When the Office for Civil Rights opens an investigation — whether it started with a stolen laptop, a misdirected fax, or a disgruntled former employee's complaint — the first item on the data request letter is almost always the same: a copy of your most recent risk analysis, with the date it was completed. Not your policies. Not your training logs. The risk analysis.

A HIPAA risk assessment for small practice settings is the documented process required by 45 CFR 164.308(a)(1)(ii)(A), in which you identify where protected health information lives, what could go wrong, how likely and how damaging that would be, and what you're doing about it. This article is for the person in your office who has to actually produce that document — the owner, office manager, or designated security official. It covers scope, method, evidence, and a realistic timeline.

How Often Does a Small Practice Need a HIPAA Risk Assessment?

The Security Rule does not name a calendar interval. It requires that the analysis be accurate and thorough and that you review and update security measures as needed. In practice, the operating standard is:

  • Annually, at minimum, and dated — this is also what the CMS Promoting Interoperability and MIPS attestations assume when you check the security risk analysis measure for the performance period.
  • Whenever something material changes: a new EHR or practice management system, a move to a new suite, adding a second location, standing up a telehealth workflow, switching billing companies, or adopting an AI scribe or patient messaging tool.
  • After any security incident or breach, as part of your corrective action.

A two-provider clinic and a 400-bed hospital are held to the same requirement, but not the same complexity. 45 CFR 164.306(b) explicitly lets you factor in your size, technical infrastructure, and cost. Small does not mean exempt; it means proportionate.

Who Owns This Inside a Small Practice

You must designate a security official in writing (45 CFR 164.308(a)(2)). In a five-person office that is usually the practice manager, sometimes the owner-physician. Write the name and date on a one-page designation memo and keep it in the compliance binder. An undesignated security official is a finding an investigator can make in thirty seconds.

That person does not have to do all the work. A realistic split for a small practice:

  • Security official: owns scope, runs the interviews, signs the final report, tracks remediation.
  • IT vendor or MSP: supplies the technical inventory — encryption status, patch levels, backup configuration, firewall and endpoint reporting, account lists.
  • Front desk lead: walks the physical space, describes actual check-in and records workflows, not the ones in the manual.
  • Billing lead: identifies every downstream vendor that touches claims, statements, or collections.
  • Owner: approves the budget for remediation. Without this, your risk management plan becomes a wish list.

Your IT vendor cannot do this for you

A vulnerability scan is not a risk analysis. A network assessment from your MSP is a valuable input, and you should keep it as an exhibit, but it does not cover paper records, workforce sanctions, business associate relationships, or facility access. If the only artifact you have is a vendor scan report, you have a gap.

The Nine Elements OCR Expects to See

HHS published guidance on risk analysis requirements that lays out the components of a compliant analysis. Structure your document around them, in this order, with headings that match. It makes review trivially easy for a regulator and for you a year later.

  1. Scope — all ePHI you create, receive, maintain, or transmit, in any form and on any medium.
  2. Data collection — where that ePHI actually is: servers, laptops, phones, cloud services, vendors, backup media.
  3. Threats and vulnerabilities — identify and document the reasonably anticipated ones.
  4. Current security measures — what you already have in place, and whether it's configured correctly.
  5. Likelihood of occurrence — rated, with your rating scale defined.
  6. Potential impact — rated the same way.
  7. Risk level — likelihood × impact, assigned per finding.
  8. Documentation — the written output itself.
  9. Periodic review and updates — evidence you revisit it.

For method, NIST Special Publication 800-66 Revision 2 maps each Security Rule standard to practical implementation steps and is the reference OCR points to most often. You do not need to adopt it wholesale. You do need a repeatable method you can describe.

Step One: Build the PHI Inventory Before You Assess Anything

Most inadequate risk analyses fail here. They assess the EHR and stop. Your ePHI footprint is wider than that.

Walk the practice with a notebook and list every place PHI enters, rests, or leaves. A typical small clinic inventory looks like this:

  • EHR and practice management system (cloud or on-premise — note which)
  • Clearinghouse and billing vendor portals
  • Email accounts, including the ones staff use to send referrals
  • The scanner-to-network-folder pipeline nobody documented
  • Front desk workstations and any shared login still in use
  • Staff personal phones with texting, email, or on-call access
  • The fax line — physical or eFax — and where inbound faxes land
  • Backup drives, and where they physically sit overnight
  • Appointment reminder and patient messaging services
  • Telehealth platform
  • Paper: charts in storage, sign-in sheets, superbills, the shred bin
  • Copiers and multifunction printers with internal hard drives

For each entry, record: system name, vendor, what PHI it holds, who has access, whether data is encrypted at rest and in transit, and whether a signed business associate agreement is on file. That last column is where small practices routinely discover three or four vendors with no BAA. If yours is one of them, you can generate a signature-ready business associate agreement and close the gap the same week rather than putting it on a list you'll re-read next year.

