← Back to Home

HIPAA Risk Assessment (Security Risk Analysis)

A federally required Security Risk Analysis (SRA) for all HIPAA-covered entities and their business associates. We deliver a comprehensive assessment of your administrative, physical, and technical safeguards, plus a remediation roadmap. OCR audit-ready in 2–3 weeks.

What Is a HIPAA Risk Assessment?

The HIPAA Security Rule requires every covered entity and business associate to conduct a documented Security Risk Analysis. Not every practice does it. Those that don't face OCR fines and breach liability.

CLAS by Fred performs a comprehensive Security Risk Analysis that covers:

  • Administrative Safeguards: Security management, workforce security, information access management, security awareness and training, security incident procedures.
  • Physical Safeguards: Facility access controls, workstation security, workstation use policies, device and media controls.
  • Technical Safeguards: Access controls, audit controls, integrity controls, transmission security, encryption standards.
  • Environmental Factors: Business continuity, disaster recovery, third-party risk, vendor management and BAAs.

The Deliverable

You receive a comprehensive written Risk Assessment report (15–25 pages) that includes:

  • Executive summary of findings and risk level
  • Detailed findings by domain (admin, physical, technical)
  • Risk scores and prioritization matrix
  • Remediation roadmap with timeline and effort estimates
  • Regulatory citations and gap explanations
  • Recommendations for compliance frameworks

Why You Need This (Beyond Compliance)

OCR (the Office for Civil Rights, the HHS office that enforces HIPAA) can fine $145 to $73,011 per violation (2025 inflation-adjusted amounts). In February 2026, a treatment center with 1,980 affected patients paid $103,000 after a phishing incident, and OCR found it had never completed an accurate risk analysis. Most breaches are preventable. A documented Security Risk Assessment proves to regulators that you identified and addressed risk intentionally, the legal standard for "reasonable safeguards."

Your liability insurance may also require it. Always check your coverage.

What's Included in the Assessment

Onsite Interviews
Meet with key staff (clinical, IT, admin) to understand workflows, decision-making, and current controls.
Systems & Infrastructure Review
Document hardware, software, network architecture, backups, encryption, and access controls.
Policy Audit
Review existing security policies against HIPAA requirements. Identify gaps and overlaps.
Vendor & BAA Assessment
Evaluate third-party risk (EHR, billing, cloud storage, etc.). Confirm BAAs are in place and current.
Workforce Security Review
Check access controls, offboarding procedures, and role-based permissions.
Incident Response Readiness
Evaluate breach detection, notification, and recovery procedures.

Typical Timeline

Engagement: 2–3 weeks from kickoff to delivery.

Onsite time: 8–12 hours (scheduled across 2–3 visits).

Report prep: 3–5 days after final onsite visit.

How to Prepare

  • Gather existing security policies, IT documentation, and vendor lists.
  • Confirm IT contact(s) and facility manager availability for interviews.
  • Document any recent security incidents or concerns.
  • Provide access to EHR, network infrastructure, and device inventory.

Next Steps After the Assessment

Once you have the Risk Assessment report, you'll know exactly what to fix. CLAS by Fred can help you:

  • Develop missing policies (Security, Incident Response, Access Control, etc.)
  • Create staff training programs tailored to your findings.
  • Implement technical controls via an MSP partner (we'll recommend one).
  • Track remediation progress with a Compliance Tracker and regular check-ins.
  • Retain ongoing vCISO support to stay audit-ready and monitor regulatory changes.

Frequently Asked Questions

Do I have to fix everything immediately?
No. The assessment identifies risks and prioritizes them. We create a roadmap with realistic timelines. You can tackle high-risk items first and spread medium/low-risk work over months. That's what a Compliance Tracker does.
Will this assessment replace my IT support?
No. HIPAA Risk Assessment is advisory: it identifies what needs to be fixed. Technical implementation (patching, encryption, backups, endpoint security) is handled by your MSP. We'll help you brief them on findings and track their work.
What if my practice is already compliant?
Great news, and unlikely. Even practices with mature IT teams find gaps. The assessment confirms compliance, identifies low-hanging fruit, and gives you a documented baseline for audits. It's also useful for insurance, board minutes, and investor confidence.
How much does this cost?
The HIPAA Security Risk Analysis starts at $3,500 standalone, or $3,000 (Resilient), $2,500 (Vanguard) or $2,000 (Sovereign) for retainer clients. Larger or multi-location practices may cost more. Contact us for a custom quote.
Will OCR see my risk assessment?
If OCR opens an investigation, your Security Risk Analysis is one of the first documents they ask for. It is a required record, so plan on sharing it. That is why it needs to be accurate and current. For questions about privilege on related legal advice, talk to your attorney.