A HIPAA risk assessment template you can copy into a spreadsheet today, the scoring scale to use with it, and a filled-in example for a 20 person company that handles patient data.
A HIPAA risk assessment template is a structured register that records, for every system holding electronic protected health information (ePHI), the threats and vulnerabilities it faces, the safeguards already in place, a likelihood and impact score, the resulting risk level, and the action, owner and due date that will reduce it. The HIPAA Security Rule requires this analysis at 45 CFR 164.308(a)(1)(ii)(A) for every covered entity and every business associate. A usable HIPAA risk assessment template has nine sections, and the worked example below shows them filled in.
A HIPAA risk assessment template should cover the nine elements the US Department of Health and Human Services (HHS) lists in its Guidance on Risk Analysis, because those elements are what the HHS Office for Civil Rights (OCR) looks for when it asks to see a risk analysis. HIPAA prescribes no format, scoring scale or tool, only an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI.
| Template section | What to record | Example entry |
|---|---|---|
| 1. Scope | Every system, device and vendor that creates, receives, maintains or transmits ePHI | Production database, support inbox, staff laptops, backup storage, email vendor |
| 2. Data collection | Where ePHI lives and flows, and how you found out | Data flow diagram dated 6 October 2026, interviews with engineering and support |
| 3. Threats and vulnerabilities | Each reasonably anticipated threat paired with the weakness it would exploit | Stolen admin credentials, exploiting no MFA on the cloud root account |
| 4. Current security measures | Safeguards already in place, and whether they are actually configured and used | Single sign-on with MFA for all staff accounts |
| 5. Likelihood | Score from 1 to 3 against a written definition | 2 |
| 6. Impact | Score from 1 to 3 against a written definition | 3 |
| 7. Risk level | Likelihood multiplied by impact, then banded | 6, High |
| 8. Documentation | The written analysis, versioned, approved and dated | Version 1.0, approved by the CEO on 19 October 2026 |
| 9. Review and update | The next review date and the events that trigger an early one | October 2027, or sooner for any new system holding ePHI |
A HIPAA risk assessment template that stops at the risk level is incomplete. The Security Rule makes risk management a separate required implementation specification at 45 CFR 164.308(a)(1)(ii)(B), and OCR enforcement actions frequently cite a missing risk management plan alongside a missing risk analysis. Every row in the register therefore needs a treatment, an owner and a due date. The Security Rule also requires the documentation to be kept for six years from the date it was created or last in effect, whichever is later, under 45 CFR 164.316(b)(2).
A completed HIPAA risk assessment is a risk register with one row per risk, not one row per system. The example below is illustrative: a fictional 20 person SaaS company that is a business associate of several clinics and stores patient records in a cloud database. Copy the columns into a spreadsheet and replace the rows with your own.
| System holding ePHI | Threat and vulnerability | Existing safeguard | L | I | Risk | Treatment, owner, due date |
|---|---|---|---|---|---|---|
| Production database | Account takeover; no MFA on the cloud root account | SSO with MFA for staff accounts | 2 | 3 | 6 High | Hardware key MFA on root, alert on any root login. CTO, 30 days |
| Backups | Ransomware; backups sit in the same account and can be deleted | Daily snapshots | 2 | 3 | 6 High | Immutable copies in a separate account, quarterly restore test. CTO, 30 days |
| Support inbox | Misdirected or over-shared email; customers send screenshots containing PHI | Annual HIPAA training | 3 | 2 | 6 High | Secure upload link, auto-delete attachments after 30 days. Support lead, 30 days |
| Staff laptops | Loss or theft; disk encryption unverified on 3 of 20 devices | Device management installed | 2 | 2 | 4 Medium | Enforce encryption by policy, monthly compliance report. IT lead, 90 days |
| Audit logs | Undetected misuse; logs kept 30 days and never reviewed | Cloud audit logging on | 2 | 2 | 4 Medium | Keep 12 months, monthly access review. CTO, 90 days |
| Email vendor | Vendor breach; no business associate agreement signed | Vendor security page reviewed | 1 | 3 | 3 Medium | Sign a BAA or stop sending PHI through the vendor. CEO, 90 days |
That prioritised list, with named owners and dates, is the risk management plan the Security Rule requires.
HIPAA does not mandate a scoring method for a risk assessment, so a simple three point scale is defensible as long as each point is defined in writing and applied the same way to every risk. The definitions below are a starting point for a small organisation.
| Score | Likelihood means | Impact means |
|---|---|---|
| 1 Low | Not expected in the next 12 months, and strong safeguards are in place | A handful of records, harm unlikely, contained within a day |
| 2 Medium | Could plausibly happen in the next 12 months, safeguards are partial | Fewer than 500 individuals, or a short loss of access to ePHI |
| 3 High | Expected in the next 12 months, or has happened before | 500 or more individuals, the threshold for notifying HHS within 60 days, or a prolonged loss of access |
Multiply likelihood by impact for a risk score from 1 to 9. A suggested banding: 1 to 2 is Low (accept and monitor), 3 to 4 is Medium (treat within 90 days), and 6 to 9 is High (treat within 30 days). These targets are a convention, not a HIPAA rule.
