Review HIPAA safeguard questions, then plan the follow-up.

What a HIPAA risk assessment actually is

A HIPAA risk assessment, often called a security risk analysis, is the structured process of finding where electronic protected health information could be exposed and deciding what to do about it. It is not optional and it is not paperwork for its own sake. The Security Rule requires it directly at 45 CFR 164.308(a)(1)(ii)(A), which requires covered entities and business associates subject to the Security Rule to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI they hold. That analysis informs the organization's safeguard and risk-management decisions.

The tool above is a fast way to take that idea and turn it into a concrete baseline. It asks about cited safeguards, summarizes your self-reported answers, and shows which items need follow-up. It cannot identify all assets, threats, vulnerabilities, likelihoods, or impacts in your environment, so it does not replace the written, organization-wide risk analysis the rule requires. Treat the output as a triage list for the formal analysis, not as a compliance or risk determination.

Why a documented analysis matters

The Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. A written analysis helps the organization connect its asset inventory and threat review to specific risk-management decisions. It also creates a dated record of the scope, assumptions, findings, owners, and remediation work that authorized reviewers can examine later.

There is a practical reason too. You cannot prioritize risks you have not identified. Examples may include an unencrypted laptop, a former worker's active account, a business associate relationship without the required agreement, or an untested backup. A formal analysis evaluates those facts in context. The checklist percentage above simply helps organize the first questions.

The administrative safeguards

Administrative safeguards are the policies, processes, and people side of HIPAA security. They begin with the risk analysis and risk management process at 164.308(a)(1), which require the organization to assess and reduce risks. They include a security awareness and training program at 164.308(a)(5), assignment of a security official at 164.308(a)(2), workforce access management at 164.308(a)(3) and (a)(4), business associate arrangements at 164.308(b), and contingency planning at 164.308(a)(7).

A weak answer in this category can point to different work. Naming a security official, reviewing access, documenting business associate arrangements, training the workforce, and testing contingency procedures each address a different requirement. Assign owners and evidence to each applicable item instead of treating one completed task as a substitute for the rest.

The physical safeguards

Physical safeguards govern the tangible world: who can physically reach the systems and records that hold ePHI, how workstations are used, and how devices and media are handled over their lifecycle. Facility access controls at 164.310(a) cover locks, badges, and visitor logs for server rooms, network closets, and records storage. Workstation use and security at 164.310(b) and (c) cover positioning screens away from public view and locking them when staff step away. Device and media controls at 164.310(d) cover tracking hardware and securely wiping or destroying it before reuse or disposal.

Physical controls address risks that software controls alone cannot resolve. Examples include media disposed of without proper handling, devices that retain ePHI, or unattended workstations visible to unauthorized people. Use answers in this category to investigate facility controls, workstation policies, and device or media procedures in the context of your environment.

The technical safeguards

Technical safeguards are controls built into systems. Access control at 164.312(a) includes the required unique-user-identification specification. Automatic logoff at 164.312(a)(2)(iii) is addressable, so the organization follows the documented process in 164.306(d) to implement it or select an equivalent measure when reasonable and appropriate. Authentication at 164.312(d) requires procedures to verify identity. Multi-factor authentication can be an appropriate risk-based control, but HIPAA does not name it as a universal requirement. Audit controls at 164.312(b) require mechanisms that record and examine activity in systems containing or using ePHI.

Encryption at rest under 164.312(a)(2)(iv) and transmission encryption under 164.312(e)(2)(ii) are addressable specifications. The organization must evaluate each one under 164.306(d), document the decision, and implement an equivalent measure when reasonable and appropriate if it does not implement the specification. For breach purposes, ePHI is treated as unreadable only when the HHS-specified method applies and the key or process needed to decrypt it has not been compromised. Review unique IDs, authentication, encryption, logoff, and audit controls against the documented risks.

