If your organization is a HIPAA covered entity or business associate and creates, receives, keeps or sends electronic patient information, the HIPAA Security Rule requires you to conduct an accurate and thorough risk analysis.
It is the starting point for every safeguard you put in place. There is no small-practice exemption and no fixed schedule, but the analysis has to reflect how your organization actually works today. ALCON DTS helps you complete it, act on what it finds and keep it current.
The HIPAA Security Rule asks you to protect electronic patient information with administrative, physical and technical safeguards. The risk analysis is how you decide which safeguards you need. The rule states it this way:
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.” (45 CFR 164.308(a)(1)(ii)(A))
HHS calls this “the first step in identifying and implementing safeguards that comply with and carry out the standards and implementation specifications in the Security Rule.” The rule does not tell you which method to use. In HHS’s words, “the Security Rule does not prescribe a specific risk analysis methodology,” and “there is no single method or ‘best practice’ that guarantees compliance.” What it does set are the objectives any method must meet, which are listed below. If you want more detail on methods, NIST SP 800-66 Rev. 2 (February 2024) provides practical guidance and resources that regulated entities of all sizes can use to safeguard ePHI.
The risk analysis sits next to a second required step: risk management. Once you know your risks, you must “implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a)” (45 CFR 164.308(a)(1)(ii)(B)). The analysis tells you what to fix; risk management is the fixing.
It covers: electronic protected health information, and all of it. HHS guidance says: “All e-PHI created, received, maintained or transmitted by an organization is subject to the Security Rule.” That includes patient information on a single workstation, on laptops and phones, in email, in file storage, in backups and on portable media, whatever the source or location.
It is not:
The requirement applies to both groups the Security Rule covers:
Quick check: does this apply to you?
If both are true, the risk analysis requirement very likely applies to you. Only health care providers that bill or conduct other standard transactions electronically are covered entities. If you are unsure whether you are a covered entity or business associate, confirm with your attorney.
There is no small-practice exemption. A two-provider clinic has the same duty to complete a risk analysis as a large system. What changes with size is how you meet it. The Security Rule is flexible by design. Under 45 CFR 164.306(b), you may use any security measures that allow you to reasonably and appropriately implement the standards, and you must take into account:
HHS notes that small organizations “tend to have fewer variables (i.e. fewer workforce members and information systems) to consider,” so the right safeguards for a small practice may differ from those for a large one. The analysis still has to cover all of your ePHI.
HHS guidance lists the elements a risk analysis must incorporate, “regardless of the method employed.” The table below follows those elements and shows how each one scales with your size and complexity.
| Element (HHS guidance) | What it asks of you | Smaller, simpler practice | Larger or more complex organization |
|---|---|---|---|
| Scope of the analysis | Consider risks to all ePHI you create, receive, maintain or transmit, in every form of electronic media | A handful of workstations, laptops, phones, email and backups | Multiple locations, networks, systems and outside parties that handle ePHI |
| Data collection | Identify where ePHI is stored, received, maintained or transmitted, and document it | Walk through each device, system and vendor that touches patient information | Interviews, project and documentation reviews across departments and sites |
| Threats and vulnerabilities | Identify and document reasonably anticipated threats and the vulnerabilities they could exploit | Common human, natural and environmental threats to a single office | A broader set of threats unique to each environment and site |
| Current security measures | Assess and document the measures you use, whether required measures are in place and whether they are configured and used properly | Fewer systems to check, often with more direct control | More systems, owners and configurations to verify |
| Likelihood | Estimate how likely each threat and vulnerability combination is, and document it | Estimates for a shorter list of combinations | Estimates across a longer list of combinations |
| Impact | Assess the potential impact of each combination, using a qualitative or quantitative method or both | A qualitative scale is often enough | Qualitative, quantitative or a combination |
| Risk level | Assign a risk level to every combination and produce a list of corrective actions | A short, ranked list of corrective actions | A ranked list of corrective actions by system, site or owner |
| Documentation | Document the risk analysis in any format, and keep it for six years (164.316) | A written report with supporting records | A formal report tied to each area’s records |
| Periodic review and updates | Keep the process ongoing and update it after changes such as a security incident, a change in ownership, turnover in key staff or management, or new technology | Review on a regular cycle you choose and after any change | A regular cycle built into planning for new systems and operations |
| Risk management (164.308(a)(1)(ii)(B)) | Implement security measures that reduce the risks you found to a reasonable and appropriate level | Work through the corrective action list in order of risk | A tracked plan with owners and target dates |
ONC, in collaboration with the HHS Office for Civil Rights (OCR), offers a free Security Risk Assessment (SRA) Tool. It can be a good way to organize your first analysis. Keep two points from the tool’s own page in mind: “The target audience of this tool is medium and small providers; thus, use of this tool may not be appropriate for larger organizations,” and “the SRA Tool survey alone may not identify all risks present in an organization.” Using the tool does not by itself establish compliance. The tool’s own disclaimer says: “Use of this tool is neither required by nor guarantees compliance with federal, state or local laws.”
