How to Perform a Healthcare Security Risk Assessment

A healthcare security risk assessment is a documented review of where patient data lives and what could put it at risk. The goal is to find the gaps before someone else does.

We help healthcare practices across Northeast Ohio work through this every year, and in my experience most start with good intentions and no plan. Here is the plan.

What to gather first

Before you start, pull these together:

• A current list of every system that touches patient data.
• Your HIPAA Privacy and Security policies.
• Network diagrams, even rough ones.
• Vendor contracts and business associate agreements.
• Login records for your EHR and email.
• One named person to own the project.

The HHS Security Risk Assessment Tool walks small practices through each step. It's free, and it's built for teams that don't have a security officer. One thing to be clear about before you start: a risk assessment is a document you keep and revisit as your systems change.

Define the scope

Scope decides what you're protecting and what you're leaving out. Get this wrong and every later step drifts with it.

Write down four boundaries:

• Which locations are in scope, one office or several.
• Which systems: the EHR, billing, email, phones, imaging, and backup drives.
• Which people: staff, contractors, remote workers, and outside vendors.
• Which data: records, claims, payment details, and scheduling notes.

I'd keep the scope to one page and have your practice administrator sign it. For a small practice, the scope is usually tighter than people expect. A 15-person office often runs one EHR and a shared file server, which is manageable. The risk comes from the tools nobody listed, like a personal phone syncing work email.

I'd ask every employee to write down each device and app they use for work, including personal phones and home laptops. In my experience, the systems people forget are the ones that cause breaches.

Inventory your systems and data flows

An inventory lists every asset and traces where the data moves. You can't protect what you haven't counted, so I'd build the inventory in four buckets:

1. Hardware: servers, workstations, laptops, tablets, printers, and routers, usually owned by your IT lead or vendor.
2. Software: the EHR, billing, scheduling, email, antivirus, and backup tools, owned by your practice administrator.
3. Data: patient records, claims, payment data, and staff files, owned by whoever acts as your compliance officer.
4. People: who touches each system and how, which your office manager usually knows best.

Then map the flow. Patient data enters at the front desk, moves into the EHR, goes to billing, and lands in a backup, and each handoff is a place where it can leak. Most small practices find 20 to 40 assets once they look properly, more than most owners expect, and it still surprises me how much hides in a small office.

Identify threats and vulnerabilities

A threat is something that can cause harm. A vulnerability is the weakness that lets it happen.

The threats I see most at small practices:

• Ransomware locking up the EHR.
• Phishing emails that steal login details.
• Lost or stolen laptops and phones.
• Staff sharing passwords.
• Vendors with weak security of their own.
• Power outages and failed backups.

The weaknesses that let them in:

• No multi-factor authentication.
• Unpatched software.
• Shared logins with no audit trail.
• No written security training.
• Backups stored on the same network as everything else.

Pair each threat with the weakness it exploits, because that pairing is what you score in the next step. Skipping the threat list and jumping straight to buying fixes is the most common mistake I see, and it leaves you with tools that don't address your actual risks.

Score the risks and assign owners

Scoring tells you what to fix first. Without it, every problem looks urgent and nothing gets done. I'd rate each risk on likelihood and impact, each from 1 to 5, then multiply the two numbers. Anything that scores 15 or higher gets fixed this quarter.

Here is how that looks in practice:

• Phishing that steals an EHR login: likelihood 5, impact 5, a score of 25, owned by your IT lead.
• A lost laptop holding patient data: likelihood 4, impact 4, a score of 16, owned by your office manager.
• A backup that fails during an outage: likelihood 3, impact 5, a score of 15, owned by your IT vendor.
• A shared front desk password: likelihood 4, impact 3, a score of 12, owned by your practice administrator.

Every risk needs one named owner, a person and not a department. This is where most assessments stall. A list of risks with no owner sits in a folder and never moves, so assign the name and a date, and check it monthly.

Document the findings

A HIPAA risk assessment template turns your notes into evidence. Auditors and insurers want to see the process as well as the result.

Your documentation should include the scope statement and its date, the full asset inventory, the threat and vulnerability list, the risk scores with their owners, the remediation plan with deadlines, and a sign-off from leadership. The HHS guidance on risk analysis is clear that the analysis has to be written down and reviewed, so a verbal walkthrough doesn't count. I've seen practices lose credit for work they actually did because it only lived in someone's head.

I tell clients to keep the finished document somewhere they can reach it fast. When a payer or an auditor asks, you want it in minutes.

Build the remediation plan

A remediation plan lists each fix with its owner and due date. Pair it with the habits I lean on to prevent most of these problems in the first place:

• Turn on multi-factor authentication everywhere it is offered.
• Patch your systems on a set monthly schedule.
• Train staff on phishing every quarter.
• Test your backups by actually restoring a file.
• Limit each person's access to what their role needs.
• Review your vendor agreements once a year.

Set deadlines that match your risk scores. High scores get fixed first, and lower ones can wait a quarter, but they still need a date on them. Revisit the plan every 90 days, because new devices and new staff create new risks. For most practices around Northeast Ohio, a local IT partner can run the technical pieces while your team handles policy and training, and that split keeps the work moving.

A HIPAA checklist for small practices

This is the yearly version, the one I'd keep on a calendar:

• Name a security officer.
• Complete a written risk assessment.
• Inventory every device and system.
• Enable multi-factor authentication.
• Patch systems monthly.
• Train staff on phishing quarterly.
• Test backups by restoring files.
• Sign business associate agreements with every vendor.
• Review access rights twice a year.
• Document everything with dates.

If you would rather not run this alone, we handle the technical side for practices across Northeast Ohio, with continuous monitoring and HIPAA documentation that's ready when someone asks for it. The same people learn your systems, so nobody reads your account cold.

Common questions

What are the steps of a healthcare security risk assessment?

It runs in six steps: define the scope, inventory your systems and data flows, identify threats and vulnerabilities, score each risk by likelihood and impact, document your findings against a HIPAA template, and build a remediation plan with owners and deadlines. Underneath all of it are four plain actions. Know what you have, know what threatens it, rank the risks, and write down how you'll fix them. Skip a step and you leave a gap in your HIPAA documentation, which matters if the Office for Civil Rights ever reviews your practice.

Is a security risk assessment required by HIPAA?

Yes. The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. It's required, and it isn't a one-time task. You have to be able to show your work if the HHS Office for Civil Rights asks for documentation.

How often should a practice do one?

Run a full assessment every year, and update it whenever something material changes, such as new software, a new location, new staff, or a breach. Smaller clinics usually treat it as a yearly exercise tied to their HIPAA checklist. If you add an EHR module or move to a new office, revisit the assessment before that change goes live.

What tools can I use?

The free HHS Security Risk Assessment Tool works for many practices, and a spreadsheet template works too. The tool matters less than the process: scope, inventory, threats, scoring, and a written remediation plan. Many practices hand this to a partner so the documentation stays ready for an auditor.

Managing HIPAA security on your own is a lot to carry while you're also running a practice. We watch your systems for problems and keep your HIPAA documentation ready for the day someone asks. Schedule a free consultation with our Northeast Ohio team and we'll map out your next risk assessment together.