Documentation and breach readiness

The Security Rule requires written policies and procedures and retention of required documentation for six years under 164.316. Breach procedures should support notice without unreasonable delay and within the applicable federal outer limit. The Notice of Privacy Practices and access prompts concern covered-entity Privacy Rule duties and can be marked Not applicable when they do not fit the organization's role or circumstances.

HIPAA contains specific documentation duties, and dated records help an organization explain what it did and when. That is why the tool counts documentation as its own safeguard area rather than folding it into the others. If answers need follow-up, identify which actions require written policies, decisions, or completion records and store that evidence where authorized reviewers can retrieve it.

How to read your score

The overall percentage is based only on applicable prompts you answered yes, partly, no, or not sure. Not-applicable answers are excluded. A score at or above eighty percent means your answers identify fewer unresolved prompts, while a score between fifty-five and seventy-nine percent leaves several partial or missing items. A score below fifty-five percent leaves many answers missing or uncertain. None of these bands measures likelihood, impact, overall risk, or compliance. Use the percentage to organize follow-up, then verify scope, evidence, threats, vulnerabilities, and risk in the formal analysis.

The category bars show how your answers are distributed, not where an incident will occur. Read them to find groups with more missing or uncertain answers, then investigate the listed items and document what the formal analysis finds. Because the self-check recalculates instantly, you can revisit it as an organizational aid after remediation.

Turning the assessment into a real risk analysis

The self-check is a starting point, not the finished product the rule requires. To build a documented risk analysis, begin with an inventory of where ePHI is created, received, stored, and transmitted, including systems, devices, vendors, and workflows. A risk analysis that starts from a real inventory is far stronger than one that starts from a form. Then investigate applicable follow-up items by documenting the threat, current control, likelihood, impact, and any resulting risk-management decision.

Next, convert confirmed findings into a tracked remediation plan with an owner and a due date for each item, which is the risk management step at 164.308(a)(1)(ii)(B). Without owners and dates, a list of risks is just awareness, and awareness alone reduces no exposure. Finally, set a documented review cadence based on your environment and revisit the analysis when material changes affect systems, vendors, staffing, or work location. Keep every version dated so reviewers can follow the analysis and remediation history.

Covered entities and business associates both need this

The Security Rule risk-analysis duty applies to covered entities and business associates. Business-associate status depends on the function or service performed, the handling of PHI on behalf of a covered entity or business associate, and the exceptions in 45 CFR 160.103. Organizations that meet the definition have direct Security Rule duties, including the risk-analysis requirement, in addition to applicable contractual obligations.

Organization size, complexity, capabilities, costs, and risks inform reasonable and appropriate safeguard decisions under 164.306(b). The duty to perform the analysis remains, while its scope and supporting inventory reflect the organization's systems and ePHI. Use Not applicable for role-specific Privacy Rule prompts that do not fit, not as a substitute for evaluating Security Rule safeguards.

Common mistakes that weaken an assessment

A few predictable errors make a risk assessment look complete while leaving the organization exposed. The first is scoping too narrowly, assessing the electronic health record but ignoring email, messaging, spreadsheets, personal devices, and the vendors that quietly hold copies of the same data. Risk lives in the places people forget. The second is treating the assessment as a one-time event, filing it, and never revisiting it after new systems, vendors, or remote-work changes reshape the risk picture. A two-year-old analysis often describes an organization that no longer exists.

The third mistake is stopping at awareness. Finding risks and never assigning owners or due dates leaves the risk-management work incomplete. The fourth is confusing a vendor's compliance with your own. A platform being HIPAA-capable does not make your configuration of it compliant, and a signed business associate agreement does not absolve you of your own safeguards. The fifth is keeping no dated evidence, so even genuine diligence cannot be documented later. The tool supports a safeguard-by-safeguard review and turns partial, negative, or uncertain answers into an ordered follow-up list.

Where workforce training fits

The Security Rule requires a security awareness and training program for all workforce members of covered entities and business associates subject to the rule. The Privacy Rule separately requires covered entities to train workforce members on applicable policies and procedures. This tool flags an applicable training answer for follow-up so the organization can assign relevant instruction and retain required records.