A HIPAA risk assessment for a 5 to 50 person organisation usually takes one competent person 20 to 40 hours on a first pass, which is a CertAssist planning estimate rather than a published figure. The steps follow the template sections in order:
The NIST SP 800-66 Revision 2 HIPAA Security Rule guide walks through the same process in more depth.
A HIPAA breach risk assessment is not the same as a HIPAA security risk assessment. The security risk assessment is the forward-looking analysis on this page. The breach risk assessment is an incident-specific test under the Breach Notification Rule, used after an impermissible use or disclosure of PHI to decide whether notification is required. That test weighs four factors: the nature and extent of the PHI involved, the unauthorised person who used or received it, whether the PHI was actually acquired or viewed, and the extent to which the risk has been mitigated. Keep the breach assessment as a separate form, and feed its lessons back into the security risk register.
The right way to complete a HIPAA risk assessment depends on how many systems hold ePHI and whether someone in-house can judge security controls. Any of the four options below can produce a compliant risk analysis, and none certifies anything, because there is no official HIPAA certification.
| Option | Cost (October 2026) | Best fit | Limitation |
|---|---|---|---|
| HHS Security Risk Assessment (SRA) Tool, version 3.7 | Free | Small and medium healthcare providers | Windows desktop app or Excel workbook; HealthIT.gov says it may not suit larger organisations |
| Spreadsheet template, as on this page | Free, plus 20 to 40 hours of staff time (estimate) | Business associates and small covered entities with a capable owner | Evidence and remediation tracking live elsewhere |
| Consultant-led risk analysis | About US$2,000 for a small single location organisation; US$20,000 and above for a large multi location one (Compliancy Group, published) | Teams without in-house security judgement | A point-in-time document unless you pay for updates |
| Compliance platform | CertAssist: US$225 per month on the current launch offer (normally US$375). Vanta and Drata do not publish list pricing | Organisations running HIPAA alongside SOC 2 or ISO 27001 | You still perform the analysis; software organises it |
CertAssist covers the HIPAA Security Rule safeguards plus key Privacy and Breach Notification obligations, with editable policy and evidence templates. CertAssist does not connect to your systems, so it holds no access to the accounts your risk register describes. For a full cost picture beyond the risk analysis, see how much HIPAA compliance costs.
A HIPAA risk assessment template is not enough when the number of systems holding ePHI outgrows what one person can track by hand, typically a hospital, a multi-site group or a platform with hundreds of integrations. Those organisations need automated asset discovery and continuous configuration monitoring, which CertAssist deliberately does not offer. A template is also no substitute for an independent assessment when a customer contract demands one, such as a SOC 2 report or HITRUST certification. No template or platform makes an organisation HIPAA compliant: the treatments still have to be implemented.
Is a HIPAA risk assessment mandatory?
Yes. A HIPAA risk analysis is a required implementation specification under 45 CFR 164.308(a)(1)(ii)(A), so every covered entity and every business associate that handles electronic protected health information must perform one. It is not an addressable item that can be documented away. HIPAA does not require a particular tool or template, only an accurate and thorough written assessment.
How often should a HIPAA risk assessment be done?
The current HIPAA Security Rule does not set a fixed frequency for a risk assessment. HHS guidance expects it to be ongoing and updated when systems or operations change, and most organisations review it every 12 months. The January 2025 proposed Security Rule update would make a review at least every 12 months mandatory, but as of October 2026 that rule has not been finalised.
How much does a HIPAA risk assessment cost?
A HIPAA risk assessment costs nothing in fees if you use the free HHS SRA Tool or a template, but a first pass usually takes 20 to 40 hours of internal time. Compliancy Group publishes about US$2,000 for a consultant-led risk analysis at a small single location organisation and US$20,000 or more for a large multi location one.
What is a HIPAA risk assessment tool?
A HIPAA risk assessment tool is software or a structured workbook that walks you through identifying threats to ePHI, scoring them and recording a plan. The best known is the free Security Risk Assessment Tool from ONC and the HHS Office for Civil Rights, version 3.7 as of October 2026. HealthIT.gov states that using it is neither required by nor a guarantee of HIPAA compliance.
What is HIPAA risk analysis?
HIPAA risk analysis is the Security Rule's name for a risk assessment: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. The two terms are used interchangeably in practice. A different process, the four factor breach risk assessment, decides whether an incident is a notifiable breach.
CertAssist lays out every HIPAA safeguard, gives you editable policy and evidence templates, and lets your auditor or assessor review it all in one place, for US$225 a month on the current launch offer.
See pricing FrameworksFlat $225 a month, or $2,475 a year (12 months for the price of 11). All prices in USD.
