HIPAA risk assessment software: a HIPAA security risk assessment tool, SRA tool alternative and Security Rule risk analysis platform

A HIPAA risk assessment, more precisely a risk analysis, is the documented process required by 45 CFR 164.308(a)(1)(ii)(A) of identifying risks to the confidentiality, integrity and availability of electronic protected health information. You determine where ePHI lives, what threats and vulnerabilities apply to each place, how likely each is and how bad it would be, and what your current safeguards do about it. OCR's guidance lists nine elements a compliant analysis contains.

Yes. The risk analysis is a required implementation specification under the Security Rule, not an addressable one, which means there is no option to document why you skipped it. It applies to every covered entity and every business associate handling electronic PHI, regardless of size. A solo practice and a health system owe the same requirement; only the scope and effort differ.

The Security Rule does not name an interval. It requires review and update as needed, which OCR interprets through the periodic review element of its guidance. Annual is the working norm and what most auditors and cyber insurers expect, but the real trigger is change: a new system, a new vendor with PHI, a merger, a significant architecture shift or a security incident should each prompt an update rather than waiting for the anniversary.

Anyone competent to do it, including your own staff. HIPAA does not require an external assessor, a certification or a credential, which is a real difference from a SOC 2 audit or a PCI Report on Compliance. What matters is whether the analysis is accurate and thorough and whether it is documented. Organizations hire consultants for expertise, capacity or legal privilege, not because the rule demands it.

In the regulation the operative term is risk analysis, and in everyday use the two words are interchangeable for the same Security Rule exercise. The distinction that genuinely matters is a different one: the Security Rule risk analysis is the ongoing, organization-wide look at risks to ePHI, while the four-factor breach risk assessment under 164.402 is performed after a specific incident to decide whether it must be reported. Different triggers, different scope, same two words.

The Security Risk Assessment Tool is a free application built by ONC with OCR, currently version 3.6.1 released May 28, 2026, available as a Windows program and an Excel workbook. It is genuinely useful and it follows the guidance closely. HHS states it is designed for small and medium providers and may not be appropriate for larger organizations. It also stops at the assessment: it will not track remediation to closure, collect evidence, or keep itself current as your environment changes.

It spans a wide range because the products are not the same shape. The HHS SRA Tool is free. Medcurity publishes a starting figure of $499 a year for a small practice analysis. Complies publishes $79, $199 and $499 a month. Accountable HQ publishes $199 to $799 a month, or $169 to $679 billed annually. Compliancy Group and the multi-framework platforms like Vanta and Drata do not publish figures at all. Consultant engagements are quoted individually.

A template is a reasonable starting structure and a poor finished product. The failure mode is predictable: the template's generic threat list gets kept, the organization's actual architecture never appears, and every row ends up rated medium. OCR's standard is an accurate and thorough analysis of your environment. If a reviewer cannot tell from the document which systems you run, the template has not been filled in, it has been submitted.

It is an OCR enforcement program focused specifically on entities that failed to conduct an accurate and thorough risk analysis, which is the most frequently cited Security Rule failure. By April 23, 2026 OCR had completed thirteen investigations under it, announcing four settlements that day covering more than 427,000 individuals and over $1 million in payments, each with a two-year corrective action plan. The pattern is consistent: a breach is reported, and the investigation finds no adequate risk analysis behind it.

It would, if adopted, and it has not been. OCR proposed the overhaul on January 6, 2025. It would remove the distinction between required and addressable implementation specifications, and make a written asset inventory, a network map, annual risk analysis, multi-factor authentication and encryption explicit requirements. The comment period closed March 7, 2025 with roughly 4,745 comments, and the target for a final rule has moved from May 2026 to July 2027. Plan against the current rule.

Yes. Since the 2013 Omnibus Rule, business associates are directly liable for Security Rule compliance, and the risk analysis obligation applies to them in their own right. Your client's analysis does not cover you, and signing their BAA does not discharge it. For a software vendor holding PHI this is usually the first HIPAA artifact a healthcare customer asks to see during procurement.

Yes, and it is the cheaper path when both are on the roadmap. The overlap is substantial: access control, audit logging, encryption, vendor management and incident response are asked for by both, so a shared control satisfies each once. What stays HIPAA-specific is the risk analysis itself, business associate agreements and the breach notification process. Complies cross-maps SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS from Growth at $199 a month.

Nothing, until something goes wrong, which is precisely why the exposure is underestimated. The risk analysis is rarely discovered in isolation; OCR asks for it after a breach report, and its absence turns an incident into a documented compliance failure with a corrective action plan attached. The practical advice is unglamorous: do a rough one now covering all nine elements, rather than waiting until you have time to do a perfect one.