The HIPAA Security Rule requires a risk analysis. Many facilities have a dusty document from years ago and assume they are covered. They are not. A risk assessment is meant to be a living picture of where protected health information lives, how it flows, and where it is exposed.
It starts with where PHI actually lives
You cannot protect what you have not mapped. A proper assessment inventories every place resident data is created, stored, or transmitted: the EHR, workstations, mobile devices, email, backups, faxes, and any third-party vendor with access.
What reviewers and insurers expect to see
- A current inventory of systems and the PHI they touch.
- Documented technical safeguards: encryption, access controls, and multi-factor authentication.
- Evidence of monitoring and how you detect and respond to incidents.
- Staff security awareness training records.
- A prioritized remediation plan with owners and dates, not just a list of problems.
The single most common gap we find is not a missing firewall. It is missing documentation of the safeguards a facility already has. If it is not written down, at survey time it did not happen.
Turning it into an ongoing program
A risk assessment is not an annual event you survive and forget. The strongest facilities revisit it whenever they add a system, change a vendor, or renew cyber-insurance. That cadence turns compliance from a scramble into a routine, and it means you are never caught explaining a gap you already knew about.
Done right, the assessment becomes your evidence file: the thing you hand a surveyor or insurer that answers their questions before they finish asking.