- Citation
45 CFR 164.308(a)(1)(ii)(A)- Standard
- Security management process, 164.308(a)(1)(i)
- Safeguard
- Administrative safeguards
- Type
- Required
What the rule says
Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.45 CFR 164.308(a)(1)(ii)(A), as currently in force
In plain English: Work out, in writing, what could go wrong with every piece of electronic patient information you hold, how likely it is, how bad it would be, and what you're doing about it. Then keep that document current.
What it means in practice
- Covers every system, device, location and vendor that holds ePHI, not only the EHR. OCR's word is enterprise-wide.
- Pairs threats with vulnerabilities for each asset and rates likelihood, impact and resulting risk on one consistent scale.
- Is a dated, written document with a named author, not a score in a dashboard.
- Feeds a risk management plan with owners and dates, because the next specification requires you to act on it.
- Is reviewed on a schedule and after changes: a new system, a new vendor, a move, an incident.
The one they always ask about first. That's the short version of this requirement.Your engineer
What OCR looks for
If an investigation touches this requirement, the data request will ask for some or all of the following.
- The current risk analysis and prior versions, with dates.
- The asset inventory it was built from.
- The methodology: how likelihood, impact and risk were rated.
- The risk management plan it produced.
- Evidence of review: dated updates, board or owner sign-off.
Where entities get caught
In 2025, sixteen of OCR's twenty-one financial penalties cited this specification. OCR's Risk Analysis Initiative, launched in October 2024, had produced at least fourteen numbered actions by mid-2026.
Vision Upright MRI, $5,000, 2025: never conducted one. Comprehensive Neurology, $25,000, 2025: none before a ransomware attack. Top of the World Ranch Treatment Center, $103,000, 2026: none before a phishing breach affecting 1,980 patients.
Business associates are cited as often as providers: Elgon ($80,000) and Virtual Private Network Solutions ($90,000) in January 2025, MMG Fusion, a software vendor to dental practices ($10,000), in March 2026.
How to meet it at a small organization
A five-provider practice can do this in a few weeks with the right structure: list every system and device with patient data, including the fax, the copier, phones and the backup; interview the people who run each; write down threats and current controls; rate each; produce the fix list. HHS's free SRA Tool is a usable skeleton on Windows. The failure mode is stopping at the EHR, or doing it once and filing it.
Under the proposed Security Rule update
The proposal would specify the required contents (a review of the technology asset inventory and network map, identification of threats and vulnerabilities, likelihood-based risk levels) and require the analysis to be reviewed and updated at least every 12 months and after changes. The update was proposed in January 2025 and remains a proposal as of October 2026; see what's changing.
This page explains a federal regulation in plain language. It isn't legal advice, and AccuSights doesn't certify compliance; no one can. For every standard and specification, see the Security Rule, clause by clause.
With AccuSights: We write the risk analysis with you, asset by asset, in the structure OCR's guidance describes. The endpoint agent and integrations supply the inventory, the platform holds the risk register, and the fix list becomes a tracked risk management plan.