HIPAA Security Risk Assessment Checklist 2026

Section 1: Five HIPAA Security Safeguard Areas

The HIPAA Security Rule organizes its requirements across five distinct areas, each addressing a different dimension of PHI protection. The SRA must evaluate an organization's controls across all five areas to be considered complete by OCR standards.

It is important to understand the distinction between "required" and "addressable" implementation specifications within the Security Rule. Required specifications must be implemented exactly as described. Addressable specifications must be implemented if reasonable and appropriate — if not, the covered entity must document why and implement an equivalent alternative measure. "Addressable" does not mean optional; it means context-dependent. Encryption, for example, is an addressable specification, but OCR's guidance makes clear that it is expected in almost all circumstances.

Section 2: Who Must Comply with HIPAA

HIPAA's reach extends well beyond hospitals and physician offices. The Security Rule applies to all covered entities and their business associates — and business associates must ensure their own subcontractors who handle PHI are also bound by equivalent protections through downstream BAAs.

Section 3: Common HIPAA Security Violations

HHS OCR publishes enforcement statistics and resolution agreements that provide a clear picture of the most common compliance failures. Understanding these patterns allows organizations to prioritize their SRA efforts on the areas most likely to attract regulatory attention — and most likely to cause actual PHI harm.

Access Control Failures

The §164.312(a)(1) requirement for access controls is one of the most technically nuanced areas of the Security Rule. Failures include: shared login credentials among staff, no automatic logoff after inactivity, no audit trail showing who accessed specific PHI records, excessive access privileges beyond what clinical or operational roles require, and insufficient termination procedures that allow former employees to retain access. Workforce access management directly intersects with §164.308(a)(3), the workforce clearance procedure implementation specification.

Encryption Gaps

While encryption is an "addressable" specification, OCR enforcement data makes clear that organizations routinely face significant penalties for unencrypted PHI — particularly on laptops, mobile devices, and portable media. §164.312(a)(2)(iv) addresses encryption and decryption of PHI at rest; §164.312(e)(2)(ii) covers PHI in transit. Device theft and loss involving unencrypted PHI triggers breach notification requirements and is one of the most common root causes of HHS Wall of Shame entries.

Workforce Training Deficiencies

§164.308(a)(5) requires security awareness and training programs that cover topics including phishing recognition, password management, PHI handling procedures, and reporting procedures for suspected violations. Regulators look not just for evidence that training was conducted, but that it is periodic (at least annual for most organizations), role-appropriate, and that completion is documented with records retained.

Contingency Planning Gaps

The contingency plan requirements (§164.308(a)(7)) are often overlooked until a ransomware attack forces the issue. Required elements include a data backup plan, disaster recovery plan, emergency mode operation plan, testing and revision procedures, and applications and data criticality analysis. Many organizations have backup procedures but lack documented emergency operation procedures, criticality analysis, or evidence that contingency plans have been tested.

Section 4: HIPAA Security Risk Assessment Checklist

This 12-point checklist covers the foundational elements that OCR reviewers evaluate during HIPAA investigations. Organizations that can produce written evidence for each item are significantly better positioned to demonstrate a good faith compliance program, which is a key factor in penalty mitigation under the tiered civil money penalty structure.

