If you only get one thing right in your HIPAA program, make it the risk assessment. It is the foundation everything else is built on, it is required by law, and it is the single most-cited failure in federal enforcement. And yet it is the piece practices most often skip, do once and forget, or reduce to a one-page checklist. Here is what the HIPAA Security Risk Assessment actually is, what the regulation requires, how a real one runs, and what Texas practices in DFW and Houston need to add.
It is required, specifically
The HIPAA Security Rule requires a risk analysis under 45 CFR 164.308(a)(1)(ii)(A), part of the Security Management Process. The requirement is to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. This applies to covered entities and to business associates, which includes your IT vendor. It is not optional, and "we are a small practice" is not an exemption.
What the Security Rule actually requires
The risk analysis does not stand alone. It sits inside a standard called the Security Management Process at 45 CFR 164.308(a)(1), which says a covered entity must implement policies and procedures to prevent, detect, contain, and correct security violations. That standard has four implementation specifications, and all four are marked required, not addressable. In plain language, here is what each one asks of a practice.
Risk analysis, 164.308(a)(1)(ii)(A)
Find out where your risks are. The word that matters is "thorough." The analysis has to cover all ePHI, wherever it sits: the EHR, the practice management system, imaging, email, scanned documents, backups, laptops, phones, cloud applications, and the systems your vendors run for you. A risk analysis that only looks at the EHR is not thorough, and OCR has said so repeatedly in its guidance and resolution agreements.
Risk management, 164.308(a)(1)(ii)(B)
Do something about what you found. The practice must implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. This is where many programs fail: the analysis exists, but there is no record of decisions, owners, dates, or completed fixes. Risk management is the written plan and the evidence that the plan was carried out. A risk that the practice decides to accept should be accepted on purpose, by someone with authority, with the reasoning written down.
Sanction policy, 164.308(a)(1)(ii)(C)
Have consequences for workforce members who fail to follow security policies, and apply them. That sounds like an HR matter, but it ties back to the risk analysis. If shared passwords, unapproved personal email, or unencrypted USB drives show up as risks, the sanction policy is part of how the practice shows it takes its own rules seriously. The policy should be written, communicated in training, and applied consistently.
Information system activity review, 164.308(a)(1)(ii)(D)
Look at what is happening on your systems. The practice must regularly review records of system activity, such as audit logs, access reports, and security incident tracking. For a medical practice this usually means reviewing EHR access logs for inappropriate chart access, reviewing sign-in activity on email and remote access, and reviewing alerts from endpoint protection and firewalls. The risk analysis should say which logs exist, who reviews them, and how often.
Read together, the four specifications describe a loop: identify risk, reduce it, hold people accountable, and watch for problems. The risk analysis is the start of the loop, not the whole of it.
It is the foundation, not a formality
Every other safeguard in the Security Rule is supposed to be implemented based on what the risk analysis finds. You cannot reasonably decide what protections you need until you have assessed where your risks actually are. That is why the risk analysis comes first. Skip it, and every other control you put in place is a guess. Do it well, and it becomes the plan that drives the rest of your security program.
What a real risk assessment covers
A genuine risk analysis inventories where ePHI lives, how it moves, and who can access it, then evaluates the threats and vulnerabilities against each of those, and documents the likelihood and impact. That includes your EMR, your email, your backups, your devices, your cloud services, and your vendors. It is not a questionnaire you fill out in an afternoon. It is a structured look at your actual environment, followed by a remediation plan in priority order.
How a risk assessment actually runs
HHS guidance does not prescribe one method, but a defensible security risk analysis follows a recognizable sequence. Here is how the process runs in a typical medical or dental practice.
Before any of it, many practices want a quick sense of where they stand. Our free IT Risk Assessment is a good informal starting point: a few minutes of plain-language questions that point to likely gaps before the formal analysis begins. It does not replace the steps below, but it helps decide where to look first.
Step 1: Scoping and ePHI inventory
Define what is in scope, which under the Security Rule means every system, location, device, and vendor that touches ePHI. Then build the inventory: each application, server, workstation, mobile device, medical device that stores images or results, cloud service, and business associate. For each one, record what data it holds, where it is physically or logically located, how data flows in and out, and who has access. Most surprises surface here: an old server in a closet, a front desk scanner that emails documents, or a billing contractor with remote access nobody remembers granting.
Step 2: Threat and vulnerability identification
For each item in the inventory, identify the realistic threats (ransomware, phishing, lost or stolen devices, insider misuse, power or connectivity failure, storm damage, vendor compromise) and the vulnerabilities those threats could exploit (missing patches, no multifactor authentication, shared accounts, unsupported operating systems, untested backups, flat networks). Technical evidence matters here. Vulnerability scans, configuration reviews, and access reports produce findings that interviews alone will miss.
