Overview
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the organization. Risk analysis under §164.308(a)(1)(ii)(A) is the foundational requirement of the Security Rule — it drives all subsequent safeguard decisions. OCR has identified failure to conduct a comprehensive, enterprise-wide risk analysis as the most common finding in breach investigations and compliance reviews. The risk analysis must be ongoing, not a one-time event, and must be updated whenever significant changes occur in the environment or in response to security incidents.
Legal Foundation
Regulatory Text
45 CFR §164.308(a)(1)(ii)(A) — Risk Analysis (Required):
"Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
45 CFR §164.308(a)(1)(ii)(B) — Risk Management (Required):
"Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with §164.306(a)."
OCR Guidance Documents
OCR published "Guidance on Risk Analysis Requirements under the HIPAA Security Rule" (July 14, 2010) establishing nine essential elements that an adequate risk analysis must address. This guidance, while not binding regulation, represents OCR's enforcement expectations and has been consistently applied in settlement agreements and corrective action plans.
OCR Nine Essential Elements
Element 1: Scope of the Analysis
The risk analysis must encompass all ePHI that the organization creates, receives, maintains, or transmits, in every form and location:
Asclepius Health Network Scope Inventory:
| ePHI Location | System/Medium | Data Categories | Volume |
|---|---|---|---|
| Electronic Health Record (Epic) | Production servers, disaster recovery site | Complete clinical records, demographics, insurance | 4.2 million patient records |
| Practice Management System | Cloud-hosted (Azure US East) | Scheduling, billing, referrals | 4.2 million patients |
| Laboratory Information System | On-premises servers | Lab orders, results, specimen tracking | 12 million results annually |
| Radiology PACS | On-premises SAN storage | Diagnostic images, reports | 850 TB imaging data |
| Email System (Exchange Online) | Microsoft 365 tenant | Incidental ePHI in clinical communications | Estimated 15,000 messages/day containing ePHI |
| Mobile Devices | 3,200 organization-owned tablets, 800 BYOD smartphones | Clinical reference, secure messaging, patient photos | Variable |
| Medical Devices | 1,400 networked devices (infusion pumps, monitors, ventilators) | Real-time patient data, device logs | Continuous streaming |
| Paper-to-digital Conversion | Scanning workstations, OCR servers | Scanned historical records, faxed referrals | 2,000 pages/day |
| Business Associate Systems | 47 BA relationships with ePHI access | Varies by BA (billing, transcription, cloud hosting, analytics) | Varies |
| Backup and Archive | Tape library, offsite vault, cloud archive | Complete system backups | 6-year retention |
| Health Information Exchange | Regional HIE platform | ADT feeds, CCD documents, lab results | 150,000 transactions/month |
Element 2: Data Collection
Identify and document where ePHI is stored, received, maintained, or transmitted. Methods include:
- Automated discovery: Network scanning tools identifying systems communicating health data (HL7, FHIR, DICOM traffic analysis)
- Data flow mapping: Documenting how ePHI moves between systems, departments, and external parties
- Workforce interviews: Structured interviews with department managers, clinical informaticists, and IT staff
- System inventory review: Cross-referencing CMDB (Configuration Management Database) with ePHI classification tags
- Vendor assessment questionnaire responses: BA-reported ePHI handling practices
- Physical walkthroughs: Identifying workstations, printers, fax machines, and storage locations processing ePHI
Element 3: Identify and Document Potential Threats and Vulnerabilities
Threat Categories
| Threat Category | Specific Threats | Source |
|---|---|---|
| Natural | Flood, earthquake, tornado, hurricane, wildfire, pandemic | Geographic and climate risk assessment |
| Human — Intentional | Hacking/IT incident, ransomware, phishing, insider theft, social engineering, nation-state APT | FBI IC3 reports, HHS cybersecurity alerts, threat intelligence feeds |
| Human — Unintentional | Misdirected email/fax, lost device, improper disposal, misconfiguration, training failure | Incident history, OCR breach portal patterns |
| Environmental | Power failure, HVAC failure, water damage, fire, electromagnetic interference | Facility assessments, utility reliability data |
| Technical | Software vulnerability, hardware failure, network outage, cryptographic weakness | CVE databases, vendor advisories, penetration test results |
Vulnerability Assessment Methods
- Penetration testing: Annual external and internal penetration test by independent third party
