A HIPAA risk assessment, formally the Security Risk Analysis required under the HIPAA Security Rule, is a documented review identifying every location electronic protected health information is created, received, maintained, or transmitted, along with the specific threats and vulnerabilities that could compromise its confidentiality, integrity, or availability.

It covers practice management software, imaging systems, email, cloud storage, backup systems, and any device or vendor that touches patient data — producing a written record of findings and a remediation plan, not just a verbal opinion that "things look fine."

It's required. The HIPAA Security Rule explicitly mandates that covered entities — including healthcare and dental practices — conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. This isn't guidance or a best-practice suggestion; it's one of the specific administrative safeguards the regulation names directly.

A practice that has never conducted or documented one is already out of compliance, independent of whether any breach has ever occurred — the requirement is to assess risk proactively, not just respond after something goes wrong.

A general IT security audit looks at network health, patching, and common vulnerabilities across an environment. A HIPAA risk assessment specifically maps every system touching ePHI, evaluates administrative, physical, and technical safeguards against the Security Rule's requirements, and produces documentation formatted to satisfy a specific regulatory standard.

A practice can have a clean general IT audit and still fail a HIPAA compliance review, simply because the assessment wasn't scoped or documented the way the regulation requires — the two serve different purposes and shouldn't be treated as interchangeable.

A thorough assessment typically covers:

• Every system, application, and device that creates, stores, or transmits ePHI
• Access controls — who can reach patient data, and whether access matches actual job need
• Encryption status of ePHI in transit and at rest
• Physical security of devices and facilities housing patient data
• Vendor and Business Associate relationships that touch ePHI
• Existing policies, training, and incident response readiness

The output is a written report ranking identified risks and a remediation plan — not just a pass/fail summary.

HIPAA doesn't specify an exact interval, but guidance from regulators and most compliance advisors treats it as an ongoing obligation — typically annually at minimum, and whenever a significant change occurs: new software, a new location, a change in EHR vendor, or after any security incident.

A risk assessment performed once and never revisited becomes stale quickly as systems and staff change — regulators generally expect it to be a living process, not a one-time checkbox.

The absence of a documented risk assessment is, by itself, a compliance finding — it doesn't require a breach to occur for it to matter. It's frequently one of the first things investigated following any breach, patient complaint, or routine audit, and its absence has historically been a factor regulators weigh heavily when determining penalties.

Example: A dental practice in the Florida Panhandle underwent a routine payer credentialing review that requested proof of a current HIPAA risk assessment — a document the practice didn't have. Producing one after the fact, under audit pressure, took considerably longer and cost more than having one already on file would have.

The process typically starts with an inventory of every system and workflow touching patient data, followed by interviews with staff about how information actually moves day to day (which often reveals informal workarounds that don't show up in a systems diagram alone). Technical testing evaluates access controls, encryption, and network security, and the findings are compiled into a prioritized, written report.

A good assessment is disruptive to normal operations as little as possible — most of the work happens through documentation review, targeted interviews, and after-hours technical testing rather than pulling staff away from patient care for extended periods.

Cost depends on practice size, number of locations, and how many systems and vendors are in scope. Many practices bundle the initial assessment and its annual refresh into a broader managed IT or compliance relationship rather than paying for it as a standalone one-off engagement each time.

The more relevant comparison is assessment cost versus the cost of remediation under audit pressure, plus potential penalty exposure — proactive assessment is consistently the less expensive path.

Part of a thorough risk assessment is inventorying every vendor that creates, receives, or transmits ePHI on the practice's behalf — cloud storage, billing services, imaging platforms, IT providers — and confirming a signed Business Associate Agreement exists with each one. A vendor handling patient data without a BAA in place is itself a finding the assessment should surface.

This vendor-mapping step is often where practices discover gaps they didn't know existed — a vendor onboarded years ago for a specific project, still holding access, without documentation confirming their handling of patient data meets HIPAA standards.

Multi-provider practices and those with multiple locations face more scrutiny simply due to scale — more systems, more staff, more vendors, more opportunity for a gap to exist. Practices participating in value-based care arrangements or government payer programs often undergo additional compliance review as part of those relationships. Specialty practices handling especially sensitive records (behavioral health, for example) may carry heightened obligations under overlapping federal or state privacy laws.

Example: A multi-location dental group in South Georgia found that each location had grown its own informal IT practices over time — a risk assessment scoped across all locations, rather than treating each as separate, surfaced inconsistencies that a single-location review would have missed entirely.

Look for a provider with direct experience conducting HIPAA-specific risk assessments — not a general IT security review relabeled — who will produce written, prioritized documentation you can produce on request, and who understands how to evaluate vendor and Business Associate relationships as part of the process, not just internal systems.

• Have they performed HIPAA-specific risk assessments before, not just general IT audits?
• Will the output be a written, prioritized report you can produce during an audit?
• Do they evaluate vendor/BAA relationships as part of the scope?
• Will they help you act on the findings, or just hand over a report and leave?