HIPAA Security Risk Analysis Guides

Reference guides for small practices working on their HIPAA Security Risk Analysis. Every article is source-grounded against HHS, OCR, eCFR, and NIST publications — no marketing claims, no fabricated stats.

Try the free 5-question readiness check →See pricing →

Administrative Safeguards

HIPAA Contingency Plan for a Small Practice

What the Security Rule contingency plan standard at 45 CFR 164.308(a)(7) actually requires, including data backup, disaster recovery, emergency mode operation, and testing — for a small practice.

Audits and Enforcement

Change Healthcare Ransomware: What Small Practices Took Away

The February 2024 Change Healthcare cyberattack, what HHS and UnitedHealth Group disclosed, and the small-practice lessons about clearinghouse concentration risk, contingency planning, and the Security Rule's information system activity review.

The HIPAA Breach Notification Rule, Explained

The four-factor risk assessment at 45 CFR 164.402, the 60-day individual notice clock at 164.404, the HHS/media notice paths, and the small-practice annual report under 164.408(c).

HIPAA Settlements and Civil Money Penalties: A Small-Practice Reading List

How HHS Office for Civil Rights publishes its enforcement record, the tiered civil money penalty structure at 45 CFR 160.404, and what recent small-practice settlements actually say.

What to Do If You Get an OCR Audit Letter

A step-by-step response framework for a small practice that receives an OCR HIPAA audit or investigation letter, drawn from OCR's audit protocol and published Resolution Agreements.

OCR Audit Protocol: What Small Practices Should Expect

How the HHS Office for Civil Rights HIPAA Audit Protocol is structured, what OCR has publicly announced about the audit program restart, and how a small practice prepares its binder against the protocol's audited elements.

By Specialty

HIPAA Risk Analysis for a Dental Practice

How a small dental practice approaches the HIPAA Security Risk Analysis required by 45 CFR 164.308(a)(1)(ii)(A), with practical scope, ePHI flows, and Security Rule references.

HIPAA Risk Analysis for a Mental Health Practice

What therapists, psychologists, and psychiatry practices need in a HIPAA Security Risk Analysis, including the psychotherapy notes carve-out at 45 CFR 164.501 and 164.508(a)(2).

HIPAA Risk Analysis for a Physical Therapy Practice

What an outpatient physical therapy clinic owes under 45 CFR 164.308(a)(1)(ii)(A), with the ePHI workflows specific to PT, OT, and rehab settings.

HIPAA Risk Analysis for a Primary Care Practice

What a primary care practice owes under 45 CFR 164.308(a)(1)(ii)(A): ePHI scope, threats specific to family medicine and internal medicine workflows, and a Security Rule mapping that holds up to OCR's audit protocol.

Foundations

CMS Promoting Interoperability and the Security Risk Analysis Attestation

How the CMS Promoting Interoperability program (formerly Meaningful Use) requires a HIPAA Security Risk Analysis for each EHR reporting period, what the attestation actually claims, and how CMS audits it after the fact.

HIPAA Policies and Procedures: What a Small Practice Actually Needs

What 45 CFR 164.316 and 164.530(i) require for HIPAA policies and procedures, the minimum set a small practice should maintain, and how to keep them current without bloat.

HIPAA Security Rule vs Privacy Rule: A Plain-English Map

What the Security Rule at 45 CFR Part 164 Subpart C does, what the Privacy Rule at Subpart E does, where they overlap, and which rule the SRA actually answers to.

How Often Should a Practice Conduct a HIPAA Risk Analysis?

What 45 CFR 164.308(a)(8) requires for periodic evaluation, what HHS guidance says about cadence, and the practical pattern most small practices land on.

Privacy Rule

HIPAA Patient Right of Access: A Small-Practice Walkthrough

How 45 CFR 164.524 governs patient access to their records, the 30-day rule and 30-day extension, the limited fees a practice may charge, and the OCR Right of Access Initiative.

Technical Safeguards

HIPAA Encryption Requirements for ePHI

What the Security Rule actually says about encryption at 45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii), the safe harbor under the Breach Notification Rule, and what 'addressable' means in practice.

Does HIPAA Require MFA? What the Security Rule Actually Says

Whether multi-factor authentication is required by the HIPAA Security Rule, how 45 CFR 164.312(d) frames person or entity authentication, and how HHS guidance and the proposed Security Rule update push toward MFA in practice.

Tooling

The HHS SRA Tool vs Paid HIPAA Risk Analysis Options

What the free HHS/ONC Security Risk Assessment Tool actually does, where it stops, and how to evaluate paid alternatives without overpaying for what the free tool already covers.

HIPAA Risk Analysis Cost: What Small Practices Actually Pay

What a small practice can realistically expect to spend on a HIPAA Security Risk Analysis: the free HHS tool, paid software ranges, and consultant engagements, with the buyer questions that prevent overpaying.

Vendors and BAAs

BAA Vendor List: Which Vendors a Small Practice Needs to Sign With

A working list of the vendor categories a small practice typically needs a Business Associate Agreement with under 45 CFR 164.504(e), plus how to handle subcontractor chains.

Practice Management and EHR Vendors: Which Offer a BAA

How a small practice identifies whether its practice management and EHR vendors offer a Business Associate Agreement, what to look for, and how the BAA fits into the broader vendor inventory required by the Security Rule.

Workforce and Training

HIPAA Training Requirements for a Small Practice

What 45 CFR 164.530(b) and 164.308(a)(5) require for HIPAA workforce training, plus a realistic cadence and documentation approach for a small practice.