The Security Rule does not set a schedule. HHS says: “The Security Rule does not specify how frequently to perform risk analysis as part of a comprehensive risk management process.” It adds that some organizations perform these processes annually or as needed, depending on their circumstances. Three parts of the rule shape your review cycle:
A practical approach is to pick a regular review cycle that fits your practice and also revisit the analysis whenever something important changes: a new system, a new location, an incident or a change in leadership.
You keep the legal decisions, we run the controls. We complete the security risk analysis with you, turn what it finds into a work plan, run the safeguards that address it, and keep the records in one evidence file, so you have a clear picture when your attorney, insurer or OCR asks.
| Risk analysis element | What ALCON DTS provides |
|---|---|
| Scope and data collection | A security risk analysis that maps where patient information lives across email, devices, file storage and backups |
| Threats and vulnerabilities | A review of the threats that matter for your practice, including account takeover, business email compromise, ransomware, lost or unmanaged devices and vendor access |
| Current security measures | A review of identity and access, email, devices, backups and vendor access, so you know what is logged, what is backed up and who can restore |
| Likelihood, impact and risk level | A work plan that puts the most important risks first, with a snapshot leadership can use |
| Documentation | An organized evidence file with your risk analysis, business associate agreements, training records and written procedures, plus policies covering HIPAA Security and Omnibus |
| Risk management (164.308(a)(1)(ii)(B)) | Identity and access with multifactor authentication and tight administrator rights; email authentication and mailbox controls; devices kept updated, protected and encrypted; tested backup and recovery; and monitoring that routes alerts to a named owner |
| Workforce training | New-hire and annual HIPAA security training with completion records. Texas Chapter 181 separately requires training on state and federal law for new hires within 90 days (see below) |
| Business associate agreements | A business associate agreement with ALCON DTS wherever our services require one |
| Periodic review and updates | A risk analysis kept current as part of an ongoing relationship, revisited when your systems, locations or staff change |
Your EHR, billing and hospital platforms stay with the vendors who own them. We work alongside them on the systems around them. The exact controls in your environment depend on your ALCON DTS plan and any project work, and we will show you which are in place today and which would close a gap.
A risk analysis from ALCON DTS does not make your organization HIPAA certified, and we do not claim a HIPAA certification. It gives you a documented, current assessment and a plan you can act on.
Want to know where your risk analysis stands? We will look at what you have today, where patient information lives and what would bring the analysis up to date.
Last reviewed: September 30, 2026
This page is general information about the HIPAA Security Rule and related Texas law, not legal advice for your situation.
Not sure when your risk analysis was last updated, or whether it covers every place your patient information lives? We will walk through what you have, show you what is current and give you a clear plan for the rest.
Managed IT, cybersecurity, and compliance for Central Texas since 2001.
© 2026 ALCON DTS.
