HIPAA risk assessment for small clinics: a plain-English checklist
If your clinic has one HIPAA document, it should be this one. The security risk analysis is required by the HIPAA Security Rule, and it's the document regulators ask for first after a complaint or breach. It's also the one most commonly missing at small practices.
The good news: for a practice with a handful of staff, it isn't a six-month project. It's a structured afternoon.
What a risk analysis is (and isn't)
A risk analysis is a written, honest look at:
- Where your patient data lives (EHR, email, file shares, laptops, phones, backups, paper)
- What could go wrong with it (phishing, ransomware, lost devices, snooping, vendor breaches, fire)
- How likely and how bad each of those would be
- What you're already doing about it, and what you'll do next
It isn't a vendor's marketing scan, an IT invoice, or a checkbox on your EHR contract. Your EHR vendor securing their servers doesn't cover your front desk, your email or your laptops.
The 10-question starting checklist
Answer these honestly. Every "no" or "not sure" is a risk to write down.
| Question | Why it matters |
|---|---|
| Do email, EHR and remote access require multi-factor authentication? | Stolen passwords are the most common way in |
| Are laptops and phones with patient data encrypted? | A lost encrypted laptop is usually not a reportable breach |
| Is at least one backup offline or immutable, and tested in the last 3 months? | Ransomware targets backups first |
| Has every staff member had documented HIPAA training this year? | Required, and your best defense against phishing |
| Is access removed the same day someone leaves? | Former staff accounts are a quiet, common gap |
| Do you have a signed BAA with every vendor that touches PHI? | Required, and you share liability for their mistakes |
| Do screens lock automatically? | Walk-up access at a busy front desk |
| Is guest Wi-Fi separate from clinic computers? | Patients' devices shouldn't share your network |
| Does everyone know who to tell if something goes wrong? | Breach notification clocks start early |
| Are paper records shredded, not trashed? | Dumpster breaches still happen |
How to rate each risk
Keep it simple. For each risk, score likelihood (1–3) and impact (1–3), then multiply. Anything scoring 6 or more goes to the top of your to-do list with an owner and a due date. That to-do list is your risk management plan, the second document HIPAA expects.
How often to do it
At least once a year, and again whenever something significant changes: a new EHR, an office move, adding remote work, or after an incident. Keep every version for six years.
The fastest way to get it done
Our HIPAA Policy & Procedure Kit includes a fill-in-the-blanks Security Risk Analysis worksheet with the common small-clinic threats pre-filled, plus the Risk Management Plan that turns it into an action list. Not sure where you stand yet? Start with the free 12-question risk quiz.
This article is general information, not legal advice.