HIPAA requires a security risk analysis. Do you perform it?

The HIPAA Security Rule requires a risk analysis, reviewed and updated periodically, and most practices treat it as annual. It is also the single most commonly cited deficiency when a practice gets examined, usually because it was done once years ago and never revisited.

The technical half is work we do anyway: asset inventory, where protected health information actually lives, access controls, encryption status, patching, backup and recovery, and audit logging. Because we manage the environment, that portion stays current rather than being reconstructed annually.

The other half is administrative and physical and it is genuinely yours: workforce training, sanction policies, your BAAs with other vendors, physical access to the operatories and server, and your own policies and procedures. We help assemble it and tell you where the gaps are.

One honest caveat, the same one we give about evaluating internal staff. We benefit commercially from findings that point at more technology. If you want a risk analysis with no possible appearance of a conflict, hire an assessor who is not your IT provider. We will hand them everything they need and it will cost you less overall than you might expect, because the evidence already exists.