A defensible HIPAA risk assessment accounts for where ePHI goes, what can happen to it, why the practice rated that risk as it did, and who owns the next decision. A questionnaire score cannot do that.
Use this sheet to produce decisions
- Follow ePHI across rooms, devices, vendors, and old storage.
- Pair a threat with a real weakness. Do not score labels in isolation.
- Write one likelihood and impact scale before scoring anything.
- Finish with owners, dates, proof of repair, and residual-risk review.
- Reopen the map when technology, people, or operations change.
This is a working template, not a certification or legal opinion. A practice remains responsible for applying the HIPAA Security Rule to its own facts.
Start with a data-flow walk
HHS says the scope covers all ePHI an organisation creates, receives, maintains, or transmits. Its risk-analysis guidance also says the rule does not prescribe one format. That makes the first job discovery, not scoring.
EPHI PATH
Workflow or service: _____________________________________
Information involved: ____________________________________
Created or received at: __________________________________
Stored in: _______________________________________________
Sent to: __________________________________________________
People and roles with access: _____________________________
Vendor or subcontractor: _________________________________
Backup and recovery location: _____________________________
Deletion or exit path: ____________________________________
Evidence checked: _________________________________________Walk one patient journey. Registration may expose a tablet, a web form, front-desk email, an identity document, and a queue display before a clinician opens the chart. Repeat the walk for documentation, billing, records release, backup, and vendor support.
Score pairs, not scary nouns
Writing only ransomware: high tells the repair owner almost nothing. A precise scenario works better: phishing steals a scheduler’s account, and that account can export the full patient list without a second factor. That statement identifies a threat, vulnerability, consequence, and control gap that a team can test.
| Field | Entry |
|---|---|
| Asset or workflow | |
| Threat event | |
| Vulnerability | |
| Existing safeguards | |
| Evidence reviewed | |
| Likelihood and reason | |
| Impact and reason | |
| Result under the written method | |
| Treatment decision | |
| Owner, due date, proof | |
| Residual-risk reviewer and date |
Use definitions your team can repeat. A likely event might mean there is current exposure plus a credible path; another practice may define it differently. The label matters less than writing the rule and applying it consistently.
HHS distinguishes the assessment from risk management: the analysis identifies and evaluates risk, while management implements safeguards to reduce it. The agency’s comparison FAQ notes that system and application inventories can support a thorough analysis. NIST’s HIPAA cybersecurity guide provides a current crosswalk and practical resources, but using it does not turn a generic control list into a practice-specific analysis.
Make the register survive Tuesday
A risk register should show movement over time. Colour alone hides stalled work.
RISK TREATMENT RECORD
Risk ID and version: ______________________________________
Decision: reduce / avoid / transfer / accept
Action: ___________________________________________________
Owner: ____________________________________________________
Due date: _________________________________________________
Completion evidence: ______________________________________
Residual risk: ____________________________________________
Approval and date: ________________________________________
Next review trigger: ______________________________________We think the most revealing test is mundane: ask the owner to produce proof for three closed items. A policy title is not proof that an old account was disabled, a restore worked, or a vendor path was removed.
HHS describes risk analysis as ongoing. It names security incidents, new technology, ownership changes, and turnover among the circumstances that can change the analysis. Keep a scheduled review, but do not wait for it when a new AI tool, cloud service, office, or remote-work pattern changes the data map.
The HIPAA audit-log review helps test activity evidence. The clinic incident-response plan handles a suspected event. Link their findings back to the register so the same weakness does not return under a new ticket number.
Patient Square is an AI clinical platform. Practice Copilot includes ambient documentation, scheduling, messaging, and practice software; hospitals can evaluate Hospital Copilot. Review the current security page and test any vendor’s actual data flow, access evidence, recovery process, and exit path before placing it inside your assessment.