Recommended Free Tools
Build a hospital cybersecurity risk assessment as a documented, ongoing HIPAA Security Rule risk analysis: define which electronic protected health information (e-PHI) and supporting operations are in scope, map the systems and dependencies involved, assess credible threats and vulnerabilities, prioritize risks to confidentiality, integrity, and availability, and track corrective actions to completion. The method should fit the health system’s actual environment and clinical operations; HHS does not prescribe a universal template, scoring formula, or reassessment interval.
What the assessment must accomplish
For a health system subject to the HIPAA Security Rule, the required risk analysis must be accurate and thorough enough to assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of e-PHI. It is foundational to selecting and implementing the rule’s security measures. HHS Office for Civil Rights (OCR) guidance emphasizes that an organization should tailor its method to its characteristics and environment rather than follow a one-size-fits-all blueprint.
As an Amazon Associate I earn from qualifying purchases.
In this context, “risk assessment” commonly refers to the Security Rule’s risk analysis. The analysis identifies and evaluates risks; it does not, by itself, reduce them. Risk management is the subsequent work of implementing reasonable and appropriate security measures to reduce identified risks and vulnerabilities. Keep both activities connected in the same governance process, but document them as distinct work: findings and priorities on one side, decisions and implemented safeguards on the other.
Build the assessment in eight steps
1. Establish ownership, scope, and method
Name an accountable executive, an assessment lead, and the people authorized to accept risk or fund corrective work. Include security, privacy, compliance, IT operations, clinical engineering, facilities, procurement, and clinical leadership; involve other teams when their systems or workflows affect e-PHI or care delivery.
Write down the entity and locations covered, assessment date, method, assumptions, decision authority, and boundaries of the e-PHI environment. Set scope by asking where e-PHI is created, received, maintained, or transmitted and which people, facilities, devices, vendors, applications, and infrastructure support those activities. Do not treat the central EHR as the entire environment simply because it is the most visible clinical system.
2. Inventory assets and dependencies
Identify systems that handle e-PHI directly and supporting services whose failure could affect access to it or essential care operations. For a hospital, consider EHR and ancillary applications, identity services, networks, cloud and hosted services, workstations and mobile endpoints, remote access, backups and recovery, connected medical devices, and business associates. Classify assets by the e-PHI they involve and their role in clinical and administrative workflows.
Healthcare-specific resources from HHS 405(d) emphasize asset management and the breadth of connected devices in healthcare. Use that perspective to look beyond conventional IT inventories: include clinical engineering’s device records and dependencies, and identify who is responsible for maintaining each inventory.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Map e-PHI flows and care dependencies
Document how e-PHI moves among departments, clinicians, facilities, payers, vendors, and other providers. Record the systems and people that create, receive, maintain, or transmit it, and identify important dependencies such as authentication, network connectivity, interfaces, power, and hosted services.
For essential care functions, describe the operational consequences if a supporting system becomes unavailable, produces unreliable information, or exposes information to an unauthorized party. This patient-care and continuity analysis helps the hospital prioritize its own scenarios; it is a practical impact lens, not a separate scoring rule prescribed by HHS.
4. Identify threats and vulnerabilities
Build scenarios that pair credible threats with weaknesses in the assets or processes in scope. HHS examples include inadvertent acts, network-based attacks, malicious software, unauthorized access, floods and storms, long-term power failure, and liquid leakage. Include human, natural, and environmental sources rather than limiting the assessment to cyberattacks.
Look for vulnerabilities such as unpatched or obsolete software, weak access controls, exposed remote access, inadequate recovery arrangements, and weaknesses in third-party or device support. OCR’s January 2026 newsletter explicitly identifies unpatched software risk as something to include in a risk analysis. Useful identification inputs can include vulnerability scans, vendor alerts, participation in an ISAC or ISAO, NIST’s National Vulnerability Database, and CISA’s Known Exploited Vulnerabilities Catalog. These are inputs to the organization’s analysis, not substitutes for evaluating its own environment.
5. Estimate likelihood and impact
For each credible scenario, assess both likelihood and consequences to e-PHI confidentiality, integrity, and availability. State the scale and method used, the evidence considered, and any assumptions or uncertainty. HHS does not prescribe one universal formula or rating scale, so explain how the organization applied its chosen approach consistently.
