HIPAA Security Risk Assessment — done properly, delivered as a document.
A written HIPAA Security Risk Assessment for small and mid-sized practices. The kind you hand to your cyber insurer, your board, or an OCR examiner without hedging. CISSP-informed methodology, fixed from-price, no retainer.
A defensible risk analysis, not a checklist.
A HIPAA Security Risk Assessment (SRA) is the risk analysis required under the HIPAA Security Rule. It is the document OCR asks for first in almost every breach investigation, the document cyber insurers now require at underwriting, and the document that determines whether a subsequent violation is treated as reasonable diligence or willful neglect.
Practices routinely mistake a self-assessment questionnaire, a vendor's compliance certificate, or an outdated 2018 PDF for an SRA. None of those hold up. A defensible SRA identifies the ePHI you hold, the systems that touch it, the threats to those systems, the safeguards in place, the residual risk, and a plan to address it — all in writing, all current.
That is what this offer delivers. Every engagement runs under CISSP-informed methodology, follows the NIST 800-30 / 800-66 risk analysis pattern that OCR examiners are trained on, and produces a document your compliance owner can actually use.
Five steps, about two to three weeks.
Scoping call
We talk through your practice size, locations, EHR, and vendors, and confirm the fixed price and timeline.
Inventory
You complete a short inventory of the systems, devices, and vendors that touch patient data. We map how that data flows.
Interviews and document review
We speak with your compliance owner and whoever manages IT, and review the policies, vendor agreements, and configuration details you provide.
Analysis
We identify threats and vulnerabilities, evaluate the safeguards in place, and score risk by likelihood and impact.
Delivery and review call
You receive the written assessment and remediation plan, and we walk through it together on a 60-minute call.
A short list, not a project.
- A list of the systems and apps that touch patient data (EHR, billing, email, texting, backups, patient portal)
- A list of your vendors and any Business Associate Agreements you have
- Your existing policies, even if they are outdated
- A contact for whoever manages your devices, network, and accounts
- Any previous risk assessments or security incident records
Price depends on practice size, the number of locations, systems, and vendors, and how much documentation already exists. We confirm a fixed price at the scoping call.
Clear about the limits.
Technical testing is a separate activity. Results from a scan or test can feed into the assessment, but an SRA is an organization-wide risk analysis.
An SRA documents your risks and a plan. It does not guarantee compliance or protect you from penalties. Have counsel review how it applies to you.
The assessment tells you what to fix and in what order. Remediation is separate, and you can do it yourself, with your IT provider, or with us.
The analysis should be reviewed and updated regularly and whenever your environment changes, such as a new system, vendor, location, or AI tool.
Not ready for a full assessment? Check where you stand first.
Our free readiness checker takes about two minutes. You get a score and a plain-English list of the safeguards most likely to be gaps, with no signup.
Deliverables.
Practices where an SRA is overdue.
Solo & small group practices
Under 25 staff, no dedicated compliance officer, and the last SRA (if any) was performed years ago.
Medspas & aesthetics practices
Practices that have added AI tooling, patient portals, or new payment processors and don't know if the risk register kept up.
Dental, therapy & specialty practices
Any practice that bills insurance electronically is likely a covered entity with the same Security Rule duty, whatever its size.
Billing companies & other business associates
Vendors that handle patient data for covered entities have their own Security Rule obligations and are increasingly asked for proof.
Growing practices adding AI
Anyone introducing automation, AI scribes, chatbots, or new SaaS to a PHI environment. The SRA should precede the deployment, not follow the incident.
Common questions.
Is a HIPAA Security Risk Assessment actually required?
Yes. Under 45 CFR § 164.308(a)(1)(ii)(A), every HIPAA-covered entity and business associate is required to conduct an accurate and thorough risk analysis. It's also a prerequisite for most cyber insurance policies, a condition of many Meaningful Use / Promoting Interoperability attestations, and one of the first documents OCR requests during any breach investigation.
How often do we need to redo it?
The regulation says "periodic" — the practical answer is annually, and any time there's a material change: new EHR, new location, new AI or automation tool, a merger, or a security incident. An SRA that's three years old is functionally not an SRA.
Isn't there a free tool from HHS?
Yes, and it's useful. It's also a self-assessment questionnaire, not a risk analysis. It doesn't produce a defensible written document, doesn't inventory your actual systems, doesn't review your BAAs, and doesn't score threats. If you have the time and expertise to run one properly, use it. If you don't, that's what this offer is for.
Do you also fix the gaps?
Optionally. The SRA is a document — it stands on its own and is yours regardless. If the gaps involve automation, integration, or infrastructure we build, we can scope remediation separately. If they involve policies, training, or vendor changes, we'll point you to the right specialist. No lock-in.
How is this different from a vulnerability scan or penetration test?
A scan is an automated technical check for known weaknesses, and a penetration test is a simulated attack. Both are useful evidence, but neither is a risk analysis. An SRA covers people, processes, and technology across your whole organization and produces a prioritized plan. Our guide to the SRA explains the differences in more detail.
Will this satisfy my cyber insurer?
Insurers commonly ask for a recent risk assessment, but requirements differ by carrier, and we cannot guarantee that any particular insurer will accept it. Share your insurer's questionnaire with us at the scoping call so we can cover what they ask for.
Do you need access to patient records?
No. An SRA works from your systems, vendors, and policies, not from patient charts. Please do not send us patient information.
Does HIPAA apply to my practice?
HIPAA applies to covered entities, such as providers that conduct standard electronic transactions like billing insurance, and to their business associates. Many cash-pay practices are not covered entities, though state laws and the FTC Act may still apply. Ask your attorney if you are unsure, and note that many practices follow HIPAA-level safeguards anyway.
What happens after we receive the assessment?
You get a prioritized remediation plan with rough effort estimates. You work through it on your own timeline, and we can help with any items involving automation or infrastructure. Plan to revisit the assessment at least annually and after significant changes.
Request the SRA.
Tell us about your practice size, EHR, and any recent changes. We respond within one business day with a scoped price and kickoff date.