Compliance / HIPAA Risk Analysis
HIPAA Risk Assessment & Security Risk Analysis
A HIPAA Security Risk Analysis identifies where your electronic protected health information (ePHI) lives, what could compromise its confidentiality, integrity or availability, and which safeguards need attention. ACS documents that analysis, rates the risks, and turns the findings into a prioritized remediation plan you can use with our team or your own. Remote-first, nationwide.
What is a HIPAA Security Risk Analysis?
It is a documented evaluation of your actual environment, and the input to risk management.
The HIPAA Security Rule requires every covered entity and business associate to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of the electronic protected health information it holds. In plain terms: identify where your ePHI is created, received, maintained or transmitted; document the threats, vulnerabilities and existing safeguards; then rate likelihood and impact.
A risk analysis is not a generic checklist or a one-page attestation. It is also distinct from risk management: the analysis finds and rates risks, while risk management reduces them to reasonable and appropriate levels. A finished report without follow-through leaves the next step undone.
The process should be ongoing. HHS does not prescribe one universal interval; review and update the analysis when your systems, operations or risks change, and choose a review cadence that fits your environment. An annual review can be a useful practice, but it does not replace updates after material changes. See the HHS Guidance on Risk Analysis.
Why does OCR keep citing practices for this?
Enforcement actions repeatedly identify missing or incomplete risk analyses, while a separate rulemaking proposal would make several safeguards more explicit.
Missing or inadequate analyses
Across OCR settlements, the recurring theme is a practice that either never performed a real risk analysis or did a superficial one that ignored whole systems. After a breach, that gap can become a central compliance issue.
A proposed update, not a current shortcut
The proposed Security Rule overhaul would remove the required/addressable distinction and make controls such as encryption and MFA more explicit. It does not replace the current rule or the need for a thorough analysis now. See our ransomware action plan for the practical controls.
What does an ACS HIPAA risk analysis include?
Six connected deliverables, from the ePHI inventory through the remediation record.
ePHI inventory & data flow
We map every place ePHI is created, received, stored, or transmitted, from your EHR to email, devices, cloud apps, and backups.
Threat & vulnerability mapping
We identify the realistic threats to each asset, from ransomware and phishing to lost devices and insider error, and the vulnerabilities that enable them.
Safeguard evaluation
We assess your administrative, physical, and technical safeguards against the Security Rule, and flag where you are exposed today.
Likelihood & impact scoring
Each risk is rated so you can see what is urgent versus what can wait, instead of a flat list with no priorities.
Prioritized remediation roadmap
A clear, sequenced plan to close the highest risks first, with the work scoped so you know what it takes. This is your risk-management starting point.
Audit-ready documentation
The full analysis is delivered as documentation you can hand to an auditor, an insurer, or a partner who asks for proof.
What do you receive, and when?
A paid, practice-specific engagement that starts with a free 30-minute scope call.
The engagement delivers the documented analysis described above: the ePHI inventory and data flow, threat and vulnerability mapping, safeguard evaluation, likelihood and impact ratings, a prioritized remediation roadmap, and the supporting record. Remediation is the next step after the analysis; ACS can scope that work separately, or your own team can use the plan.
There is no universal delivery timeline or price. Timing and cost depend on the size of your practice and the number of systems in scope. On the free scope call, ACS identifies the systems and work to cover; confirm your expected delivery window during that discussion. Before the paid work begins, ACS scopes the engagement and gives you a flat quote.
How does a HIPAA risk assessment work?
A focused engagement that fits around your clinical schedule.
What practices say about working with us
As someone working in healthcare, protecting patient information is non-negotiable. Atlantic Computer Systems has been outstanding: knowledgeable, responsive, and always ahead o…
Atlantic Computer Systems has been fantastic to work with. Their team is knowledgeable, responsive, and always quick to help when issues come up.
Huge shoutout to an amazing IT team! Reliable, responsive, and always ready to help, no matter how big or small the issue. They keep everything running smoothly behind the scenes.