A hospital may also describe operational and patient-care consequences—such as which functions depend on the affected asset and what happens during disruption—to make prioritization useful to clinical leaders. Keep those local estimates clearly identified as the health system’s assessment, not as regulatory thresholds or externally established facts.
6. Document and prioritize each risk
Maintain a risk register or equivalent record that makes the path from scenario to action auditable. HHS calls for documenting assigned risk levels and corrective actions while leaving the format to the organization. A useful record includes:
- The asset, process, location, and e-PHI involved.
- The threat, vulnerability, and scenario being evaluated.
- Existing safeguards and evidence considered.
- Likelihood, impact, and the resulting risk rating, with the scale defined.
- Inherent and residual ratings if the organization uses those concepts, with their meanings stated.
- An accountable owner, treatment decision, corrective action, target date, and status.
Prioritize by the documented method and governance criteria, not by whether a risk is technically sophisticated or easy to fix. Make sure high-impact clinical dependencies and material e-PHI exposures are visible to the people who can authorize resources and approve risk decisions.
7. Choose and implement risk treatment
For each risk, record whether the organization will mitigate, accept, transfer, or avoid it, subject to its approved governance. A decision to accept risk should identify the decision-maker, rationale, any conditions, and review trigger; it should not silently close a finding. For mitigation, assign concrete work, an owner, and a due date, then track implementation and evidence that the measure is operating.
Best Value
HHS 405(d) healthcare practices and the HHS Cybersecurity Performance Goals can help translate assessment findings into work involving vulnerability and asset management, access management, incident response, data protection, workforce training, and medical-device security. Use them as healthcare-context and prioritization aids alongside the entity-specific analysis, not as replacements for it.
8. Keep the analysis current
Treat risk analysis as ongoing. HHS does not set one fixed reassessment frequency; the appropriate cadence depends on the organization and circumstances. Establish a regular review schedule and update the analysis when meaningful system or technology changes occur, new risks are recognized, material vulnerabilities emerge, an incident changes the risk picture, or the operating environment changes. Record what changed, which scenarios were reconsidered, and whether treatment plans or priorities need revision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use resources without mistaking them for the assessment
- HHS OCR Risk Analysis Guidance: Use it to ground the scope, documentation, tailoring, and ongoing nature of the analysis.
- HHS/ONC Security Risk Assessment Tool: HHS describes this tool as useful for small and medium-sized practices and business associates. A large hospital system may use its prompts, but should not assume the tool alone covers enterprise systems, clinical devices, third parties, or operational dependencies.
- HHS 405(d) Health Industry Cybersecurity Practices (HICP): Use healthcare-sector practices on areas such as asset, access, and vulnerability management, incident response, data protection, device security, and workforce training to inform threat and control coverage.
- HHS Cybersecurity Performance Goals: Use these goals, informed by sector guidance and frameworks, to help prioritize common vulnerabilities and resilience work; they do not replace entity-specific risk analysis.
- ASPR RISC 2.0 Cybersecurity Module: ASPR says the module was added in 2026, scores answers against NIST Cybersecurity Framework 2.0 and HHS Cybersecurity Performance Goals, and can be used as an add-on to RISC or as a standalone assessment. The ASPR description does not establish that completing the module alone satisfies every organization’s HIPAA analysis obligation.
- OCR/NIST HIPAA Security Rule Crosswalk: Use it to compare Security Rule provisions with NIST Cybersecurity Framework outcomes when mapping findings or safeguards.
What a defensible assessment looks like
A completed assessment should let a reviewer follow each important risk from the affected e-PHI or supporting asset through the threat, vulnerability, likelihood and impact reasoning, existing safeguards, priority, accountable owner, and treatment status. It should also make clear what remains unresolved and who approved any risk acceptance. HHS does not require a particular document format, but an undocumented or untracked analysis cannot show that its findings informed risk management.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When comparing assessment methods or tools, judge them by whether they cover e-PHI and its supporting assets; confidentiality, integrity, and availability; threats and vulnerabilities; clinical continuity; third parties and connected medical devices; relevant framework mapping; an evidence trail; repeatability; and outputs that support named owners and prioritized corrective actions. Select a method the organization can apply consistently and maintain as its systems and risks change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
