Security Risk Analysis
SRA
The accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Acronym for
- SRA
- Primary sources
- 4
- Workspace handoff
- sra studio →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
45 CFR 164.308(a)(1)(ii)(A) requires a Security Risk Analysis (SRA) as the foundation of the entire Security Rule. NIST SP 800-66 Rev. 2 and SP 800-30 provide the federal methodology: scope ePHI systems, identify threats and vulnerabilities, assess likelihood and impact, document risks, and feed a risk management plan.
How it shows up in your practice
The SRA is the single most-cited deficiency in OCR enforcement actions. It must be conducted at intervals (at least annually and after significant changes), documented in writing, and used to drive remediation. The HHS / ONC SRA Tool is a free starter, but the documentation burden is on the practice.
Sources
- 45 CFR 164.308 — Administrative safeguardshttps://www.ecfr.gov/current/title-45/section-164.308
- HHS / ONC — Security Risk Assessment Toolhttps://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool
- NIST SP 800-66 Rev. 2 — HIPAA Security Rule Implementation Guidehttps://csrc.nist.gov/pubs/sp/800/66/r2/final
- NIST SP 800-30 — Guide for Conducting Risk Assessmentshttps://csrc.nist.gov/pubs/sp/800/30/r1/final
Run your Security Risk Analysis in SRA Studio
Open sra studio →Related terms
- SecurityRisk Management PlanThe documented plan that implements security measures sufficient to reduce risks identified in the Security Risk Analysis to a reasonable and appropriate level.
- HIPAA & PrivacyHIPAA Security RuleThe federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
- SecurityThreat SourceAny circumstance or event with potential to adversely impact organizational operations, assets, individuals, or the nation through unauthorized access, destruction, disclosure, or modification of information.
- SecurityVulnerability AssessmentThe systematic examination of an information system to determine the adequacy of security measures, identify deficiencies, and provide data from which to predict the effectiveness of proposed security measures.
- SecurityRisk RegisterA living document that records identified risks, their likelihood and impact ratings, owners, and remediation status.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossaryRisk Management PlanThe documented plan that implements security measures sufficient to reduce risks identified in the Security Risk Analysis to a reasonable and appropriate level.
- GlossaryRisk RegisterA living document that records identified risks, their likelihood and impact ratings, owners, and remediation status.
- GlossaryThreat SourceAny circumstance or event with potential to adversely impact organizational operations, assets, individuals, or the nation through unauthorized access, destruction, disclosure, or modification of information.
- GlossaryVulnerability AssessmentThe systematic examination of an information system to determine the adequacy of security measures, identify deficiencies, and provide data from which to predict the effectiveness of proposed security measures.
- GlossaryHIPAA Security RuleThe federal regulation at 45 CFR Part 164 Subpart C that requires safeguards for ePHI.
- ComplianceSecurity Risk Analysis Template (2026): What Auditors Actually WantA 2026 HIPAA Security Risk Analysis template auditors actually read: NIST SP 800-30 scoring, ePHI asset inventory, every required 164.308 field, threat list.
- SRAHIPAA Risk Analysis for a Dental PracticeHow a small dental practice approaches the HIPAA Security Risk Analysis required by 45 CFR 164.308(a)(1)(ii)(A), with practical scope, ePHI flows, and Security Rule references.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.