If your practice handles patient information, there’s one HIPAA document that matters more than almost any other: a written security risk analysis. It’s the foundation of the HIPAA Security Rule, and it’s often one of the first things federal investigators look for after a breach.
Recent enforcement makes the point clearly. This post explains what OCR’s recent actions show, what an adequate risk analysis includes, and the steps an independent healthcare or behavioral health practice in Iowa can take now.
What Recent Enforcement Shows
The HHS Office for Civil Rights (OCR) enforces HIPAA, and in recent years it has focused heavily on ransomware breaches and missing risk analyses. OCR even runs a dedicated Risk Analysis Initiative aimed at this specific requirement.
In April 2026, OCR announced four settlements tied to ransomware investigations. One involved a self-funded employer health plan that paid $245,000. In June 2026, a second employer health plan settled for $450,000. In both cases, OCR found the organization had not conducted an accurate and thorough risk analysis of the risks to its electronic protected health information.
Those two cases involved employer health plans rather than medical practices, but the lesson applies to any covered entity. A ransomware attack often starts the investigation, and a missing or inadequate risk analysis frequently becomes a central finding. Organization size doesn’t change the requirement. OCR’s Risk Analysis Initiative has included settlements with small providers as well as large ones.
What the Rule Requires
Under the HIPAA Security Rule (45 CFR 164.308(a)(1)), covered entities must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic protected health information they hold. They must then implement measures to reduce those risks to a reasonable and appropriate level.
In plain terms, you need to know where patient information lives, what could go wrong, how likely and how serious each risk is, and what you’re doing about it. And you need it in writing.
What a Solid Risk Analysis Includes
A risk analysis isn’t a checklist of software you own or a copy of your policies. A credible one generally covers these areas.
Where Patient Information Lives
Start with a complete inventory of every place electronic health information is created, received, stored, or sent. That usually includes your electronic health record system, practice management and billing software, email, cloud file storage, backups, laptops, phones, and any remote access tools. Map how data moves between them, not just where it sits.
Threats and Vulnerabilities
For each system, identify realistic threats, such as ransomware, phishing, lost or stolen devices, and unauthorized access. Then identify the weaknesses that could let those threats succeed: missing updates, weak passwords, accounts without multi-factor authentication, or former employees who still have access.
Likelihood and Impact
Rate how likely each scenario is and how much harm it would cause. That rating is what turns a list of concerns into a set of priorities.
Physical and Administrative Safeguards
Risk isn’t only technical. Consider who can walk into areas with workstations, how devices are disposed of, how staff are trained, and whether written procedures actually match what happens day to day.
A Written Report
The result should be a documented report covering scope, method, identified risks, ratings, and recommended actions. That document is your evidence.
Common Gaps
Many practices believe they’re covered when they aren’t. The most common problems include:
- A risk analysis that only covers computers and network equipment, with no mapping of where patient data actually flows
- A document completed once, years ago, that has never been updated
- A generic template with the practice’s name added but no real findings
- No risk management plan showing what was done about the risks identified
Steps Your Practice Can Take Now
1. Find your current risk analysis. If you can’t locate a written analysis that reflects your current systems, treat that as your top compliance priority.
2. Build your inventory. List every system and device that touches patient information, including personal phones staff use for work.
3. Assess and rate your risks. Document threats, vulnerabilities, likelihood, and impact for each system.
4. Create a risk management plan. Assign each significant risk a response, an owner, and a target timeframe. The analysis alone isn’t enough; OCR expects to see what you did with it.
5. Keep it current. Update the analysis when something meaningful changes, such as a new EHR, a move to cloud services, new locations, or significant staffing changes. HHS also offers a free security risk assessment tool designed for small and mid-sized providers, which can be a useful starting framework.
Making It Part of How the Practice Runs
A risk analysis works best when it drives real decisions. Your update schedule, access controls, backup strategy, and staff training should all connect back to the risks you identified. When that connection exists, the document stops being paperwork and becomes a practical plan for protecting your patients and your practice.
For practices without a compliance officer or internal IT staff, keeping up with this can feel like a lot. CyberCore Technologies conducts HIPAA security risk analyses and helps practices build and maintain documented compliance programs as part of our Compliance service tier, working with healthcare and behavioral health practices across Des Moines and central Iowa. If you’d like to understand where your practice stands, we offer a free assessment and are happy to talk whenever it’s convenient for you.
This post is general information, not legal advice. For questions about your specific obligations, consult your attorney.
