Risk Register
A living document that records identified risks, their likelihood and impact ratings, owners, and remediation status.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Primary sources
- 2
- Workspace handoff
- sra studio →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
Although the HIPAA Security Rule does not name a "risk register," NIST SP 800-30 and SP 800-66 describe it as the operational artifact connecting the SRA to ongoing risk management. Each entry typically captures: asset, threat, vulnerability, likelihood, impact, control, owner, and review date.
How it shows up in your practice
Review the register quarterly. Close completed items with evidence and document the rationale for any accepted residual risk. The register is the artifact you hand an auditor.
Sources
- NIST SP 800-30 — Guide for Conducting Risk Assessmentshttps://csrc.nist.gov/pubs/sp/800/30/r1/final
- NIST SP 800-66 Rev. 2 — HIPAA Security Rule Implementation Guidehttps://csrc.nist.gov/pubs/sp/800/66/r2/final
Maintain your risk register in SRA Studio
Open sra studio →Related terms
- SecuritySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
- SecurityRisk Management PlanThe documented plan that implements security measures sufficient to reduce risks identified in the Security Risk Analysis to a reasonable and appropriate level.
- HIPAA & PrivacyHIPAA Security RuleThe federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryRisk Management PlanThe documented plan that implements security measures sufficient to reduce risks identified in the Security Risk Analysis to a reasonable and appropriate level.
- GlossarySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
- GlossaryHIPAA Security RuleThe federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- GlossaryAdministrative SafeguardsPolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
- ComplianceAnnual HIPAA Training Curriculum (What to Cover + How to Document)A 2026 annual HIPAA training curriculum for small healthcare practices — eight required modules under 45 CFR 164.530(b) and 45 CFR 164.308(a)(5), with documentation templates.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- SRAHIPAA Contingency Plan for a Small PracticeWhat the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.