A HIPAA Security Rule risk analysis is the accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI) held by a covered entity or business associate, as 45 CFR 164.308(a)(1)(ii)(A) requires. Risk management, paragraph (B), is implementing security measures sufficient to reduce them to a reasonable and appropriate level to comply with 164.306(a). Integral Healthcare Solutions (IHS) drafts the method, worksheets, risk register, remediation plan and supporting policies with your security official, for organizations with no documented analysis or one that is out of date.
Your security official adopts the documents and your IT staff or vendor supplies the technical findings. IHS does not take possession of ePHI, so do not send it. IHS is a consulting firm, not a law firm, and this page is not legal advice.
Last updated: November 2026
What is a HIPAA Security Rule risk analysis and risk management program?
It is the work behind two implementation specifications that 164.308(a)(1)(ii) labels Required, both inside the security management process standard. A covered entity or business associate must comply with the applicable standards, implementation specifications and requirements of the subpart with respect to the ePHI of a covered entity (164.302). We read the eCFR text as of October 29, 2026, the latest amendment date for title 45; pages opened November 2, 2026: 164.308, 164.306 and 164.316. The paragraphs ask the following.
| Paragraph | What it asks of a covered entity or business associate |
|---|---|
| 164.308(a)(1)(ii)(A) Risk analysis (Required) | Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. |
| (a)(1)(ii)(B) Risk management (Required) | Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 164.306(a). |
| (a)(2) Assigned security responsibility | Identify the security official who is responsible for the development and implementation of the policies and procedures required by the subpart for the covered entity or business associate. |
| (a)(8) Evaluation | Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which the entity's security policies and procedures meet the requirements of the subpart. |
Takeaway: the analysis assesses and the management step acts. In IHS's reading, a register that lists risks but records no measures taken leaves paragraph (B) without evidence.
Paragraph (B) points to 164.306(a), whose four general requirements include ensuring the confidentiality, integrity, and availability of all ePHI the entity creates, receives, maintains, or transmits and protecting against any reasonably anticipated threats or hazards to its security or integrity. Paragraph (A) says ePHI "held by" the entity, so IHS builds the inventory to the longer "creates, receives, maintains, or transmits" list. That is IHS practice, not a rule.
What does Required versus Addressable mean?
The word Required or Addressable appears in parentheses after each specification title (164.306(d)(1)). A Required specification must be implemented. For an Addressable one, the entity must assess whether it is a reasonable and appropriate safeguard in its environment, analyzed with reference to its likely contribution to protecting ePHI, and then, as applicable, implement it if reasonable and appropriate or, if not, document why and implement an equivalent alternative measure if reasonable and appropriate (164.306(d)(2) and (d)(3)). In IHS's reading, Addressable does not mean optional.
| Standard in 164.308 | Required | Addressable |
|---|---|---|
| (a)(1) Security management process | Risk analysis; risk management; sanction policy; information system activity review | None |
| (a)(3) Workforce security | None | Authorization and/or supervision; workforce clearance procedure; termination procedures |
| (a)(4) Information access management | Isolating health care clearinghouse functions (applies if a clearinghouse is part of a larger organization) | Access authorization; access establishment and modification |
| (a)(5) Security awareness and training | None | Security reminders; protection from malicious software; log-in monitoring; password management |
| (a)(6) Security incident procedures | Response and reporting | None |
| (a)(7) Contingency plan | Data backup plan; disaster recovery plan; emergency mode operation plan | Testing and revision procedures; applications and data criticality analysis |
| (b)(3) Business associate arrangements | Written contract or other arrangement | None |
Takeaway: this table covers 164.308 only; we did not open 164.310, 164.312 or 164.314.
Who needs it, and what triggers an update?
Any covered entity or business associate whose ePHI falls under 164.302; whether you are one is a question for your counsel. Paragraph (A) makes no exception by size, and 164.306(b)(2)(i) makes size one factor in choosing measures.
The text ties review to environmental or operational changes affecting the security of ePHI ((a)(8); 164.316(b)(2)(iii), which says to review documentation periodically and update it as needed) and to continued reasonable and appropriate protection (164.306(e)).
How often? The sections we opened use the words "periodic," "periodically" and "regularly" and give no number of months or years for how often to analyze or update. IHS does not tell clients that these sections require an annual analysis. Documentation required by 164.316(b)(1) is kept for 6 years from the date of its creation or the date when it last was in effect, whichever is later (164.316(b)(2)(i)).
Is a new HIPAA Security Rule in effect?
No, according to the sources we checked on November 2, 2026. HHS published a proposed rule on January 6, 2025 (90 FR 898, RIN 0945-AA22) to solicit comment on a proposal to modify the Security Rule. A proposal is not law. A Federal Register search by that RIN returned no final rule, and the eCFR source notes for 164.302, 164.306, 164.308 and 164.316 show a last amendment of January 25, 2013. This page does not summarize the proposal. Page opened November 2, 2026: Federal Register, 2024-30983.
