The question OCR asks first, every time
When HHS investigates a healthcare data breach, the first question isn't usually how did the attacker get in? It is done, and you are left with no other option but to do a risk analysis. Since launching its Risk Analysis Initiative in October 2024, the HHS Office for Civil Rights has made a missing or inadequate risk analysis the single most common finding named in recent HIPAA Security Rule settlements. And it shows up across organizations of every size, not just large health systems. That's exactly why HIPAA security risk assessments deserve more attention than most practices give them.
What a HIPAA security risk assessment actually is
At its core, it's a documented, organization-wide review of where electronic protected health information lives, who can access it, and what could realistically go wrong. Not a checklist you fill out once and file away. A real assessment covers every system that touches patient data, your EHR, email, billing software, cloud storage, even the laptops staff use remotely, and identifies specific vulnerabilities in each one.
The HIPAA Security Rule has required this since 2005. What's changed is how closely OCR is now checking whether practices actually did it, and did it thoroughly.
Why this matters beyond avoiding a fine
A weak or missing risk assessment doesn't just create compliance exposure. It usually means nobody in the practice actually knows where the real gaps are. That's a patient-care and business-continuity problem as much as a legal one. If a ransomware attack hits and nobody's tested whether backups actually restore, or nobody knows which systems hold patient data and which don't, the recovery process gets a lot longer and a lot more expensive.
The recent OCR settlement pattern backs this up. Practices that had a current, thorough risk analysis on file, even when a breach still occurred, consistently reached resolution faster and paid less than practices that couldn't produce one.
What a proper assessment actually includes
A thorough assessment identifies every system that stores, processes, or transmits patient information, evaluates the specific threats and vulnerabilities facing each one, reviews who has access and whether that access is appropriate, and documents a prioritized plan for fixing what's found rather than just listing problems. It also needs to be revisited regularly, not treated as a one-time project, since new systems, new staff, and new tools all change the risk picture.
Who actually needs one
Every healthcare provider, practice, or business associate handling protected health information is required to have one, regardless of size. Smaller practices sometimes assume this only applies to hospitals or large health systems. The OCR settlement data says otherwise. Several recent enforcement actions involved breaches affecting fewer than 10,000 patients, which means practice size has never been the deciding factor in whether OCR investigates.
Security has to be the baseline, not the reaction
This is where I think a lot of practices get the order backwards. A risk assessment shouldn't be something you scramble to produce after a breach or an audit notice arrives. It should be the starting point, the thing that tells you what to actually prioritize before something goes wrong. Multi-factor authentication, access controls, encryption, and monitored backups all matter, but a risk assessment is what tells you which of those gaps is actually the most urgent for your specific practice.
What about AI tools in a healthcare setting?
More practices are experimenting with AI for transcription, scheduling, and administrative work, and a current risk assessment needs to account for that too. Before any AI tool touches patient data, you need to know whether that tool is HIPAA compliant, where the data goes once it's entered, and who can access it on the other end. That's a question a real assessment should be answering directly, not skipping past.
Where to start
I founded Ask Erik Computer Services in 2006 and have served businesses here in Lane County since moving to Oregon in 2017. I've walked practices through exactly this process, explaining what's found in plain language, not acronyms, and building a prioritized plan around it rather than a stack of findings nobody has time to act on.
If your practice hasn't had a current risk assessment done, or it's been a while, start with a 30-minute consultation. We'll talk through where things stand and what a proper assessment would actually involve for your setup.
You can also read more about how this connects to our broader managed IT approach, and how we think about AI in a healthcare setting specifically.
Frequently Asked Questions
What Does a HIPAA Security Risk Assessment Include?
A thorough review of every system that holds patient data, from your EHR to email to cloud storage, along with the specific vulnerabilities in each one. It also covers who currently has access, whether that access is appropriate, and a documented, prioritized plan to fix what's found. It's meant to be ongoing, not a one-time checklist filed away and forgotten.
Why Are HIPAA Security Risk Assessments Important?
Since 2024, OCR has named a missing or inadequate risk analysis as the top finding in the majority of recent HIPAA settlements, regardless of practice size. Beyond avoiding penalties, a proper assessment shows you exactly where your real security gaps are before they cause a breach, rather than finding out during an investigation after something's already gone wrong.
What Tools Are Used for HIPAA Security Risk Assessments?
There's no single required software or tool. What actually matters is a thorough, documented process that covers every system touching patient data, evaluated by someone who understands both HIPAA's specific requirements and how your practice's technology is actually set up, not a generic template applied without context.
When Should a Healthcare Organization Update Its Risk Assessment?
At minimum once a year, and any time something meaningful changes, new software, new staff, a new location, or a new AI tool touching patient data. OCR treats an outdated risk assessment the same way it treats a missing one, so letting it sit unrevised carries the same exposure as never having done one.