Firewalls and cybersecurity across San Bernardino County. Locally owned and operated, with local support. Call or text (760) 684-4139Sign inRequest service or a quote
WENO Office Solutions

Home > HIPAA compliance > Security risk assessment

HIPAA SECURITY RULE
After a breach, the first thing OCR asks for is your risk analysis.

HIPAA security risk assessment for small medical offices

Every practice that keeps patient records on computers must do a written security risk analysis. It is the most common gap federal investigators find, and many small offices have never done one. Here is what it is, what goes in it and how we do the technical work and document it with you.

Schedule my risk assessmentCall or text (760) 684-4139
✓ Doctors, dentists, therapists, clinics★ We sign a business associate agreement

The short answer

  • The HIPAA Security Rule requires an accurate and thorough risk analysis of the risks to patient information your practice stores or sends electronically.
  • It is not a form you buy. It is a written review of where patient data lives, what could go wrong, how likely it is and what you are doing about it.
  • The federal Office for Civil Rights (OCR) runs a Risk Analysis Initiative, and a missing or weak risk analysis is one of the most cited problems in its investigations.
  • Do it at least once a year and whenever something big changes, such as a new EHR, new office or new computers.
  • We do the technical review, find the gaps, fix them and give you the written report to keep.
Requiredfor every covered practice
Yearlybest practice, plus after changes
6 yearskeep HIPAA documentation
#1gap in OCR investigations

What the risk analysis covers

📍Where data livesEHR, computers, phones, email, copiers, backups, cloud apps and paper scans.
⚠ThreatsRansomware, phishing, stolen laptops, former employees, fire and power loss.
🛡Current safeguardsPasswords, MFA, encryption, firewall, backups, logs and training.
📋Risk rating and planHow likely, how bad, and what gets fixed first, with dates.

What we check in a small practice

  • Every computer, server, laptop, tablet and phone that touches patient data.
  • Sign in protection: unique logins, strong passwords and multi factor sign in on email and remote access.
  • Encryption on laptops, backups and email that carries patient information.
  • Firewall, Wi-Fi separation for guests and updates on every device.
  • Backups that are offline or immutable, and tested.
  • Who can see what in the EHR, and whether former staff accounts are closed.
  • Audit logs that show who accessed records.
  • Copiers and scanners that store images of patient forms.
  • Business associate agreements with the vendors that handle patient data.
  • Staff training on phishing and privacy. See phishing training.

What you get

DocumentWhat it shows
Asset and data inventoryEvery system that holds patient data and where it goes
Risk analysis reportThreats, current safeguards and a risk rating for each
Risk management planWhat gets fixed, who owns it and by when
Fix logEach fix with the date completed, the record OCR wants to see
Evidence folderScreenshots and settings that prove safeguards are in place

The rule is getting stricter

HHS has proposed the biggest update to the Security Rule in 20 years. It would make yearly risk analysis, multi factor sign in, encryption and a written technology inventory clearly required. As of late 2026 it is not final, but OCR is already enforcing risk analysis under the current rule. Practices that do this work now will be ready either way.

How WENO handles your risk assessment

1. Walk throughOn site at your office, plus remote review of your computers and accounts.
2. Inventory and analysisWe map where patient data lives and rate each risk in plain English.
3. Fix the gapsMFA, encryption, a WatchGuard® firewall, backups, updates and account cleanup.
4. Document itThe report, plan, fix log and evidence folder, ready if OCR, an insurer or an auditor asks.
5. Repeat yearlyWe update it every year and after any big change, with a business associate agreement in place.

Questions people ask

Is the free HHS risk assessment tool enough?

The HHS Security Risk Assessment Tool is a good guide, but it only asks questions. Someone still has to check the actual computers, settings and accounts and fix what is wrong. That is the part we do.

We are a small office. Does this really apply to us?

Yes. The rule applies to practices of every size that handle patient information electronically. OCR has taken action against small practices too.

Is a risk assessment the same as a HIPAA audit?

No. The risk analysis is your own required review. An audit or investigation is when OCR or another party reviews you, and the risk analysis is one of the first things they ask for.

Can you be our HIPAA compliance officer?

Your practice names its own privacy and security officials. We handle the technical security work and documentation that supports them.

HIPAA complianceCyber insurance questionnaireCopier securityPhishing trainingWatchGuard firewallsToday's cyber threats
Have the report ready before anyone asks.Risk analysis, fixes and proof, done for your practice.
Schedule my risk assessment

Sources

  1. HHS: Guidance on risk analysis
  2. HealthIT.gov: Security Risk Assessment Tool
  3. HHS: The HIPAA Security Rule

General information, not legal advice. Your counsel can confirm how HIPAA applies to your practice.