HIPAA security risk analysis for small behavioral health programs

What the Security Rule requires

The risk analysis is the first implementation specification of the Security Rule's "security management process" standard, and everything else in the rule is supposed to follow from it.

Provision	What it says (paraphrased)	What it means for a small program
164.308(a)(1)(ii)(A) Risk analysis (required)	Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the electronic protected health information you hold.	Every system, device and vendor that touches client information, not only the EHR.
164.308(a)(1)(ii)(B) Risk management (required)	Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.	The fix list, done, with dates. An analysis with no follow-through doesn't meet the rule.
164.308(a)(1)(ii)(C)–(D) Sanctions; activity review	Apply sanctions to workforce members who break security policies; regularly review records of system activity, such as audit logs and access reports.	A written sanction policy, and someone who actually looks at the EHR's access log on a schedule.
164.306(b) Flexibility	In deciding which measures to use, consider your size, complexity and capabilities, your technical infrastructure, the costs, and the probability and criticality of the risks.	A 12-person IOP isn't expected to run a hospital's security program, but it has to show it thought about each risk.
164.306(d) Required vs addressable	An "addressable" specification is implemented if reasonable and appropriate; if not, you document why and use an equivalent measure if one is reasonable.	"Addressable" never means optional. Encryption is addressable; skipping it needs a written reason that holds up.
164.316(b) Documentation	Keep the policies and the required records in writing (electronic is fine) for 6 years from when they were created or last in effect, make them available to the people who use them, and review them periodically.	Every year's signed analysis and fix list stays on file for six years.

The physical safeguards (164.310: facility access, workstations, devices and media) and technical safeguards (164.312: access control, audit controls, integrity, authentication, transmission security) are the checklist your analysis tests against. The Security Rule covers electronic information; paper charts fall under the Privacy Rule's safeguards and, for substance use records, Part 2.

The steps in HHS's guidance

The rule doesn't prescribe a method. HHS's guidance on risk analysis, which draws on NIST's risk assessment publications, lists the elements a sound analysis covers:

1. Scope: all electronic client information you create, receive, maintain or send, on every kind of media.
2. Data collection: where it's stored, received, maintained and sent.
3. Threats and vulnerabilities: identified and written down.
4. Current security measures: what already protects each system, and whether it's configured and used properly.
5. Likelihood that each threat happens.
6. Impact if it does.
7. Level of risk, from likelihood and impact together.
8. Documentation of all of the above.
9. Periodic review and update, as the program changes.

Step one: where client information lives

Most weak analyses fail here: they cover the EHR and stop. Walk the program and list every place, including the ones nobody thinks of as "systems." For a typical outpatient or IOP program:

• The EHR and its client portal, and every login to it.
• Email, including the shared intake inbox and anything forwarded to personal accounts.
• Phones: texts, voicemail, call recordings, photos of insurance cards, the admissions team's personal cell phones.
• Laptops and desktops, including the downloads folder and the desktop spreadsheet "just for tracking."
• Fax: the fax machine's memory, or the e-fax service and its inbox.
• The copier or printer, which may store scanned pages on its own drive.
• The clearinghouse, the verification tool, the lab portal, the e-prescribing network, the telehealth platform.
• Backups, wherever they are, and who can restore them.
• The network: office Wi-Fi, the guest network, the router's admin password.
• Paper (outside the Security Rule, but in your Part 2 and Privacy Rule duties): intake packets, sign-in sheets, group rosters, the drug screen log.

For each, note the vendor and whether you have a signed Business Associate Agreement. A vendor that stores or sends client information for you without one is a finding before you rate anything (see the BAA section of the HIPAA checklist).

A worked risk register

A made-up 12-person IOP, rated on a simple 1–3 scale for likelihood and impact (the score is the two multiplied, so 1 to 9). HHS doesn't require this scale; it's one way to make the ranking visible. Fix the highest scores first.

