# Security risk analysis

> **HIPAA explicitly requires a risk analysis, and it's the document solo practices most often lack.** It takes an afternoon. Replace the *example* rows with what you actually use, and where something is a gap, say so and give it a date: an analysis with no gaps isn't credible.

**Year:** [Year]
**Covered entity:** [Practice Name]
**Conducted by:** [Your Name, credentials] (owner / sole workforce member)
**Date conducted:** [Date]
**Next scheduled review:** [Date, ~12 months out] and on any material change to systems
**Basis:** HIPAA Security Rule, 45 CFR §§164.308–164.316

---

## 1. Practice overview

- Solo private practice, fully out-of-network; clients pay directly.
- Licensed in [Washington / Rhode Island]; [telehealth only / in-person and telehealth].
- Workforce: one (the owner). No employees or contractors with access to protected health information (PHI).
- No outsourced billing, transcription, or admin staff.

## 2. What counts as electronic PHI (ePHI) here

- Client demographics and contact information
- Appointment records and schedules
- Session notes, treatment plans, intake forms, and assessments
- Billing records: invoices, payments, and superbills (including diagnosis codes)
- Communications with clients: secure messages, any email, and voicemail

**Volume:** approximately [N] active clients.

## 3. System inventory

Every system that stores, touches, or could touch client information, including the boring ones. The last column records whether the vendor has signed a business associate agreement (BAA); [vendors and business associate agreements](https://toolkit.marcusberley.com/vendor-baa-checklist/) covers which vendors will.

| # | System | Role | ePHI? | BAA? |
|---|---|---|---|---|
| 1 | *Example:* SimplePractice | Electronic health record (EHR): records, scheduling, billing, messaging, and telehealth | Yes (primary) | Yes: click-through, in force on account creation |
| 2 | *Example:* Google Workspace (paid plan) | Email, calendar, and drive | Incidental | Yes: accepted in Admin Console |
| 3 | *Example:* Work laptop | Workstation | Only via browser sessions; no local storage by policy | N/A (device) |
| 4 | *Example:* Phone | Calls, EHR app, and email app | Via apps | N/A (device); apps covered above |
| 5 | *Example:* Calendly | Consultation scheduling | Minimal: prospect name, email, and phone | **No: vendor doesn't sign BAAs.** Risk-accepted with minimum-necessary limit |
| 6 | *Example:* Business bank | Receives payments | Minimal: payer names | N/A: financial data |
| 7 | *Example:* Bookkeeping (QuickBooks / spreadsheet / other) | Books | None by policy (no client names in memos) | N/A with no-PHI rule |
| 8 | *Example:* iCloud / personal cloud | Device sync and contacts | Limited: first name, last initial, and phone in contacts only | **No BAA available.** Risk-accepted; no clinical files |
| 9 | Paper | Records | [None (fully paperless) / describe] | N/A |

**Action items from the inventory:** [e.g. confirm BAA on file for #1 and #2; write the risk-acceptance note for #5 and #8.]

## 4. Administrative safeguards (§164.308)

| Requirement | Current state | Gap / action |
|---|---|---|
| Security management process | This document is the risk analysis. | Review annually. |
| Assigned security responsibility | Owner is Security Official. | Named in Policies & Procedures. |
| Workforce security | N/A: no workforce. | Revisit before any hire/contractor. |
| Information access management | Owner has sole access to all systems. | Documented. |
| Security awareness & training | [Date of last training / scheduled date] | Log completion in Process Log. |
| Security incident procedures | Breach procedure in Policies & Procedures. | None |
| Contingency plan | EHR vendor handles backup and disaster recovery under BAA; outage steps in Policies & Procedures. | None |
| Evaluation | This document. | Annually and on change. |
| Business associate contracts | [List in force; list risk-accepted vendors] | [Any missing?] |

## 5. Physical safeguards (§164.310)

| Requirement | Current state | Gap / action |
|---|---|---|
| Facility access | [e.g. Home office; door locked when unattended; home locked when empty. Household has access to the house but not to devices.] | |
| Workstation use | [Devices are sole-use; no shared accounts.] | |
| Workstation security | [Disk encryption on; auto-lock ≤ 5 minutes; phone passcode and biometric.] | Verify encryption is actually on. Don't assume. |
| Device & media controls | [Factory erase before disposal, logged. No USB/external storage for PHI. Backups are vendor-managed.] | |

## 6. Technical safeguards (§164.312)

| Requirement | Current state | Gap / action |
|---|---|---|
| Access control | Unique accounts; vendor encryption at rest; auto-logoff defaults. | |
| Audit controls | EHR and email audit logs exist. | Set a spot-check cadence (e.g. quarterly). |
| Integrity | Vendor version history / restore. | |
| Authentication | Multi-factor authentication (MFA) verified on [EHR, email, device account, bank, and password manager] on [date]. | |
| Transmission security | PHI only via EHR portal or BAA-covered email. | Put "please use the portal" language in onboarding. |

## 7. Risk register

Likelihood and impact: Low / Medium / High. Residual = after current controls.

| # | Risk | Likelihood | Impact | Current control | Residual | Remediation |
|---|---|---|---|---|---|---|
| R1 | Laptop lost or stolen | Low | High | Disk encryption, auto-lock, MFA, and remote wipe | Low | Verify at each annual review |
| R2 | Clinical PHI saved somewhere unapproved (desktop, personal cloud) | Medium | Medium | No-local-PHI policy | Low if followed | Periodic spot-check of Downloads/Desktop |
| R3 | PHI sent by plain email or text | Medium | Medium | Portal-only policy | Low | Onboarding language; redirect clients who email |
| R4 | Vendor breach (EHR, email) | Low | High | BAAs, vendor security programs | Low | Watch vendor breach notices |
| R5 | Phishing → account takeover | Medium | High | MFA everywhere, password manager | Low | Annual training |
| R6 | Phone lost or stolen | Low | High | Passcode, remote wipe, and app-level logins | Low | Confirm remote wipe is on |
| R7 | Old device disposed without erasure | Low | High | Written erase-and-log procedure | Low | Follow at next upgrade |
| R8 | Family member uses a work device | Low | Medium | Sole-use policy, separate accounts | Low | None |
| R9 | [Your own, e.g. PHI pasted into an AI tool without a BAA] | | | [AI policy] | | |

## 8. Findings

- With no workforce, most administrative safeguards are "owner-only" or "N/A." **Write that down,** because a blank looks like a gap.
- The main residual risks are **endpoints** (laptop and phone), controlled by encryption, MFA, and remote wipe if verified.
- **Vendors without BAAs** are the most common real gap: get the BAA, keep PHI out, or document a minimum-necessary risk acceptance.

## 9. Open items before sign-off

- [ ] Disk encryption verified on every device
- [ ] MFA verified on EHR, email, device account, bank, and password manager
- [ ] BAAs on file (or risk acceptance written) for every vendor in §3
- [ ] Physical security described
- [ ] Device disposal procedure written
- [ ] Paper records policy decided
- [ ] First annual training scheduled

---

*Template shared in the Private Practice Toolkit. Not legal, tax, clinical, or compliance advice. The U.S. Department of Health and Human Services (HHS) also publishes a free Security Risk Assessment (SRA) Tool at healthit.gov if you prefer a guided questionnaire.*