Of all the obligations in the HIPAA Security Rule, the risk analysis is the one most often completed badly. It is also the one regulators ask about first after an incident.
The requirement itself is not ambiguous. HHS guidance is explicit that covered entities and their business associates must conduct a risk assessment of their organization, and that effective risk management is a foundational component of Security Rule compliance rather than an optional exercise.
What varies enormously is what practices actually do to satisfy it.
Where a HIPAA Security Risk Assessment Goes Wrong
Three failure patterns account for most of it.
The first is treating the assessment as a one-time event. A risk analysis completed when a practice adopted its current EHR does not describe the environment today, after new devices, new cloud services, and staff turnover.
The second is scope. Many assessments cover the EHR thoroughly and stop there. Protected health information also moves through email, scanning and imaging systems, backup copies, mobile devices, third-party billing platforms, and vendor connections. An assessment that examines one system while ignoring the rest documents a narrow slice of the actual risk.
The third is confusing a questionnaire with an assessment. HHS and ONC publish a free Security Risk Assessment Tool, and it is genuinely useful. The guidance accompanying it is also candid: the target audience is medium and small providers, and use of the tool may not be appropriate for larger organizations. A self-completed questionnaire records what staff believe to be true. It does not verify configuration, test a restore, or confirm that a control covers every system it should.
See also: How Implementing Life Care Planning Services Enhances Patient Outcomes
The Gaps That Recur in Healthcare Cybersecurity
Certain findings appear repeatedly across healthcare cybersecurity reviews, and none of them are exotic.
- Multifactor authentication enabled on email but not on the practice management system, remote access, or administrative accounts.
- Standing administrative rights on workstations, with no periodic review of who holds them.
- Unencrypted laptops and mobile devices holding or reaching protected health information.
- Cloud platforms such as Microsoft 365 with no independent backup, on the assumption the vendor provides one.
- Backups that run reliably but have never been restore-tested.
- Security awareness training delivered once at onboarding and not repeated.
- Business associate relationships with no documented review of the vendor’s own safeguards.
The pattern is consistent. Controls exist, but coverage is partial, and partial coverage is what an attacker needs.
Why the Sector Remains a Target
Healthcare sits among the sixteen critical infrastructure sectors tracked in the FBI’s 2025 Internet Crime Report, which recorded 655 incidents reported by organizations across those sectors, involving more than $261 million in reported losses.
The economics explain the persistence. Clinical operations cannot pause while systems are rebuilt, which raises the pressure to pay quickly. Patient records also retain value long after payment card data has been cancelled.
Verizon’s 2026 Data Breach Investigations Report adds a relevant warning for a sector that relies heavily on external platforms: third parties were involved in 48 percent of breaches. For most practices, the vendor ecosystem is now part of the attack surface.
What a Serious Review Looks Like
A credible HIPAA security risk assessment covers identity and access, email security, endpoint security, network security, monitoring and response, patch management, backup and recovery, and documentation, training and governance. It scores honestly, distinguishing complete coverage from partial coverage, and produces a remediation plan ordered by risk.
It should also be repeatable, so next year’s review measures progress rather than starting over. A risk analysis that produces a different structure each year cannot show whether a practice is improving.
Documentation matters as much as the findings. In the event of an OCR inquiry following a breach, a practice is asked to produce evidence that a risk analysis was conducted, that identified risks were addressed, and that decisions were reasoned. A completed assessment with a dated remediation plan and a record of what was fixed is considerably stronger than an assertion that the practice takes security seriously.
For practices without internal security staff, this is the strongest argument for outside support. The obligation is annual and ongoing, and it does not lighten as the practice grows.
FAQs: HIPAA Security Risk Assessment
How often is a HIPAA security risk assessment required?
HHS treats risk analysis as an ongoing obligation rather than a single event. Practices should review at least annually and after any significant change to systems, vendors, or facilities.
Is the free HHS tool sufficient?
It is a reasonable starting point and HHS notes it is aimed at medium and small providers. It records self-reported answers, so it does not replace verification of configuration, coverage, and recoverability.
What is the most common healthcare cybersecurity gap?
Multifactor authentication that stops at email, leaving practice management systems, remote access, and administrative accounts protected by passwords alone.
Confirm your risk analysis reflects reality rather than assumption. Contact Xobee Networks to speak with a Solutions Specialist about a healthcare security risk assessment. With 30 years of proven results, Xobee Networks delivers enterprise-grade managed security offerings for healthcare organizations and regulated industries.