System	Threat and vulnerability	What protects it now	L × I	Action, owner, due
Shared intake inbox	Phishing; one password shared by three people; no two-step sign-in	Spam filter	3 × 3 = 9	Individual accounts with two-step sign-in; phishing training. Operations lead, 14 days.
Admissions staff's personal phones	Photos of insurance cards and texts with clients on an unmanaged, unlocked phone that can be lost	None	3 × 2 = 6	Card photos only in the verification tool, never the camera roll; screen lock required; written mobile device policy. Admissions lead, 30 days.
Front-desk laptop	Theft of an unencrypted laptop with downloaded reports	Locked office at night	2 × 3 = 6	Turn on full-disk encryption; stop local downloads. Operations lead, 7 days.
Former employee accounts	A counselor who left two months ago can still sign in to email	EHR access removed	2 × 3 = 6	Same-day offboarding checklist covering every system; quarterly account review. Program director, 7 days.
Copier	Stored scans of intake packets on the copier's drive when the lease ends	None	1 × 3 = 3	Lease return requires drive wipe or removal, following NIST's media sanitization guidelines; certificate kept. Operations lead, at lease end.
EHR	Ransomware or an outage stops access to records during program hours	Vendor's encrypted nightly backups; BAA	1 × 3 = 3	Downtime procedure and a printed daily roster; test once a year. Clinical director, 60 days.
Office Wi-Fi	Clients on the same network as staff computers	Password on the network	2 × 2 = 4	Separate guest network for clients; change the router's default admin password. Operations lead, 14 days.

Some risks you'll accept rather than fix. Write those down too, with the reason and who decided. "Accepted, because…" signed by the security officer is an answer; a blank line isn't.

Using the HHS SRA Tool

HHS's Office of the National Coordinator for Health IT and the Office for Civil Rights publish the Security Risk Assessment Tool free, for small and medium-sized practices. It's a downloadable application that asks a series of questions about your safeguards, lets you record your assets and vendors, and produces a report of the risks it finds. How we use it:

1. Do the inventory first, on paper or in a spreadsheet, so you answer the tool's questions about real systems.
2. Answer honestly. "Partially" or "no" is useful; a report that's all green is not believable.
3. Turn every flagged risk into a line on your fix list with an owner and a due date. The tool's report is the analysis; the fix list is the risk management the rule also requires.
4. Save the file and the report with the year in the name, signed, in the place you keep six years of HIPAA records.

The tool is a guide, not a certificate. Using it doesn't by itself make a program compliant, and no agency certifies a program or a product as "HIPAA compliant."

42 CFR Part 2: what it adds

A licensed substance use program that bills insurance electronically is usually both a HIPAA covered entity and a Part 2 program. The HIPAA risk analysis covers its electronic Part 2 records like any other health information. Part 2 adds:

• Paper is in scope. 42 CFR 2.16 requires formal policies and procedures that protect Part 2 records, paper and electronic, against unauthorized use and disclosure and reasonably anticipated threats, including how records are moved, removed, destroyed, kept and accessed. Put the paper items from your inventory into the same review.
• Breach notification applies to Part 2 records. Since the 2024 rule, Part 2 programs follow the HIPAA breach notification rules for unsecured Part 2 records; the clocks are on the incident reporting timelines page.
• Stricter limits on disclosure mean a misdirected fax or email about a substance use client is a bigger problem. Rate fax, email and release-of-information workflows with that in mind. Our sister site's 42 CFR Part 2 guide covers consent and the 2024 changes.

Texas items to fold in

• Training within 90 days. Texas requires privacy training for new staff within 90 days of hire (Tex. Health and Safety Code 181.101). Check training records as part of the review.
• The attorney general's 30-day clock. A breach of sensitive personal information of 250 or more Texans goes to the Texas attorney general within 30 days (Tex. Bus. & Com. Code 521.053), shorter than HIPAA's 60 days for individuals. Your incident response plan should say so.
• Records retention. Texas has its own retention periods for client records; our sister site's Texas records retention guide lists them. Backups and disposal in your analysis should match.

What to keep, and how often to redo it

The rule doesn't set a frequency. HHS's guidance treats risk analysis as an ongoing process, reviewed as the program changes, and 164.316 asks you to review your documentation periodically and update it after environmental or operational changes. What we do, and what we'd defend:

• Every year, a full review, signed and dated by the security officer.
• Again when something big changes: a new EHR or clearinghouse, a new office, telehealth, a new service line, a merger, a breach or a near miss.
• Kept 6 years: each year's analysis, the fix list with completion dates, accepted risks with reasons, and the evidence (the encryption screenshot, the BAA, the restore test).

