Medical clinics
Primary care and specialty practices with an EHR, patient portal and a mix of office and remote staff.
What HIPAA requires
The risk analysis is the first thing OCR asks for
The HIPAA Security Rule requires covered entities and business associates to do an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of electronic protected health information (45 CFR 164.308(a)(1)(ii)(A)).
It applies to practices of every size. HIPAA lets you scale the safeguards to your size and resources, but not skip the analysis.
It's also where enforcement is focused. The HHS Office for Civil Rights runs a Risk Analysis Initiative aimed at practices with missing or weak risk analyses, and it has announced at least 14 enforcement actions under it since October 2024 (HHS).
How it works
From inventory to fix plan
01
Inventory
We map where patient data lives: your EHR or practice management system, email, imaging, file shares, backups and cloud apps.
02
Test
We run an external penetration test and review your Microsoft 365 or Google Workspace settings, the way an attacker would.
03
Rate
Each risk gets a likelihood and impact rating, tied to the HIPAA safeguard it falls under.
04
Plan
You get the written analysis, a risk register and a fix plan, and we walk you through all of it.
Who it's for
Practices, and the companies that serve them
Dental offices
Practice management software, digital imaging and front-desk computers that all touch patient records.
Behavioral health
Counseling and therapy practices, often with telehealth and records that need extra care.
Business associates
Billing companies, IT vendors and software firms that handle patient data for covered entities.
After the assessment
Turning the report into fixes
A risk analysis only helps if the risks get managed. HIPAA also requires security measures that bring those risks down to a reasonable level (45 CFR 164.308(a)(1)(ii)(B)).
We can fix the technical gaps ourselves as part of a managed IT plan, or hand the plan to your current IT provider and retest when they're done. For the ongoing side, policies, training and yearly updates, see our HIPAA compliance program.
FAQ
Questions we get asked
Don't see yours? Email hello@portlandsecureit.com and you'll get a straight answer.
How often do we need a HIPAA risk assessment?
HIPAA doesn't set a calendar. It expects you to review and update the analysis regularly and whenever something changes, like a new EHR, a new office or a security incident. Most practices redo it every year.
Is a risk assessment the same as a risk analysis?
In practice, yes. The regulation says risk analysis, and most people call it a risk assessment. Either way, it has to cover every system that creates, receives, stores or sends patient data.
We're a small office. Do we really need one?
Yes. The requirement applies to every covered entity and business associate, no matter the size. A small office just has fewer systems to cover.
Is the free HHS risk assessment tool enough?
The HHS Security Risk Assessment Tool can help you organize the work, but it's a questionnaire. It doesn't test anything. Our assessment covers the same ground and adds real testing.
Is the HIPAA Security Rule changing?
HHS proposed an update in January 2025. It's still a proposal, with final action now targeted for July 2027 (federal regulatory agenda). The risk analysis is required under the current rule either way.
What does it cost?
It's a fixed price, quoted after a short call. It depends on how many locations, staff and systems you have.
Keep reading