HIPAA Security Risk Assessment
for San Diego Medical & Dental Practices
Required by federal law for every covered entity. Most medical and dental practices have never completed one. That is an OCR audit waiting to happen.
If You Handle Patient Data, This Is Required
The HIPAA Security Rule requires every covered entity to conduct a thorough assessment of the potential risks and vulnerabilities to patient health information. This is not optional.
Medical Practices
Physicians, specialists, urgent care clinics, and multi-provider groups that store or transmit electronic patient records.
Dental Offices
Dental practices using digital X-rays, EHR platforms, or any software that stores patient health information.
Mental Health Providers
Therapists, psychiatrists, and counseling practices where confidentiality and PHI protection are especially critical.
Business Associates
Billing companies, IT vendors, and other organizations that handle PHI on behalf of a covered entity.
What Happens If You Do Not Have One
The HHS Office for Civil Rights (OCR) requires a documented Security Risk Assessment as part of every HIPAA audit. Practices without one can face findings of non-compliance. Fines range from $145 to $73,011 per violation for the lower tiers, and from $73,011 up to $2,190,294 per violation for willful neglect that is not corrected. The calendar-year cap is $2,190,294 per violation type (Title 45 of the Code of Federal Regulations, section 160.404; Federal Register, 91 FR 3665, January 28, 2026).
Beyond fines, a breach without a documented SRA on file removes your ability to demonstrate good-faith compliance efforts, which is one of the primary factors OCR uses to determine penalty severity.
What It Costs When It Goes Wrong
The HHS Office for Civil Rights (OCR) has settled these cases with practices and providers after breaches, and in nearly every case OCR found that the risk analysis was missing or incomplete.
| Organization | Year | Amount paid | What OCR found | Ransomware |
|---|---|---|---|---|
| Top of the World Ranch Treatment Center | 2026 | $103,000 | No accurate and thorough risk analysis. | No (phishing) |
| Regional Women’s Health Group (Axia Women’s Health) | 2026 | $320,000 | No accurate and thorough risk analysis. | Yes |
| Assured Imaging | 2026 | $375,000 | No risk analysis, late breach notice, and an impermissible disclosure. | Yes |
| Syracuse ASC | 2025 | $250,000 | Never completed a risk analysis, and notified late. | Yes |
| Comprehensive Neurology PC | 2025 | $25,000 | Failure to complete a risk analysis. | Yes |
| Northeast Surgical Group | 2025 | $10,000 | No compliant risk analysis. | Yes |
| Cascade Eye and Skin Centers | 2024 | $250,000 | No compliant risk analysis, and inadequate activity monitoring. | Yes |
| Green Ridge Behavioral Health | 2024 | $40,000 | Failure to complete a risk analysis. | Yes |
This table lists settlements announced by HHS. Amounts are what each organization agreed to pay, and most settlements also carry a two- or three-year corrective action plan.
What prevention costs here
Free HIPAA Evidence Binder
The documents to keep under each Security Rule safeguard, with a starter tracker in Excel.
Get the free binderHIPAA Evidence Binder Kit
Editable policies, plans, forms, and a risk analysis workbook for small practices.
See the kitProfessional HIPAA Security Risk Analysis
For a practice with 1 to 5 providers.
See the pricingSources
- HHS Office for Civil Rights: Top of the World Ranch Treatment Center settlement
- HHS Office for Civil Rights: four ransomware investigations settled (Regional Women’s Health Group and Assured Imaging)
- HHS Office for Civil Rights: Syracuse ASC resolution agreement and corrective action plan
- HHS Office for Civil Rights: Comprehensive Neurology PC resolution agreement and corrective action plan
- HHS Office for Civil Rights: Northeast Surgical Group ransomware settlement
- HHS Office for Civil Rights: Cascade Eye and Skin Centers ransomware settlement
- HHS Office for Civil Rights: Green Ridge Behavioral Health ransomware settlement
- Penalty amounts: Title 45 of the Code of Federal Regulations, section 160.404; Federal Register, volume 91, page 3665 (91 FR 3665), January 28, 2026.
How the Assessment Works
A structured five-phase process that follows NIST SP 800-66 and HHS SRA Tool methodology. You receive a complete written report at the end.
Discovery Call
Free 30-minute call to understand your practice size, systems in use, and current compliance posture.
PHI Inventory
Identify every location where patient health information is created, stored, received, or transmitted.
Staff Interviews
Structured interviews with the practice owner, office manager, and IT contact to assess current controls.
Technical Review
Review of your EHR configuration, access controls, encryption, audit logs, and vendor agreements.
Written Report
Delivery of a complete written Security Risk Assessment with prioritized remediation recommendations.
