How to Do a HIPAA Risk Assessment for Small Medical Practices

Why risk assessments are the first thing OCR looks for

When the Office for Civil Rights audits a medical practice, the risk assessment is often the first document they request. It’s also the most commonly missing one.

This matters for a specific reason: the risk assessment is the foundation of your compliance program. HIPAA Security Rule §164.308(a)(1) requires every covered entity to conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. Without it, every other compliance step you take is built on an undocumented assumption about what your actual risks are.

OCR enforcement actions against small practices consistently cite the absence of a documented risk assessment as a primary violation. Fines start at $100 per violation and can reach $1.5 million annually per violation category.

Step 1: Identify where your practice handles ePHI

Start with a list. Every system, device, and physical location where your practice creates, receives, stores, or transmits electronic protected health information goes on it.

For most small practices, this includes: the EHR system, the scheduling platform, the billing software, email, any task management or care coordination tool, cloud file storage, workstations in exam rooms and the front desk, any staff laptops, personal smartphones used for work, tablets, and fax machines with memory.

The list is usually longer than people expect. That’s fine. A comprehensive list is the point.

Step 2: Identify threats and vulnerabilities for each

For every ePHI location, identify what could go wrong. Realistic threats for a small clinic:

• Ransomware attack on an unpatched workstation
• Staff member clicking a phishing link
• Laptop stolen from a car or home office
• Cloud storage provider experiencing a breach
• Former employee retaining access after termination
• Paper records left in an unsecured area

For each threat, identify the vulnerabilities that make it possible: weak or shared passwords, no multi-factor authentication, devices without disk encryption, outdated operating systems, no formal offboarding process.

You don’t need a security background to do this step. You need to look honestly at how your practice actually operates.

Step 3: Evaluate what safeguards you already have

For each threat-vulnerability pair, document what your practice currently does to mitigate it. Encryption on laptops? Multi-factor authentication on the EHR login? Regular backups? Termination checklist that includes revoking system access?

Rate how effective each safeguard is. A password policy that exists on paper but isn’t enforced is a different rating than one with technical controls that require complexity and rotation.

Step 4: Assign risk levels

Rate each identified risk high, medium, or low. Use two factors: likelihood (how probable is this threat given your current vulnerabilities) and impact (what happens if it occurs: data volume exposed, financial consequences, operational disruption).

High-likelihood, high-impact risks need remediation plans before your next quarterly review. Low-likelihood, low-impact risks can go on a longer-term roadmap.

HHS’s free Security Risk Assessment tool walks through this rating process with structured questions.

Step 5: Write a remediation plan

For every high and medium risk, document three things: what you’ll do to address it, who is responsible, and by when.

Keep this practical. “Enable full-disk encryption on all staff laptops” is a remediation action. “Implement a comprehensive endpoint security strategy” is not. It’s vague enough to remain undone indefinitely.

PHIGuard’s compliance dashboard lets you assign remediation tasks to staff members and track completion. A spreadsheet works too, as long as someone is actually updating it.

Step 6: Document and retain

Store the completed risk assessment (your ePHI inventory, threat and vulnerability analysis, risk ratings, current safeguards, and remediation plan) in your compliance files.

HIPAA requires retaining compliance records for six years. File your risk assessments by date. When OCR asks for your most recent assessment, you need to be able to produce it in minutes, not hours.

Update the assessment annually. Also update it when significant changes happen: a new EHR, an office relocation, adding a new cloud service that handles PHI, or a security incident that reveals a vulnerability you hadn’t documented.

Annual updates don’t require starting from scratch. If you keep the base assessment maintained, an update takes 2-3 hours, mostly reviewing whether anything changed since last year.