for audits and breach investigations.

Most GRC platforms aren’t built for security teams

All-in-one tools try to do everything—except make risk management easy. Isora GRC was built for security teams to run assessments, manage inventories, and track risk across the org with ease. Ready to simplify your workflows?

Learn More

HIPAA Security Rule Risk Assessment FAQs

What is the difference between a HIPAA Security Rule risk assessment and a HIPAA privacy assessment?

A HIPAA Security Rule risk assessment focuses on identifying risks to electronic protected health information (ePHI), addressing how it is stored, accessed, and protected. It deals with technical, physical, and administrative safeguards under 45 CFR Part 164 Subpart C.

A HIPAA privacy assessment, on the other hand, evaluates how protected health information (PHI) is used and disclosed under the Privacy Rule. It addresses policies, procedures, and workforce access related to patient rights, notice of privacy practices, and permissible disclosures.

How often should a HIPAA Security Rule risk assessment be conducted?

HIPAA requires risk assessments to be reviewed and updated regularly. A best practice is at least annually or when systems, vendors, or threats change. The 2025 updates emphasize an ongoing, living process—not a one-time task.

What systems must be included in a HIPAA risk assessment?

Any system that creates, receives, maintains, or transmits ePHI must be assessed. This includes EHRs, cloud platforms, mobile and medical devices, SaaS tools, backups, and third-party services. Shadow IT and legacy systems must also be considered.

How do HIPAA risk assessments apply to third-party vendors and business associates?

Covered entities must evaluate the security of business associates handling ePHI. This involves reviewing risk assessments, certifications, and contracts. The 2025 rule proposes formalizing third-party risk assessments as a requirement.

What evidence supports HIPAA risk assessment findings?

Evidence includes policies, screenshots, audit logs, access records, training documentation, incident response plans, encryption settings, and third-party attestations. Each safeguard should be supported with proof of effectiveness.

What are common HIPAA risk assessment mistakes?

• Treating it as a one-time checklist
• Not documenting scope, ownership, or evidence
• Leaving out ePHI systems or vendors
• Using generic templates not aligned with HIPAA
• Skipping reassessments after changes
• Failing to score or prioritize risks

Which cybersecurity frameworks support HIPAA compliance?

Frameworks like NIST SP 800-66r2, HITRUST CSF, and CIS Controls help organizations assess and implement safeguards for ePHI. They support structured, repeatable compliance processes.

Why is documentation important for HIPAA risk assessments?

Documentation proves compliance under §164.316. HIPAA requires keeping risk assessment records for six years. Clear, complete records show that risks are identified, addressed, and regularly reviewed.