What the Assessment Covers
The HIPAA Security Rule organizes requirements into three categories. Every category is assessed and documented.
Administrative Safeguards
- Security officer designation
- Workforce training and awareness
- Access management policies
- Security incident procedures
- Contingency and disaster recovery plan
- Business Associate Agreement review
- Periodic evaluations and audits
Physical Safeguards
- Facility access controls
- Workstation use policies
- Workstation physical security
- Device and media disposal
- Server and equipment room access
- Visitor and maintenance logging
- Mobile device controls
Technical Safeguards
- Unique user ID and authentication
- Automatic logoff configuration
- Encryption of data at rest and in transit
- Audit log review and retention
- EHR access control configuration
- Email and transmission security
- Backup and recovery verification
Your Deliverables
Every engagement produces a complete written record. These documents support the HIPAA requirement and serve as your evidence of compliance in the event of an audit or breach investigation.
Written Security Risk Assessment
A formal document covering all three safeguard categories, each identified risk, its likelihood and impact, and your current controls. This is the document OCR asks for in every audit.
PHI Inventory
A documented inventory of every system, device, and location where protected health information exists in your practice.
Risk Register
A prioritized list of every identified vulnerability and threat, rated by likelihood and impact, so you know exactly what to fix first.
Remediation Roadmap
Plain-language recommendations for each identified gap, organized by priority. Written for practice owners, not IT professionals.
Findings Debrief Call
A 60-minute call to walk through every finding, answer questions, and confirm you understand your next steps before we close the engagement.
30-Day Follow-Up
A check-in 30 days after delivery to answer implementation questions and confirm remediation progress on high-priority items.
Flat Fee. No Surprises.
Enterprise compliance firms charge several times what a small or mid-size practice can reasonably afford for the same assessment. Every engagement is scoped and quoted to fit your practice, with no hourly billing and no surprises.
Small Practice
1 to 5 providers · Single location
- Complete HIPAA Security Risk Assessment
- PHI inventory documentation
- All three safeguard categories reviewed
- Written report with risk register
- Prioritized remediation roadmap
- 60-minute findings debrief call
- 30-day follow-up check-in
Mid-Size Practice
6 to 15 providers · Single location
- Everything in Small Practice
- Expanded staff interview process
- Department-level access control review
- Multi-system PHI flow mapping
- BAA gap analysis for all vendors
- 60-minute findings debrief call
- 30-day follow-up check-in
Complex or Multi-Location
Multiple locations or complex IT environments
- Everything in Mid-Size Practice
- Multi-location PHI inventory
- Site-specific risk documentation
- Scoped to your actual environment
- Estimated hours provided before start
- No-surprise billing
- 30-day follow-up check-in
Frequently Asked Questions
Is the Security Risk Assessment actually required by law?
Yes. 45 CFR § 164.308(a)(1) requires covered entities to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. It is one of the most commonly cited findings in OCR audits and breach investigations.
How often does it need to be done?
The HIPAA Security Rule does not specify an exact interval, but HHS guidance requires that the assessment be conducted periodically and whenever operations, technology, or the environment change significantly. In practice, annual completion is the standard most compliance programs follow.
We already use a HIPAA-compliant EHR. Are we covered?
No. Your EHR vendor being HIPAA-compliant does not transfer compliance to your practice. You are independently responsible for how your staff uses that system, who has access, how devices are secured, and how patient data moves within and outside your office. The Security Risk Assessment covers all of that.
What if the assessment finds serious problems?
That is exactly what the assessment is for. Identified problems are documented with plain-language explanations and prioritized by risk level. I will walk you through every finding on the debrief call. Remediation recommendations are practical and written for practice owners, not IT staff. Many issues can be resolved without significant expense.
How long does the process take?
For a small practice, the full process from kickoff to report delivery typically takes two to three weeks. This includes the PHI inventory, staff interviews, technical review, and report writing. Complex or multi-location engagements may take longer and will be scoped before work begins.
Is this the same as a HIPAA privacy audit?
No. This is a Security Risk Assessment focused on the HIPAA Security Rule, which governs electronic protected health information. It does not cover the HIPAA Privacy Rule in full. If you need a comprehensive privacy and security review, contact me and we can discuss a broader engagement scope.
Ready to Get Compliant?
Start with a free 30-minute consultation. I will answer your questions, assess your situation, and tell you exactly what the engagement would involve before you commit to anything.
Start with the Free Scoping Form
Under five minutes. Thabiti reviews every submission personally and replies within 1 business day with a tailored next-step plan. Your information is never sold or shared.
Thanks. Submission received.
Thabiti will review your HIPAA scoping submission and follow up within 1 business day with a tailored next-step plan.