How IHS helps
IHS works in five steps: a gap assessment of your documents against each paragraph above; the scope statement, inventory and threat worksheets; the risk register and remediation plan; drafts of the supporting policies, contingency plan outlines and evaluation calendar; and a readiness review of the finished documentation file.
The assessment is your obligation. You supply the security official, system and vendor lists, descriptions of how information moves, your IT staff or vendor's technical findings, and counsel. IHS works from documents and descriptions, never from patient records or logs that contain ePHI.
The real limit: IHS does not scan, penetration-test, configure or monitor systems, decide that a risk is acceptable, or communicate with any regulator for you. IHS drafts; you adopt and run it. IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC; this program is part of its compliance services line.
What to have ready
- The name of the person who will serve as security official (paragraph (a)(2)).
- A list of systems, devices, applications, locations and vendors that create, receive, maintain or transmit ePHI (paragraph (A); 164.306(a)(1)).
- Any earlier risk analysis, with its date and author (paragraphs (A) and (a)(8)).
- Existing security policies, however informal, and when each last changed (164.316(a)).
- Technical findings your IT staff or vendor already has, such as patch, access and scan reports, with patient data removed (164.306(b)(2)(ii)).
- Backup, recovery and emergency-mode procedures and any test records (paragraph (a)(7)).
- Your business associates and the contract or other arrangement for each (paragraph (b)).
- Records of security incidents and their outcomes, training materials and attendance, and any sanctions applied (paragraphs (a)(6)(ii), (a)(5)(i) and (a)(1)(ii)(C)).
If you want to start, the introductory call is free and is where IHS learns what you already have.
How it compares
Other routes are an in-house effort led by your security official and IT staff, a technical security firm that performs scanning and testing, and software that organizes risk records. IHS does not tell you which to choose. Certification programs are separate undertakings; our Security Compliance Foundations (HITRUST) page covers a certification effort, not the 164.308 documentation set. Related builds: HIPAA Privacy Rule compliance program, breach notification and business associate management.
What does a HIPAA Security Rule risk analysis program cost?
Government fees: the five sections we opened (164.302, 164.304, 164.306, 164.308 and 164.316) attach no fee to conducting a risk analysis or adopting a program. Consulting fees: IHS does not publish a price for this work and scopes each engagement after a free introductory call. Your own staff time: your security official and IT staff explain each system and review each draft.
What this is not
- It is not legal advice. IHS is a consulting firm, not a law firm.
- It is not a technical test. IHS does not scan, penetration-test, configure or monitor systems.
- It is not a guarantee about how any regulator will view your analysis, and IHS does not communicate with a regulator for you.
Frequently asked questions
What is a HIPAA Security Rule risk analysis?
It is the accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate (45 CFR 164.308(a)(1)(ii)(A), labeled Required). Integral Healthcare Solutions (IHS) drafts the method and documents with your security official, who adopts them.
What is the difference between the risk analysis and risk management?
They are separate Required specifications. Paragraph (A) asks for the assessment. Paragraph (B) asks the entity to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with 164.306(a).
Is a vulnerability scan or penetration test the same as a risk analysis?
The sections we opened do not use the words scan or penetration test and name no methodology. In IHS's reading, a scan result is one input to the assessment that paragraph (A) describes. Your IT staff or vendor runs scans and tests; IHS does not.
How often must the risk analysis be updated?
The sections we opened give no number of months or years for how often to update. Paragraph (a)(8) asks for a periodic evaluation, based initially upon the standards implemented and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, and 164.316(b)(2)(iii) says to review documentation periodically and update it as needed in response to such changes. IHS does not tell clients that these sections require an annual analysis.
What does addressable mean in the Security Rule?
For an Addressable specification, the entity must assess whether it is a reasonable and appropriate safeguard in its environment and, as applicable, implement it if so or, if not, document why and implement an equivalent alternative measure if reasonable and appropriate (164.306(d)(3)). In IHS's reading, the assessment is not optional.
Does the Security Rule apply to business associates?
Yes. 164.302 and the opening of 164.308(a) address a covered entity or business associate. Under paragraph (b)(1), a covered entity may permit a business associate to create, receive, maintain, or transmit ePHI on its behalf only if it obtains satisfactory assurances, in accordance with 164.314(a), that the business associate will appropriately safeguard the information; it is not required to obtain such assurances from a business associate that is a subcontractor.
Does the risk analysis have to be in writing, and how long is it kept?
Paragraph 164.316(b)(1)(ii) requires a written (which may be electronic) record of an action, activity or assessment if the subpart requires it to be documented; whether your analysis falls under that condition is a question for your counsel. Documentation required by (b)(1) is kept for 6 years from the date of its creation or the date when it last was in effect, whichever is later.
Does IHS see our ePHI, do the technical work or give legal advice?
No to all three. IHS drafts from your description of your systems, vendors and workflows and does not take possession of ePHI, so do not send it. Your IT staff or vendor does the scanning, testing, configuration and monitoring, and your security official adopts every document. IHS is a consulting firm, not a law firm, and does not communicate with a regulator for you.