What the rule actually calls it
The Security Rule has one requirement with this job, and it uses the words "risk analysis": conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the entity. That's 164.308(a)(1)(ii)(A), and it's a required specification, not an addressable one.
Then HHS went and named its free tool the Security Risk Assessment Tool, and the two words have been tangled ever since. Investigators, auditors and the people who write corrective action plans say "risk analysis". Everybody else says "risk assessment". OCR will not penalize you for the vocabulary. It will penalize you for the content.
Why the distinction matters anyway
"Risk assessment" has at least four meanings in a healthcare office, and only one of them is the document OCR asks for.
| What people mean | What it is | Satisfies the requirement? |
|---|---|---|
| The enterprise-wide risk analysis | Written analysis of threats and vulnerabilities to every system holding ePHI, with likelihood, impact and risk levels | Yes. This is the one. |
| A compliance questionnaire or score | Yes/no questions about safeguards, often producing a percentage | No. Useful as a gap check, not an analysis of risk. |
| The breach risk assessment | The four-factor test under 164.402 that decides whether an incident is a reportable breach | No. Different rule, different purpose. |
| A vendor or vulnerability assessment | A review of one business associate, or a scan of one network | No. These are inputs, not the analysis. |
A score out of 100 is a mood. A risk analysis is a document.Your engineer
The nine things a risk analysis has to contain
OCR published its expectations in 2010 and still points to them. Tick what your current document has.
What your risk analysis has
Tick what yours has. If you're not sure, the answer is usually the scope question: does it cover everything, or only the EHR?
What OCR sees when it reads yours
Investigators don't grade on a curve. They look for three failure patterns, and the published settlements show all three.
- It doesn't exist. A California MRI practice settled for $5,000 in 2025 after OCR found it had never done one. A Maryland software vendor that serves dental practices settled for $10,000 in 2026 for the same reason, after a breach affecting roughly 15 million people.
- It isn't enterprise-wide. The analysis covers the EHR and skips the billing system, the backups, the fax server, the laptops and the vendors. OCR's 2016 and 2017 audits rated 86 percent of covered entities' and 83 percent of business associates' risk analyses as having serious shortcomings, most often incomplete scope, missing likelihood and impact ratings, and no updates.
- It's stale. Done once for a meaningful-use attestation years ago, never revisited after new systems, new vendors or a ransomware incident.
Since October 2024, OCR has run an enforcement initiative aimed squarely at this requirement. By June 2026 it had announced its fourteenth numbered action, and HIPAA Journal's count puts risk analysis failures behind 16 of the 21 financial penalties announced in 2025.
Risk analysis, then risk management
The analysis is half of the pair. The next specification, 164.308(a)(1)(ii)(B), requires you to implement measures that reduce the risks you found to a reasonable and appropriate level. In an investigation, a risk analysis with no risk management plan behind it reads as a list of problems you knew about and ignored. Keep the two documents together, with owners and dates on the fixes.
How often, really
The rule's text sets no interval. The documentation standard requires you to review and update as needed in response to environmental or operational changes, and OCR's guidance describes the process as ongoing. In practice: a full review every year, and an update whenever you add a system, change a vendor, move offices, or have an incident. The proposed Security Rule update would turn the annual review into a requirement.
With AccuSights: we write the risk analysis with you, asset by asset, in the structure OCR's guidance describes, and the fix list becomes your risk management plan inside the platform. When something changes, the analysis updates instead of expiring.