The gaps we see most

• One system only. The analysis covers the EHR, or the portal, and nothing else.
• No dates, no signature, no author. It has to say when it was done and by whom.
• A list of risks with no fix list, or a fix list nobody ever closed. Risk management is a separate requirement.
• Copied from a template with another organization's systems still in it.
• The same document every year, re-signed without anyone looking at what changed.
• Vendors without BAAs found during the analysis and never fixed.

Where Comply and Cima EHR fit

In Comply, the HIPAA security risk analysis is a yearly task for leadership: systems with client information listed (EHR, email, phones, paper), threats and safeguards rated, business associate agreements on file for every vendor, a backup restored as a test, staff HIPAA and Part 2 training current, and the analysis signed by the privacy and security officer. A "no" on any line becomes a fix with an owner and a due date, and the signed analysis goes in the survey binder. It sits next to the IT outage line in the hazard vulnerability analysis and the downtime section of the emergency operations plan; the year's schedule is in the compliance calendar.

For the EHR row of your register, Cima EHR's security page lists what it does: a BAA with every practice, encryption, US hosting on HIPAA-eligible AWS services, two-step sign-in and passkeys, nightly encrypted backups, and a log of every chart view for your activity review.

Want it written with you? Cima Consulting's program policy and procedure manual ($7,500) includes the HIPAA and Part 2 security policies, and the practice policies and forms kit ($1,250) includes a risk assessment worksheet for smaller practices.

Questions

What is a HIPAA security risk analysis?

The written assessment, required by 45 CFR 164.308(a)(1)(ii)(A), of the risks and vulnerabilities to the confidentiality, integrity and availability of the electronic health information a covered entity holds. It's followed by risk management: the security measures that bring those risks down to a reasonable level.

Does a small therapy practice or IOP need a risk analysis?

Yes, if it's a covered entity (for example, it bills insurance electronically). The rule scales the measures to your size and resources (164.306(b)), not the requirement to do the analysis.

Is the HHS SRA Tool enough on its own?

It's a good structure for small and medium practices, but the analysis is only as good as the inventory and answers you put in, and the rule also requires you to act on what it finds. Keep the report, the fix list and the evidence that each fix was done.

How often do we need to do a HIPAA risk analysis?

The rule doesn't set an interval. HHS treats it as ongoing, and documentation must be reviewed periodically and updated after changes. A yearly review, plus an update after any major change or incident, is a common and defensible schedule.

What's the difference between a risk analysis, a risk assessment and risk management?

"Risk analysis" is the Security Rule's term; "security risk assessment" is what HHS's tool and most people call the same work. Risk management is the separate requirement to fix what the analysis finds.

Does using a HIPAA-compliant EHR cover the risk analysis?

No. The EHR is one row of your analysis. Email, phones, laptops, fax, paper, vendors, backups and logins are yours to assess, and the analysis has to cover every system that holds client information.

Does 42 CFR Part 2 require a risk analysis?

Part 2's security section (42 CFR 2.16) requires formal policies and procedures to protect Part 2 records, paper and electronic. Most Part 2 programs are also HIPAA covered entities, so the HIPAA risk analysis covers their electronic records; include paper Part 2 records in the same review.

More in this set: incident and breach reporting timelines, the client grievance procedure (privacy complaints), the emergency operations plan and the Joint Commission checklist. On cimaehr.com, the full HIPAA checklist for behavioral health.

Sources

• 45 CFR Part 164, Subpart C (eCFR): 164.308 (administrative safeguards, risk analysis and risk management), 164.306 (flexibility; required and addressable), 164.310, 164.312, 164.316 (documentation, 6 years).
• HHS, Guidance on risk analysis and the Security Rule; HHS (ONC and OCR), Security Risk Assessment Tool; HHS, Breach Notification Rule.
• 42 CFR 2.16 (security for records and breach notification) and Part 2.
• NIST, SP 800-88 Rev. 1, Guidelines for Media Sanitization.
• Texas Health and Safety Code chapter 181 (181.101, training); Business and Commerce Code 521.053 (breach notice to the attorney general).

The program and its ratings are made up. This guide is general information, not legal advice; the official text of each rule controls. Comply isn't affiliated with or endorsed by HHS or NIST.