Security risk analysis

HIPAA explicitly requires a risk analysis, and it's the document solo practices most often lack. It takes an afternoon. Replace the example rows with what you actually use, and where something is a gap, say so and give it a date: an analysis with no gaps isn't credible.

Year: [Year] Covered entity: [Practice Name] Conducted by: [Your Name, credentials] (owner / sole workforce member) Date conducted: [Date] Next scheduled review: [Date, ~12 months out] and on any material change to systems Basis: HIPAA Security Rule, 45 CFR §§164.308–164.316

1. Practice overview

Solo private practice, fully out-of-network; clients pay directly.
Licensed in [Washington / Rhode Island]; [telehealth only / in-person and telehealth].
Workforce: one (the owner). No employees or contractors with access to protected health information (PHI).
No outsourced billing, transcription, or admin staff.

2. What counts as electronic PHI (ePHI) here

Client demographics and contact information
Appointment records and schedules
Session notes, treatment plans, intake forms, and assessments
Billing records: invoices, payments, and superbills (including diagnosis codes)
Communications with clients: secure messages, any email, and voicemail

Volume: approximately [N] active clients.

3. System inventory

Every system that stores, touches, or could touch client information, including the boring ones. The last column records whether the vendor has signed a business associate agreement (BAA); vendors and business associate agreements covers which vendors will.

#	System	Role	ePHI?	BAA?
1	Example: SimplePractice	Electronic health record (EHR): records, scheduling, billing, messaging, and telehealth	Yes (primary)	Yes: click-through, in force on account creation
2	Example: Google Workspace (paid plan)	Email, calendar, and drive	Incidental	Yes: accepted in Admin Console
3	Example: Work laptop	Workstation	Only via browser sessions; no local storage by policy	N/A (device)
4	Example: Phone	Calls, EHR app, and email app	Via apps	N/A (device); apps covered above
5	Example: Calendly	Consultation scheduling	Minimal: prospect name, email, and phone	No: vendor doesn't sign BAAs. Risk-accepted with minimum-necessary limit
6	Example: Business bank	Receives payments	Minimal: payer names	N/A: financial data
7	Example: Bookkeeping (QuickBooks / spreadsheet / other)	Books	None by policy (no client names in memos)	N/A with no-PHI rule
8	Example: iCloud / personal cloud	Device sync and contacts	Limited: first name, last initial, and phone in contacts only	No BAA available. Risk-accepted; no clinical files
9	Paper	Records	[None (fully paperless) / describe]	N/A

Action items from the inventory: [e.g. confirm BAA on file for #1 and #2; write the risk-acceptance note for #5 and #8.]

4. Administrative safeguards (§164.308)

Requirement	Current state	Gap / action
Security management process	This document is the risk analysis.	Review annually.
Assigned security responsibility	Owner is Security Official.	Named in Policies & Procedures.
Workforce security	N/A: no workforce.	Revisit before any hire/contractor.
Information access management	Owner has sole access to all systems.	Documented.
Security awareness & training	[Date of last training / scheduled date]	Log completion in Process Log.
Security incident procedures	Breach procedure in Policies & Procedures.	None
Contingency plan	EHR vendor handles backup and disaster recovery under BAA; outage steps in Policies & Procedures.	None
Evaluation	This document.	Annually and on change.
Business associate contracts	[List in force; list risk-accepted vendors]	[Any missing?]

5. Physical safeguards (§164.310)

Requirement	Current state	Gap / action
Facility access	[e.g. Home office; door locked when unattended; home locked when empty. Household has access to the house but not to devices.]
Workstation use	[Devices are sole-use; no shared accounts.]
Workstation security	[Disk encryption on; auto-lock ≤ 5 minutes; phone passcode and biometric.]	Verify encryption is actually on. Don't assume.
Device & media controls	[Factory erase before disposal, logged. No USB/external storage for PHI. Backups are vendor-managed.]

6. Technical safeguards (§164.312)

Requirement	Current state	Gap / action
Access control	Unique accounts; vendor encryption at rest; auto-logoff defaults.
Audit controls	EHR and email audit logs exist.	Set a spot-check cadence (e.g. quarterly).
Integrity	Vendor version history / restore.
Authentication	Multi-factor authentication (MFA) verified on [EHR, email, device account, bank, and password manager] on [date].
Transmission security	PHI only via EHR portal or BAA-covered email.	Put "please use the portal" language in onboarding.

7. Risk register

Likelihood and impact: Low / Medium / High. Residual = after current controls.

#	Risk	Likelihood	Impact	Current control	Residual	Remediation
R1	Laptop lost or stolen	Low	High	Disk encryption, auto-lock, MFA, and remote wipe	Low	Verify at each annual review
R2	Clinical PHI saved somewhere unapproved (desktop, personal cloud)	Medium	Medium	No-local-PHI policy	Low if followed	Periodic spot-check of Downloads/Desktop
R3	PHI sent by plain email or text	Medium	Medium	Portal-only policy	Low	Onboarding language; redirect clients who email
R4	Vendor breach (EHR, email)	Low	High	BAAs, vendor security programs	Low	Watch vendor breach notices
R5	Phishing → account takeover	Medium	High	MFA everywhere, password manager	Low	Annual training
R6	Phone lost or stolen	Low	High	Passcode, remote wipe, and app-level logins	Low	Confirm remote wipe is on
R7	Old device disposed without erasure	Low	High	Written erase-and-log procedure	Low	Follow at next upgrade
R8	Family member uses a work device	Low	Medium	Sole-use policy, separate accounts	Low	None
R9	[Your own, e.g. PHI pasted into an AI tool without a BAA]			[AI policy]

8. Findings

With no workforce, most administrative safeguards are "owner-only" or "N/A." Write that down, because a blank looks like a gap.
The main residual risks are endpoints (laptop and phone), controlled by encryption, MFA, and remote wipe if verified.
Vendors without BAAs are the most common real gap: get the BAA, keep PHI out, or document a minimum-necessary risk acceptance.

9. Open items before sign-off

Disk encryption verified on every device
MFA verified on EHR, email, device account, bank, and password manager
BAAs on file (or risk acceptance written) for every vendor in §3
Physical security described
Device disposal procedure written
Paper records policy decided
First annual training scheduled

Template shared in the Private Practice Toolkit. Not legal, tax, clinical, or compliance advice. The U.S. Department of Health and Human Services (HHS) also publishes a free Security Risk Assessment (SRA) Tool at healthit.gov if you prefer a guided questionnaire.