- Vulnerability scanning: Weekly automated scans of all network-connected assets (Qualys, Nessus, or equivalent)
- Configuration auditing: Quarterly review of system configurations against CIS benchmarks
- Social engineering testing: Semi-annual phishing simulations; annual physical penetration attempts
- Application security testing: SAST/DAST scanning of internally developed applications; third-party code review for critical systems
- Wireless security assessment: Quarterly rogue access point scanning; annual wireless penetration test
Element 4: Assess Current Security Measures
Document existing safeguards and their effectiveness:
Asclepius Health Network Current Controls Assessment (Sample):
| Control Area | Implemented Measure | Effectiveness Rating | Gap Identified |
|---|---|---|---|
| Access Control | Role-based access in EHR with unique user IDs | Effective | Quarterly access reviews not consistently completed for all departments |
| Encryption at Rest | AES-256 FDE on servers and endpoints | Effective | 12 legacy medical devices running unencrypted embedded systems |
| Encryption in Transit | TLS 1.2+ enforced on all external connections | Effective | 3 internal legacy interfaces still using TLS 1.0 |
| Audit Logging | Centralized SIEM with 6-year retention | Effective | Log review staffing insufficient for alert volume |
| Backup | Daily incremental, weekly full, offsite replication | Effective | Restore testing frequency needs improvement |
| Physical Security | Badge access, CCTV, visitor management | Partially Effective | Server room access badge list includes 15 individuals who no longer require access |
| Anti-Malware | EDR deployed on all managed endpoints | Effective | Coverage gap on BYOD devices with MDM enrollment below 100% |
| Patch Management | Monthly patch cycle, 14-day critical patch SLA | Partially Effective | Medical device patching delayed by manufacturer certification requirements |
Element 5: Determine the Likelihood of Threat Occurrence
Assign likelihood ratings based on threat capability, motivation, and existing controls:
| Likelihood Level | Definition | Scoring |
|---|---|---|
| Very High | Almost certain to occur within the next year; active exploitation observed | 5 |
| High | Likely to occur; threat source is capable and motivated; controls have known weaknesses | 4 |
| Medium | Possible occurrence; threat source exists and has some capability; controls are partially effective | 3 |
| Low | Unlikely but possible; limited threat capability or motivation; controls are generally effective | 2 |
| Very Low | Remote possibility; no known threat source targeting this vulnerability; strong controls in place | 1 |
Element 6: Determine the Potential Impact of Threat Occurrence
Assess the magnitude of harm if a threat exploits a vulnerability:
| Impact Level | Definition | Examples | Scoring |
|---|---|---|---|
| Critical | Catastrophic harm to individuals or organization | Breach of >500K records, permanent patient harm from data integrity failure, organizational insolvency | 5 |
| High | Significant harm to many individuals or severe organizational impact | Breach of 10K-500K records, extended system outage affecting patient care, OCR investigation | 4 |
| Medium | Moderate harm to limited individuals or substantial operational disruption | Breach of 500-10K records, multi-day system unavailability, significant remediation costs | 3 |
| Low | Limited harm to few individuals or manageable operational impact | Breach of <500 records, brief system disruption, contained incident | 2 |
| Negligible | Minimal or no harm | No ePHI exposure confirmed, minor operational inconvenience | 1 |
Element 7: Determine the Level of Risk
Risk is calculated as the product of likelihood and impact:
Risk Score = Likelihood × Impact
| Risk Score | Risk Level | Action Required |
|---|---|---|
| 20-25 | Critical | Immediate mitigation required; senior leadership notification; consider system suspension |
| 12-19 | High | Mitigation plan required within 30 days; management approval to accept risk |
| 6-11 | Medium | Mitigation plan required within 90 days; documented risk acceptance alternative |
| 2-5 | Low | Monitor and address in normal operations; annual review |
| 1 | Minimal | Accept and document; review at next scheduled risk analysis |
Asclepius Health Network Risk Register (Sample Entries):
| Risk ID | Threat/Vulnerability | Likelihood | Impact | Risk Score | Risk Level |
|---|---|---|---|---|---|
| R-001 | Ransomware attack on clinical systems | 4 (High) | 5 (Critical) | 20 | Critical |
| R-002 | Insider unauthorized access to celebrity patient records | 4 (High) | 3 (Medium) | 12 | High |
| R-003 | Unencrypted legacy medical device data exposure | 3 (Medium) | 4 (High) | 12 | High |
| R-004 | Phishing leading to credential compromise | 4 (High) | 4 (High) | 16 | High |