Our healthcare agency couldn't be happier with their service. Their team is always professional, responsive, and really understands the challenges of managing sensitive patient…
Four was amazing at helping me get set up! He answered all my questions and guided me so well with getting my access and software. He's always easy to reach and does great with…
Four has been very knowledgeable and available when it comes to technological issues. He always solved the problem and is always professional and kind. Great support team!
Atlantic Computer Systems is wonderful. I've personally interacted with Four and Ed. They are both very knowledgeable and professional. I would highly recommend them to anyone n…
Four Acuna is very friendly, patient, courteous and very knowledgeable.
I needed managed IT for my remote business, and these guys had the best deal I could find and a free cybersecurity audit! Thank you ACS.
Four is kind, helpful and solution oriented. I appreciate the patient and non-judgmental way I've been treated as a less tech-savvy person. Thank you Four!
As someone working in healthcare, protecting patient information is non-negotiable. Atlantic Computer Systems has been outstanding: knowledgeable, responsive, and always ahead o…
Atlantic Computer Systems has been fantastic to work with. Their team is knowledgeable, responsive, and always quick to help when issues come up.
Huge shoutout to an amazing IT team! Reliable, responsive, and always ready to help, no matter how big or small the issue. They keep everything running smoothly behind the scenes.
Our healthcare agency couldn't be happier with their service. Their team is always professional, responsive, and really understands the challenges of managing sensitive patient…
Four was amazing at helping me get set up! He answered all my questions and guided me so well with getting my access and software. He's always easy to reach and does great with…
Four has been very knowledgeable and available when it comes to technological issues. He always solved the problem and is always professional and kind. Great support team!
Atlantic Computer Systems is wonderful. I've personally interacted with Four and Ed. They are both very knowledgeable and professional. I would highly recommend them to anyone n…
Four Acuna is very friendly, patient, courteous and very knowledgeable.
I needed managed IT for my remote business, and these guys had the best deal I could find and a free cybersecurity audit! Thank you ACS.
Four is kind, helpful and solution oriented. I appreciate the patient and non-judgmental way I've been treated as a less tech-savvy person. Thank you Four!
HIPAA risk analysis: questions, answered
How often do we need a HIPAA risk analysis?
HIPAA does not prescribe a universal annual deadline. The process should be ongoing: review and update the analysis when you introduce technology, change operations or ownership, experience a security incident, or face new threats. Many practices choose an annual review cadence, but that alone does not replace updates after material changes.
What is the difference between a risk analysis and a risk assessment?
The terms are often used interchangeably. The Security Rule calls the required work a risk analysis. What matters is that it accurately and thoroughly documents where ePHI lives, the threats and vulnerabilities, current safeguards, likelihood, impact and risk levels, then feeds risk management. We deliver both the analysis and the remediation plan.
Do small and solo practices really need one?
Yes. The Security Rule applies to covered entities and business associates regardless of size. The way you conduct the analysis and the safeguards that are reasonable and appropriate can reflect your size and complexity, but a small practice still needs to assess and document risks to all of its ePHI.
Isn't the free government SRA Tool enough?
The HHS SRA Tool can help small and medium-sized practices work through the required elements, but a completed questionnaire does not by itself prove that your analysis is accurate and thorough. You still need to validate your actual ePHI inventory, systems, vendors, safeguards and risks, document the results, and follow through on remediation. See the HHS guidance and SRA Tool resources.
What does a risk analysis cost, and how long does it take?
Both depend on the size of your practice and the number of systems in scope; there is no universal price or turnaround. Book a free 30-minute scope call to identify the work, confirm your expected delivery window and receive a flat quote before the paid engagement begins. See our pricing model for how we work.
Scope your documented HIPAA risk analysis.
Start with a free 30-minute scope call. Review the six deliverables, confirm your delivery window and get a flat quote before authorizing the paid work.
Remote-first · nationwide · audit-ready documentation
How we work with you
Real specialists who know your environment, remote-first and onsite when it matters.
Your own pod (larger clients)
A dedicated team that learns your whole environment.
A named account manager
Everyone else gets one Technical Account Manager as a direct point of contact who owns your account.
Remote-first response
Most support, monitoring, and projects are handled remotely, so you are not waiting on a truck roll.
Onsite when it matters
Our own team comes to you for hands-on work and projects as needed.