Risk Management
HIPAA Risk Assessment Template
A guided HIPAA security risk assessment based on the NIST SP 800-30 methodology. Answer 22 questions about your practice's safeguards and receive a risk score with prioritized remediation steps you can print for documentation.
March 9, 2026
Answer each question about your practice's current security controls. Select “N/A” for questions that don't apply to your organization.
What Is a HIPAA Risk Assessment?
A HIPAA risk assessment (also called a security risk analysis) is a systematic evaluation of potential threats and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). It's required under 45 CFR §164.308(a)(1)(ii)(A) for every covered entity and business associate, regardless of size.
Unlike a simple checklist, a risk assessment quantifies each risk by combining how likely the threat is with how severe the impact would be — following the same methodology used by OCR auditors and recommended by NIST SP 800-30.
How Often Is HIPAA Risk Assessment Required?
Legally required
Every covered entity and business associate must conduct a risk assessment under the HIPAA Security Rule.
At least annually
OCR expects assessments at least once per year and whenever significant changes occur (new EHR, office move, breach).
All practice sizes
Solo practitioners to large health systems. The scope scales with your organization, but the requirement doesn't shrink.
OCR enforcement reality: Failure to conduct a risk assessment is the #1 finding in HIPAA audits and settlements. Penalties range from $145 to $73,011 per violation, with an annual maximum of $2,190,294 per violation category (2026 figures).
How to Use This Assessment
- 1Enter your practice name and work through each of the 5 assessment categories
- 2Answer each question honestly — Yes, Partial, No, or N/A
- 3Click "Generate Risk Report" to see your risk score and severity breakdown
- 4Review the prioritized remediation plan, starting with Critical findings
- 5Print or copy the report for your compliance documentation files
For a broader compliance review beyond security, use our HIPAA Compliance Checklist which covers the Privacy Rule and Breach Notification Rule as well. If you need to formalize vendor relationships, our BAA Template Generator creates compliant Business Associate Agreements.
NIST SP 800-30 Methodology
This tool follows the risk assessment framework from NIST Special Publication 800-30, the methodology recommended by HHS for HIPAA compliance. Each identified risk is scored using two factors:
Likelihood
How probable is this threat? Based on current controls, threat sources, and vulnerability severity.
Impact
How severe would the consequence be? Based on data sensitivity, number of records, and regulatory penalties.
The resulting risk matrix maps each finding to a severity level: Low, Medium, High, or Critical. This is the same approach used by OCR auditors when evaluating compliance. For training and documentation requirements beyond security controls, review our dedicated guides.
Related Tools & Guides
HIPAA Compliance Checklist
Interactive checklist covering Privacy Rule, Security Rule, and Breach Notification requirements.
BAA Template Generator
Generate Business Associate Agreements for vendors who handle your ePHI.
Who Does HIPAA Apply To?
Determine whether your organization is a covered entity or business associate.
HIPAA Minimum Necessary Rule
Understand when and how to limit PHI access to the minimum required.