Step 3: Likelihood and impact rating
Rate each threat and vulnerability pair for how likely it is to happen given the controls in place, and how much harm it would cause to confidentiality, integrity, or availability if it did. A simple scale such as low, medium, and high is fine as long as it is applied consistently and the reasoning is written down. Likelihood multiplied by impact gives a risk level that lets the practice compare very different problems on the same terms.
Step 4: The risk register
Record every identified risk in a single register: the asset, the threat, the vulnerability, the current controls, the likelihood, the impact, the resulting risk level, and the owner. The register is the working document of the security program. It is what OCR, the Texas Attorney General, an auditor, or a cyber insurer will ask to see, and it is what the next review starts from.
Step 5: Remediation plan in priority order
Turn the register into a plan. Fix the highest risks first, assign each item to a person, set a target date, and record when it is done. Some items are quick, such as enabling multifactor authentication on email. Others take budget and planning, such as replacing an unsupported server. This step is how the practice satisfies the risk management specification, and it is the part regulators look for most closely after an incident.
Step 6: Documentation and retention
Keep the risk analysis, the register, the remediation plan, the evidence of completed work, and the related policies. HIPAA requires this documentation to be retained for six years from the date it was created or last in effect, whichever is later. Version each review rather than overwriting the last one, so the practice can show how its risk posture changed over time.
Risk analysis vs risk assessment vs gap analysis vs security risk analysis
Practices hear all four terms, often from the same vendor in the same meeting. In everyday use, risk analysis, risk assessment, security risk assessment, and security risk analysis are used interchangeably. The regulation says "risk analysis." HHS and ONC named their free tool the Security Risk Assessment Tool. Insurers and auditors tend to say "security risk assessment." When someone asks about a HIPAA security analysis, they almost always mean the same required exercise.
The term that is genuinely different is gap analysis. A gap analysis compares the controls you have against a checklist of requirements and lists what is missing. It is useful, and it is often part of a security risk analysis, but it does not rate likelihood and impact across your actual environment, so on its own it does not satisfy 164.308(a)(1)(ii)(A). If a proposal for a security risk analysis in Texas is really a gap checklist, ask what is missing before you sign.
It is the most-cited HIPAA failure
Failure to conduct an accurate and thorough risk analysis is consistently the most-cited HIPAA violation in Office for Civil Rights enforcement actions and audits. When something goes wrong and OCR gets involved, this is the first document they ask for. A practice that can produce a current, thorough risk analysis and a record of acting on it is in a fundamentally different position than one that cannot.
Do it, document it, and act on it, on a cadence
The requirement is not a one-time event. Environments change: you add a vendor, adopt a new system, open a location. The risk analysis should be reviewed and updated on a regular cadence and whenever something material changes, and, just as importantly, you have to act on what it finds and keep the records. HHS and ONC even publish a free Security Risk Assessment Tool, but a tool only helps if the assessment is honest and the findings get remediated.
HIPAA risk assessments in Texas: what is different
Texas practices have obligations beyond the federal Security Rule. The Texas Medical Records Privacy Act (HB 300) defines covered entity far more broadly than HIPAA, so businesses that merely come into possession of protected health information can be covered, and it layers on its own training and privacy requirements. Texas breach notification law requires notifying affected individuals within 60 days and reporting breaches affecting 250 or more Texans to the Texas Attorney General, who maintains a public list of reported breaches. The Texas Data Privacy and Security Act adds general data protection duties for many businesses as well.
For a risk assessment, that means two practical things. First, your assessment scope in Texas should cover state definitions of sensitive information, not just HIPAA ePHI. Second, enforcement can come from two directions, the HHS Office for Civil Rights and the Texas Attorney General, and both expect to see a current, documented risk analysis when something goes wrong.
What OCR enforcement looks like from inside a practice
For most practices, OCR contact does not start with an audit. It starts with a breach report the practice filed itself, or a complaint from a patient. OCR sends a data request, and near the top of the list is the current risk analysis, the risk management plan, and evidence that the plan was carried out. OCR also asks for prior versions, policies, training records, and business associate agreements.
The practice then has a limited window to produce documents. If the risk analysis is years old, covers only the EHR, or never led to remediation, that becomes a finding in its own right, separate from whatever caused the breach. Outcomes range from technical assistance to a resolution agreement with a corrective action plan and monitoring, and in some cases civil money penalties. The Texas Attorney General can pursue a parallel state action. The common thread is that the documentation, not the intention, is what gets evaluated.
Why DFW and Houston practices get caught out
The patterns we see across both markets are less about bad intent and more about growth outpacing the paperwork.
- Multi-location growth. A group adds a second or third site across the Metroplex or the Houston suburbs, or acquires an existing practice. The new site has its own network, its own devices, and sometimes its own EHR instance, and the risk analysis still describes only the original office.
- Offshore and remote billing. Revenue cycle work moves to remote staff or an offshore team. ePHI now flows to people and devices outside the building, through remote desktops or virtual desktops, and the analysis never accounted for that access path or the business associate chain behind it.
