Is your HIPAA compliance documented or just assumed? A Security Risk Analysis you can verify on demand separates regulatory readiness from regulatory exposure. This template gives you the structure the HIPAA Security Rule requires, built around the questions that matter during an investigation.
Purpose of This Template
This template helps you create the documented Security Risk Analysis that the HIPAA Security Rule mandates as the foundation of your compliance program. It's not a checklist to complete once and file away. It's a living record that connects your practice's actual systems, locations, and workflows to the administrative, physical, and technical safeguards you've implemented. When a regulator asks how you identified risks to electronic protected health information, you'll point to this analysis. When you update a policy or add a new system, you'll update this document to reflect the change.
The template addresses all three HIPAA rules in a coordinated way: the HIPAA Security Rule's safeguard requirements, the HIPAA Privacy Rule's use and disclosure controls, and the HIPAA Breach Notification Rule's incident response obligations. You can't meet one rule in isolation and claim compliance. This template ensures your analysis covers all three.
Prerequisites
Before you customize this template, gather:
- Current system inventory: Every electronic system that stores, transmits, or processes protected health information, including practice management software, electronic health records, email, billing systems, and backup solutions.
- Physical location details: Each office, storage area, server room, and workstation where protected health information exists in any form.
- Workforce roles: Who has access to what systems, and what their job functions require.
- Existing policies: Whatever documentation you currently have, even if it's outdated or incomplete. You'll identify gaps against this baseline.
- Vendor agreements: Business Associate Agreements and service contracts for any third party that handles protected health information on your behalf.
If you can't produce one of these items immediately, that's your first finding. Document the gap and set a deadline to close it.
The Template
Section 1: Scope Definition
Practice locations assessed: [List each physical address where protected health information is created, received, maintained, or transmitted]
Systems in scope: [List each electronic system by name, vendor, version, and function]
Assessment date: [Current date]
Next scheduled review: [Date no more than 12 months from assessment date]
Responsible party: [Name and title of person accountable for maintaining this analysis]
Section 2: Asset Inventory and Classification
For each system identified in scope:
| System Name | Function | Data Types Stored | Access Controls in Place | Encryption Status | Backup Frequency |
|---|---|---|---|---|---|
| [Example: Practice Management System] | [Scheduling, billing] | [Demographics, insurance, payment] | [Role-Based Access Control, password policy] | [At rest: AES-256, In transit: TLS 1.2+] | [Daily incremental, weekly full] |
Section 3: Threat and Vulnerability Assessment
For each asset, identify:
Potential threats: [Unauthorized access, malware, ransomware, insider misuse, physical theft, natural disaster, system failure]
Current vulnerabilities: [Outdated software versions, weak passwords, unpatched systems, unsecured mobile devices, lack of multi-factor authentication, inadequate physical access controls]
Likelihood: [Rate as Low/Medium/High based on your environment, not industry averages]
Impact if exploited: [Rate as Low/Medium/High based on volume and sensitivity of data at risk]
Section 4: Safeguard Analysis
Map each identified risk to existing or planned safeguards:
| Risk Identified | Administrative Safeguard | Physical Safeguard | Technical Safeguard | Status |
|---|---|---|---|---|
| [Unauthorized workstation access] | [Workstation use policy, training] | [Locked office after hours, visitor log] | [Auto-logout after 15 minutes, screen privacy filters] | [Implemented / Planned] |
Section 5: Gap Analysis and Remediation Plan
For each safeguard marked "Planned":
Gap description: [Specific control missing]
Regulatory requirement: [Cite HIPAA Security Rule section, e.g., § 164.312(a)(2)(iii) encryption and decryption]
Remediation action: [Specific task to close gap]
Responsible party: [Name and title]
Target completion date: [Specific date]
Validation method: [How you'll confirm the control works]
Section 6: Business Associate Risk
| Business Associate | Services Provided | BAA Signed (Date) | Last Security Assessment Reviewed | Risk Level |
|---|---|---|---|---|
| [Vendor name] | [Cloud EHR hosting] | [MM/DD/YYYY] | [MM/DD/YYYY] | [Low/Medium/High] |
Section 7: Breach Notification Readiness
Breach response team roles: [List name, title, and specific responsibility for each person involved in breach assessment and notification]
Notification timeline checklist:
- Breach discovery documented within 24 hours
- Risk assessment completed within 48 hours of discovery
- Affected individuals notified within 60 days if breach meets notification threshold
- HHS notification submitted within 60 days for breaches affecting 500+ individuals
- Media notification coordinated for breaches affecting 500+ individuals in same state/jurisdiction
Evidence retention: [Location where breach investigation records will be stored for six years]
Customizing the Template
Don't fill this template with hypothetical scenarios or assumptions. Use actual system names, vendor contracts, and staff roles. If you don't have multi-factor authentication deployed, mark it as a gap with a remediation date, not as "planned" with no timeline.
When you list threats and vulnerabilities, base likelihood ratings on your practice's specific circumstances. A ground-floor office with street-facing windows has different physical security risks than a third-floor suite in a locked building. A practice that allows staff to access records from personal devices faces different technical risks than one that restricts access to office workstations.
Update Section 2's asset inventory every time you add a system, change vendors, or modify how data flows through your practice. Update Section 6's Business Associate table whenever you sign a new BAA or receive a vendor's SOC 2 Type II report.
The gap analysis in Section 5 drives your compliance roadmap. Prioritize high-likelihood, high-impact risks first. Assign specific names and dates, not "IT team" and "Q3." If a gap remains open past its target date, document why and set a new deadline.
Validation Steps
A completed Security Risk Analysis should allow you to answer these questions without hesitation:
- What systems store protected health information right now?
- Which staff members can access each system, and why?
- What would happen if a laptop was stolen from your office today?
- When did you last train staff on your breach notification procedure?
- Can you produce a Business Associate Agreement for every vendor that touches patient data?
If any answer requires you to check with someone else or search through old files, that's evidence your analysis isn't current. Schedule a review, update the affected sections, and set a recurring calendar reminder to repeat the process.
When you update policies or add safeguards based on this analysis, reference the specific section and risk that drove the change. That connection between identified risk and implemented control is what a regulator looks for. It demonstrates you're working from evidence, not assumptions.
Your Security Risk Analysis isn't a document you complete to satisfy a requirement. It's the operational record that proves your compliance program addresses your practice's actual risks, not a generic template's theoretical ones.