Step Two: Rate Threats Against What You Actually Have

Use a simple three-by-three matrix — Low, Moderate, High for both likelihood and impact — and define each level in one sentence so a second reader would score it the same way. Sophistication is not the goal. Consistency and honesty are.

The findings that surface repeatedly in small practices, and that regulators ask about:

  • Unencrypted laptops and external drives. Encryption is addressable, not required — but if you skip it you must document why and what you did instead. "We didn't get to it" is not an equivalent alternative measure.
  • Shared or generic logins. Unique user identification is a required implementation specification. A shared front-desk account destroys your audit trail.
  • No review of access logs. Information system activity review is required. If nobody looks, snooping goes unnoticed until a patient complains.
  • Terminated staff accounts left active. Pull your user list and compare it against payroll. This takes fifteen minutes and finds something in most practices.
  • Backups never tested. An untested restore is a hypothesis, not a contingency plan.
  • Email containing PHI sent to patients and referral partners without encryption or documented patient request.
  • Physical exposure — monitors visible from the waiting room, records room propped open, keys unaccounted for after a staff departure.

Check your sector against reality using the OCR breach portal for incidents affecting 500 or more individuals. Filter by provider type. The recurring causes — hacking of network servers and email, plus theft and improper disposal — should map directly to threats in your analysis.

Step Three: Turn Findings Into a Risk Management Plan

The risk analysis identifies. The risk management plan at 164.308(a)(1)(ii)(B) fixes. OCR has been explicit in recent enforcement work that a risk analysis with no follow-through is a compliance failure in its own right, and its risk analysis enforcement initiative has produced a steady stream of resolution agreements against providers of all sizes, including very small ones.

For every finding rated Moderate or High, record four fields:

  1. The remediation action, stated concretely ("enable BitLocker on all six clinical laptops")
  2. The named owner — a person, not a department
  3. The target date
  4. The completion date and evidence attached

Accepting a risk is legitimate. Accepting it silently is not. If you decide not to remediate, write the rationale and have the owner sign it.

Assembling all of this — the analysis document, the management plan, the matching policies, the BAA tracker — is where small practices lose weeks to blank templates. Tools that automate HIPAA risk analysis reports and the supporting policy set shorten the drafting time considerably, so your effort goes into the walkthrough, the interviews, and the remediation rather than formatting. No product, including any of them, confers a government certification; HHS does not certify or endorse compliance software. What you're buying is structure and a defensible paper trail.

What the Documented Evidence Looks Like

If an investigator, an auditor, or an acquiring group asks for your risk analysis, hand over a folder containing:

  • The dated risk analysis report, organized by the nine elements, signed by the security official
  • The ePHI inventory as an appendix
  • The risk management plan with owners, dates, and completion evidence
  • Supporting exhibits: vulnerability scan output, encryption status report, backup test results, user access review
  • Prior years' analyses, showing progression
  • The security official designation memo
  • The BAA log with execution dates

Retain all of it for six years from creation or last effective date, per 164.316(b)(2)(i). Store it somewhere that survives a ransomware event and a staff turnover — not solely on the practice manager's desktop.

A Six-Week Timeline You Can Actually Run

Week 1: Confirm the security official designation. Define scope in writing. Pull the vendor list from accounts payable.

Week 2: Build the ePHI inventory. Walk the physical space. Request the technical inventory from your IT vendor with a deadline.

Week 3: Interview front desk, clinical, and billing leads for thirty minutes each. Ask how the work actually happens.

Week 4: Score threats and vulnerabilities. Compare current safeguards against each Security Rule standard.

Week 5: Draft the report and the risk management plan. Assign owners and dates.

Week 6: Owner reviews and approves the remediation budget. Security official signs and dates. Calendar the next review and the first remediation check-in at 90 days.

If you want a free starting structure, the ONC and OCR Security Risk Assessment Tool is built specifically for practices with fewer than fifty employees and produces an exportable report. It is a scaffold, not a finished product — you still supply the facts and the follow-through.

Three Mistakes That Undo the Whole Exercise

Undated documents. A risk analysis with no completion date proves nothing about when you did it. Date every page.

Scoping to the EHR only. If your report never mentions email, the copier, or paper storage, an investigator will conclude the scope was inadequate — and inadequate scope is the most common risk analysis finding there is.

Copying last year's file and changing the year. If your practice added a telehealth platform in March and the analysis doesn't mention it, the document contradicts itself.

Also worth watching: OCR proposed significant updates to the Security Rule in a rulemaking published in early 2025, which would tighten expectations around asset inventories, network mapping, and encryption. Check the current status before your next annual cycle and build your inventory in a format you can extend rather than rewrite.

Your Next Step

Block four hours this week for the inventory. That single artifact drives everything downstream — scope, threat scoring, BAA gaps, and remediation. When you're ready to turn it into a signed, dated report with matching policies, a platform that produces the full HIPAA documentation set will get you to a defensible file faster than a blank template will. Either way, finish it, sign it, and put the next review on the calendar before you close the folder.