| R-005 | Lost/stolen unencrypted mobile device | 2 (Low) | 3 (Medium) | 6 | Medium |
| R-006 | Misdirected fax containing ePHI | 3 (Medium) | 2 (Low) | 6 | Medium |
| R-007 | Natural disaster affecting primary data center | 2 (Low) | 5 (Critical) | 10 | Medium |
Element 8: Finalize Documentation
The risk analysis must be documented in sufficient detail to demonstrate:
- The scope covered all ePHI
- Threats and vulnerabilities were comprehensively identified
- Current security measures were evaluated
- Likelihood and impact were assessed using a consistent methodology
- Risk levels were determined
- The analysis was conducted by qualified personnel
Required Documentation Components:
- Date of analysis and date range covered
- Personnel conducting the analysis (names, qualifications)
- Methodology description
- Complete asset inventory with ePHI classification
- Threat and vulnerability catalog
- Current controls inventory
- Risk scoring matrix and ratings
- Risk register with all identified risks
- Executive summary for leadership
Element 9: Periodic Review and Updates
The risk analysis is not a one-time activity. It must be updated:
- At least annually as a scheduled comprehensive review
- When new systems, applications, or technologies are implemented
- When significant changes to the operating environment occur (mergers, relocations, new facilities)
- After a security incident or breach
- When new threats are identified (new malware families, regulatory changes, threat intelligence alerts)
- When OCR or industry guidance identifies new risk areas
Risk Management and Mitigation Planning — §164.308(a)(1)(ii)(B)
For each risk above the organization's acceptable risk threshold, develop and implement a mitigation plan:
Mitigation Plan Template (Risk R-001: Ransomware):
| Element | Detail |
|---|---|
| Risk ID | R-001 |
| Risk Description | Ransomware attack encrypting clinical systems, rendering ePHI unavailable |
| Current Risk Score | 20 (Critical) |
| Mitigation Measures | (1) Deploy advanced EDR with behavioral ransomware detection; (2) Implement network segmentation isolating clinical systems; (3) Maintain immutable backup copies with air-gapped storage; (4) Conduct quarterly tabletop ransomware exercises; (5) Implement application whitelisting on clinical workstations |
| Implementation Timeline | EDR: Complete; Segmentation: 60 days; Immutable backups: 90 days; Tabletop: Quarterly; Whitelisting: 120 days |
| Responsible Party | CISO (overall); Network Engineering (segmentation); Backup Administrator (immutable backups) |
| Target Risk Score | 8 (Medium) — likelihood reduced from 4 to 2 through layered controls |
| Residual Risk Acceptance | Approved by CIO and CPO on documented risk acceptance form |
| Review Date | Next comprehensive review or 90 days post-implementation |
Common OCR Findings
OCR consistently identifies the following deficiencies in risk analyses:
- Not enterprise-wide: Analysis limited to EHR system only, excluding email, mobile devices, medical devices, and BA systems
- Not updated: One-time analysis without periodic review or updates after significant changes
- Not thorough: Failure to identify all ePHI assets, particularly shadow IT, personal devices, and cloud services
- No documentation: Analysis conducted informally without written documentation
- No risk management follow-through: Risks identified but no mitigation plans developed or implemented
- Inadequate methodology: No structured approach to likelihood/impact determination; subjective risk ratings without defined criteria
Enforcement Actions for Risk Analysis Failures
Risk analysis deficiency is cited in the majority of OCR enforcement actions:
- Anthem Inc. (2018): $16 million — failed to conduct enterprise-wide risk analysis prior to breach affecting 78.8 million
- Premera Blue Cross (2020): $6.85 million — risk analysis failed to identify risks across the enterprise; did not assess all systems with ePHI
- Banner Health (2023): $1.25 million — risk analysis was not accurate and thorough; did not identify all risks to ePHI
- CHSPSC LLC (2020): $2.3 million — failed to conduct accurate risk analysis and implement risk management measures
- University of Massachusetts Amherst (2020): $650,000 — failure to conduct risk analysis of ePHI maintained by research programs
- Metro Community Provider Network (2017): $400,000 — risk analysis not conducted to sufficient depth
Integration Points
- hipaa-security-rule: Risk analysis drives implementation decisions for all technical, administrative, and physical safeguards
- hipaa-breach-notify: Post-breach risk analysis updates feed into breach risk assessment under §164.402
- hipaa-baa-management: Risk analysis must include ePHI held by or accessible to business associates
- hipaa-privacy-rule: Privacy risk assessments complement security risk analysis for comprehensive PHI protection