What is a HIPAA security risk assessment, and do you need one?

What is a HIPAA security risk assessment?

A HIPAA security risk assessment (often called a security risk analysis) is a systematic process for identifying where electronic protected health information (ePHI) lives in your organization, what could go wrong, and how serious the consequences would be. It is the foundational requirement of the HIPAA Security Rule's administrative safeguards: every other security control you implement should flow from what the assessment reveals.

In practice, the assessment maps the full lifecycle of ePHI (how it is created, received, maintained, and transmitted), then evaluates the threats and vulnerabilities affecting that data and rates the likelihood and potential impact of each risk. The goal is not a perfect score; it is a documented, defensible understanding of your risks so you can prioritise remediation. The US Department of Health and Human Services (HHS) treats the risk analysis as ongoing rather than a one-time checkbox, and expects it to be revisited whenever your systems, vendors, or operations change materially.

Who needs a HIPAA security risk assessment?

You need a HIPAA security risk assessment if you are a covered entity or a business associate that handles ePHI. The obligation does not stop at the US border; it follows the data.

• Covered entities: US healthcare providers, health plans, and healthcare clearinghouses that handle protected health information electronically.
• Business associates: any vendor that creates, receives, maintains, or transmits ePHI on behalf of a covered entity, including cloud hosting providers, SaaS platforms, analytics firms, billing services, and IT contractors.
• Subcontractors: a business associate's own vendors that touch ePHI inherit the same obligations through the business associate agreement (BAA) chain.
• Non-US organizations: a Canadian software, hosting, or services company serving US hospitals, clinics, or health plans is typically a business associate and is contractually and legally expected to meet the Security Rule, including the risk analysis.

What does a HIPAA security risk assessment cover?

A defensible HIPAA security risk assessment covers far more than antivirus and firewalls. It examines the administrative, physical, and technical safeguards required by the Security Rule and ties each identified risk to a realistic likelihood and impact rating, so remediation can be prioritised by exposure rather than guesswork.

• Scope and data flow: every system, application, device, and third party that creates, receives, stores, or transmits ePHI, including backups, mobile devices, and SaaS tools.
• Threats and vulnerabilities: realistic threat sources (external attackers, insiders, lost devices, vendor failures) paired with the weaknesses they could exploit.
• Existing controls: access controls, encryption at rest and in transit, audit logging, authentication, and physical security already in place.
• Likelihood and impact: a rating of how probable each risk is and how damaging a resulting breach of ePHI would be.
• Administrative safeguards: workforce training, sanction policies, contingency planning, and BAAs with vendors.
• Documentation: a written record of the analysis, decisions, and remediation plan, which HHS expects to be retained and updated over time.

Is a HIPAA security risk assessment the same as a Canadian PIA or TRA?

No, but they are complementary, and the underlying methodology overlaps heavily. A HIPAA security risk assessment is a US legal requirement focused specifically on the security of electronic protected health information. A Canadian Privacy Impact Assessment (PIA) is broader: the federal Office of the Privacy Commissioner describes a PIA as a risk-management process that helps institutions ensure they meet legislative requirements and identify how a program or activity affects individuals' privacy, assessed against privacy principles such as accountability, limiting collection, retention, safeguards, and individual access. A Threat and Risk Assessment (TRA) focuses on security threats and controls and is often paired with a PIA.

If your organization handles both Canadian personal information (under PIPEDA, PHIPA, or Quebec's Law 25) and US ePHI, you may need all three. The good news is that the evidence collected for one (data flow mapping, control inventories, threat analysis) feeds directly into the others, so a well-run programme avoids duplicating effort. Note that most private-sector organizations are not legally bound by the government PIA mandates that apply to federal and provincial public bodies, but the same methodology is widely treated as best practice and is increasingly demanded by healthcare and enterprise buyers.

What does a HIPAA security risk assessment cost and how is it scoped?

Cost varies widely and depends on scope rather than any fixed price, so the honest answer is that it should be quoted after a short scoping conversation. The size of the assessment is driven by how complex your environment is, not by a published rate card.

The main cost and effort drivers are the number of systems and applications that touch ePHI, the number of third-party vendors and subcontractors in scope, the maturity of your existing documentation and controls, whether the work is a one-time analysis or an ongoing managed programme, and whether you also need remediation support afterward. A small SaaS vendor with a single application and a modern cloud stack is a very different exercise from a multi-system hospital integrator. Rather than fixating on price, scope the assessment to your actual ePHI footprint and treat it as a recurring activity, since HHS expects the risk analysis to be reviewed and updated as your systems and risks change. Book a consultation for a tailored quote based on your environment.