HIPAA Risk Analysis vs a Full Compliance Program: Which Comes First

Which do you need first, a HIPAA risk analysis or a full compliance program?

The risk analysis comes first. It is the document OCR asks for at the start of nearly every investigation, and every other Security Rule safeguard (which controls you pick, which policies you write, what you train staff on) is supposed to follow from what it finds.

A full compliance program is the rest: the risk management plan, policies and procedures, training, business associate agreements, breach procedures and the periodic review. You need all of it eventually. You cannot build it well without the analysis, and a practice that starts with the policy binder usually ends up with policies describing a clinic that does not exist.

How HHS separates the two

The Security Rule lists them as two different required implementation specifications under one standard, the security management process at 45 CFR 164.308(a)(1).

Specification	Citation	What it asks for
Risk analysis	164.308(a)(1)(ii)(A)	An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI
Risk management	164.308(a)(1)(ii)(B)	Security measures sufficient to reduce those risks to a reasonable and appropriate level

The first is a finding. The second is what you do about it. The HHS guidance on risk analysis, published in 2010 and still current, says the analysis has to cover all ePHI the organization creates, receives, maintains or transmits, wherever it lives: the EHR, the billing system, the office manager's laptop, the backup drive in a desk drawer, the texting app a nurse installed last spring.

That scope is where small practices fall short. A questionnaire from the EHR vendor covers the EHR. It does not cover the rest.

How OCR enforces the difference

In October 2024 OCR announced its Risk Analysis Initiative, an enforcement program aimed at one failure: covered entities and business associates that never completed an accurate and thorough risk analysis. A steady run of settlements has followed, many with small and mid-sized providers and their vendors, and the pattern repeats. A breach happens. OCR asks for the risk analysis. There is nothing to send.

The initiative matters for sequencing. OCR is not penalizing practices for an imperfect program. It is penalizing them for lacking the one document the program is supposed to start from.

When a practice needs the full program now

Some situations do not allow a staged approach.

• You have had a breach, or a patient complaint has reached OCR. An investigation asks for the risk analysis, the risk management plan, policies, training records and BAAs together.
• A hospital system or payer is onboarding you and its vendor security review wants policies and evidence, not a plan to write them.
• You are a business associate (a billing company, an IT provider, a transcription service) and your covered entity clients are asking what you have in place.
• Your cyber insurer's renewal application asks about written policies, MFA and backups, and the answers set the premium.

In those cases the analysis still goes first, but by weeks rather than months, and the program follows straight behind it.

The order that works for a small practice

1. Risk analysis. Inventory where ePHI lives, identify the threats and weaknesses, rate each risk, write it down. Our guide to the HIPAA risk analysis covers what OCR expects to see in it.
2. Risk management plan. Each risk gets an owner, a fix and a date. This is the document that turns findings into controls.
3. Policies and procedures, written against the controls you run. The policies a small practice needs lists them.
4. Training, BAAs, breach procedures and the sanction policy.
5. The periodic review, which updates everything above. The HIPAA annual review explains what changes each year.

The analysis is not a one-time deliverable. The rule expects it refreshed when something material changes: a new EHR, a new location, a move to a cloud vendor, a breach.

One note on the Security Rule update. The January 2025 proposal, which would make the risk analysis more prescriptive with a required asset inventory and network map, is still a proposal; the Unified Agenda lists final action for July 2027; the current rule applies now.

The fee

A risk analysis on its own is a defined piece of work and we price it as one: a fixed fee in writing within 24 hours of the intake form. What a HIPAA risk analysis costs explains what moves the number, and no dollar figure is owed to HHS for any of it.

Where AccuSights fits

We do the risk analysis first and build the program from it, with a named engineer rather than a ticket queue, and implementation and remediation included. No one can certify HIPAA compliance and we do not claim to; we make sure the documents OCR asks for exist and hold up. Start with the HIPAA framework page or book a free Risk Diagnosis and we will tell you which one you need this quarter.