• ▪
  PHI Inventory Complete — Comprehensive inventory of all locations where PHI exists: electronic health records, billing systems, email, file shares, cloud storage, backup media, and portable devices. Data flow map showing how PHI moves through and out of the organization, including third-party systems.
• ▪
  Risk Analysis Documented — Formal risk analysis under §164.308(a)(1)(ii)(A) identifying potential threats to PHI confidentiality, integrity, and availability. Likelihood and impact assessed for each threat. Current controls evaluated. Residual risk documented. Analysis dated, versioned, and signed off by responsible party.
• ▪
  Risk Management Plan in Place — Written plan implementing security measures sufficient to reduce identified risks to a reasonable and appropriate level per §164.308(a)(1)(ii)(B). Risk management plan updated when risks change, and reviewed at least annually.
• ▪
  Access Control Policies Implemented — Written policies governing unique user identification, emergency access procedures, automatic logoff, and encryption/decryption. Technical controls enforcing least-privilege access to PHI. Role-based access review process documented.
• ▪
  Workforce Training Records Maintained — Annual security awareness training conducted and completion records retained. Training covers phishing, password security, PHI handling, incident reporting, and sanctions. New employee training conducted before access to PHI is granted.
• ▪
  Audit Log Review Process Established — Audit logging enabled on all systems containing PHI per §164.312(b). Process for regular review of audit logs documented and practiced. Audit records protected from modification and retained per organizational policy (minimum 6 years for most documentation).
• ▪
  PHI Encrypted in Transit and at Rest — Encryption deployed for PHI transmitted over networks (email, APIs, remote access) and for PHI stored on portable devices, mobile devices, laptops, and backup media. Addressable specification documentation completed for any non-encrypted data flows, with compensating controls documented.
• ▪
  Breach Notification Procedure Documented — Written breach notification policy and procedure per §§164.400-414. Four-factor risk assessment process defined. Notification timelines clear (60 days to individuals and HHS; immediate media notification for 500+ individual breaches in a state/jurisdiction). Breach log maintained.
• ▪
  Business Continuity and Contingency Plan — Data backup plan, disaster recovery plan, and emergency mode operation plan per §164.308(a)(7). Contingency plans tested within the past 12 months. Testing results documented. Critical systems and applications prioritized in criticality analysis.
• ▪
  Business Associate Agreement Inventory — Complete inventory of all business associates (vendors, contractors, service providers) who handle PHI on behalf of the organization. Current, executed BAA in place for each BA, including cloud service providers. BAA terms reviewed against current HHS model language.
• ▪
  Workstation Use Policies Documented — Written workstation use and workstation security policies per §§164.310(b) and (c). Policies cover screen lock requirements, physical positioning of screens, authorized applications, remote access rules, and personal device use restrictions in clinical or administrative environments.
• ▪
  Physical Access Controls Implemented — Facility access control program per §164.310(a). Visitor access logs, badge access system, visitor escort procedures, and workstation security controls. Hardware disposal procedures ensuring PHI is unrecoverable from decommissioned devices per §164.310(d).

Section 5: SRA Methodology

OCR's guidance on conducting a Security Risk Analysis identifies a structured eight-step process. The HHS SRA Tool (available from HealthIT.gov) provides a structured interview format suitable for small to medium practices. Larger organizations typically require a more comprehensive methodology using dedicated risk management frameworks such as NIST SP 800-30 or NIST SP 800-66r2, which provides specific guidance on applying NIST risk management to HIPAA compliance.

SRA Frequency and Update Triggers

The Security Rule does not specify a mandatory frequency for the risk analysis, but OCR guidance and enforcement actions consistently indicate that annual reviews are the accepted baseline. Beyond annual review, the SRA must be updated when significant environmental or operational changes occur: adoption of new technology (particularly EHR systems, cloud platforms, or telehealth solutions), mergers and acquisitions, significant workforce changes, new business lines involving PHI, and following any security incident or breach that identified previously unrecognized vulnerabilities.

Documentation Retention

HIPAA Security Rule documentation — including risk analyses, risk management plans, policies, training records, and BAAs — must be retained for six years from the date of creation or the date it was last in effect, whichever is later. This means your 2022 SRA should be accessible and reviewable by OCR investigators through at least 2028. Electronic retention with version control and access logging is considered best practice.

Tabletop Exercises and HIPAA Contingency Planning

The contingency plan testing requirement (§164.308(a)(7)(ii)(D)) does not specify tabletop exercises by name, but HHS guidance acknowledges testing and revision as core requirements. Healthcare organizations that conduct structured tabletop exercises simulating ransomware attacks against PHI systems, medical device compromises, and insider threat scenarios are building documented evidence of contingency plan testing that directly supports HIPAA compliance — and are simultaneously building the muscle memory their teams need to respond effectively in real incidents.

Skyhigh Cybersecurity's platform includes healthcare-specific tabletop scenarios addressing hospital BMS compromises, medical device network attacks, and health system ransomware response — all with built-in After Action Report generation that produces audit-ready documentation for HIPAA contingency plan testing records.