- Aging on-premise servers. An EHR, imaging archive, or practice management database still runs on a server past its support date. It is the kind of vulnerability a thorough analysis flags immediately, and the kind a checklist assessment can miss entirely.
Most DFW and Houston practices we work with settle into a rhythm of a full security risk assessment annually, refreshed whenever something material changes: a new EHR or practice management system, a new location, a merger, or a move to remote or offshore billing.
Want a quick read on where you stand first? Take the free 3-minute IT Risk Assessment.
Who can perform it
HIPAA does not require an outside firm. A practice can perform its own risk analysis, and many small practices start that way. The question is whether the people doing it have the time, independence, and technical visibility to make it accurate and thorough.
Self-assessment with the HHS/ONC SRA Tool
The free Security Risk Assessment Tool from HHS and ONC walks a practice through questions organized around the Security Rule and produces a report. It is a reasonable structure for a small practice. Its limits are the answers it is given: the tool cannot see your firewall configuration, your patch status, or the remote access account a former vendor left behind. If the person answering does not know, the report will not either.
Working with HIPAA risk assessment consultants in Texas
A third party brings technical testing, a fresh set of eyes, and experience with what regulators ask for. When you evaluate HIPAA risk assessment consultants in Texas, ask how they collect evidence (interviews only, or scans and configuration reviews as well), whether they cover every location and vendor, whether they address Texas law alongside HIPAA, who owns remediation afterward, and whether they will sign a business associate agreement. Be cautious of anyone offering a certificate of HIPAA compliance; no such official certification exists.
What a deliverable should contain
- A written scope and an inventory of systems, locations, and vendors handling ePHI.
- The method used, including how likelihood and impact were rated.
- A risk register with every identified risk, its rating, and an owner.
- A remediation plan in priority order with target dates.
- Supporting evidence such as scan results and configuration findings.
- A summary leadership can read, and a date for the next review.
How Galleon helps
We conduct HIPAA risk assessments for our clients, document them, and drive the remediation in priority order, then keep the posture current as the environment changes. As your IT partner we are also a business associate, so we hold the same obligation, and we produce the documentation that holds up under review. For a fast, informal starting point, our free IT Risk Assessment gives you a plain-language snapshot of where your gaps are before a formal analysis.
If you are not sure whether your last risk assessment is current, or whether one has ever been done, that uncertainty is the finding. Explore our Regulatory Compliance service, take the free IT Risk Assessment, or schedule a discovery call.
Frequently asked questions
An accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic protected health information the practice creates, receives, maintains, or transmits. In practice that means an inventory of where ePHI lives and moves, identified threats and vulnerabilities, a rating of likelihood and impact for each risk, a risk register, a remediation plan in priority order, and documentation kept for six years.
The Security Rule does not set a fixed calendar interval. It requires the analysis to be accurate and current, and to be reviewed and updated as the environment changes. Many practices review it annually and update it whenever something material changes, such as a new EHR, a new location, a merger, or a move to remote or offshore staff.
Yes. The risk analysis is a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A) of the HIPAA Security Rule. It applies to covered entities, including medical and dental practices, and to their business associates, including IT providers. Practice size does not create an exemption.
In everyday use there is no meaningful difference. The regulation uses the term risk analysis, while HHS tools, auditors, insurers, and consultants often say security risk assessment or security risk analysis. A gap analysis is narrower: it compares current controls against a list of requirements and does not by itself satisfy the risk analysis requirement.
Cost depends on scope rather than a standard price. The main drivers are the number of locations, workstations, servers, and users; how many systems hold ePHI, including the EHR, imaging, billing, and cloud services; whether technical testing such as vulnerability scanning is included; the number of vendors and business associates to review; and whether remediation support is part of the engagement. Ask any provider to price the scope in writing.
The HHS Office for Civil Rights enforces HIPAA nationally, including in Texas. The Texas Attorney General can also bring actions under HIPAA and under Texas law, including the Texas Medical Records Privacy Act, and receives breach reports affecting 250 or more Texans. Both expect to see a current, documented risk analysis after an incident.
Yes. HIPAA does not require a third party, and HHS and ONC publish a free Security Risk Assessment Tool designed for small and medium practices. The assessment has to be honest, cover the whole environment, and lead to documented remediation. Many practices bring in outside help because they lack the time or technical visibility to assess servers, networks, and vendors accurately.
HIPAA requires Security Rule documentation, including the risk analysis, risk management decisions, and related policies, to be retained for six years from the date it was created or the date it was last in effect, whichever is later.
The Security Rule risk analysis covers electronic protected health information. Paper records fall under the Privacy Rule safeguards. Texas law also reaches sensitive information more broadly, so many Texas practices document physical and paper risks in the same exercise to keep one complete picture.