Skip to content

Free HIPAA tool

Free HIPAA risk assessment tool: find your gaps in ten minutes

Thirty plain-English questions across the three safeguard families, scored the way an investigator would weigh them. Nothing leaves your browser. At the end you get your weakest areas, the citation for each gap, and what to do first.

Take the 3-minute Cyber Hygiene Test

By the AccuSights compliance team. Updated . Every figure is quoted from a source listed at the end of the page.

Before you start

Answer for how things are today, not how they're supposed to be. "Partly" is a valid answer and usually the honest one. The tool weights questions by how often OCR cites the requirement, so the first section matters most. Ten minutes, thirty questions, nothing stored.

The HIPAA risk assessment

0 of 30 answered

Question 1 of 30. Administrative safeguards, 164.308(a)(1)(ii)(A)

Do you have a written risk analysis, dated within the last year, covering every system, device and vendor that holds patient information?

A gap you've found is a risk you can manage. A gap OCR finds is a finding.Your engineer

What to do with the result

  1. If the risk analysis questions scored low, start there. Every other gap on the list is easier to close once it exists, and it's the document every investigation asks for first. See what it has to contain.
  2. If the technical questions scored low, turn on MFA and encryption this week. They stop breaches and they're the controls OCR expects to find.
  3. If the documents and training scored low, the fix is a few weeks of writing and a tracking system. See the Security Rule clause by clause for what each policy has to cover.
  4. If everything scored well, check the dates. A program that was complete two years ago and hasn't been reviewed is the second most common finding.

With AccuSights: the platform's assessment goes far deeper than thirty questions, links each answer to the evidence that proves it, and a named engineer turns the gaps into a written risk analysis and a fix plan. What that costs.

Quick questions

Is this a HIPAA risk analysis?
No. It's a gap assessment: a quick check of which Security Rule requirements you have in place. The risk analysis required by 164.308(a)(1)(ii)(A) is a written, enterprise-wide analysis of threats, vulnerabilities, likelihood and impact for every system holding ePHI. This tool shows you how far you are from one and where to start.
Does this tool store my answers?
No. It runs entirely in your browser and sends nothing to us. If you want a copy, use the copy button at the end; otherwise your answers disappear when you close the page.
How is this different from the HHS SRA Tool?
HHS's Security Risk Assessment Tool is a free desktop application with well over a hundred questions that walks you through building an actual risk analysis. It's thorough and worth using. This tool is shorter, runs on any device, and is meant to show you your gaps before you commit a day to the SRA Tool or hire someone.
Who should use this?
The practice manager, security officer or founder who's been asked whether the organization is HIPAA compliant and wants an honest answer before anyone else asks. It works for covered entities and business associates.
What does the score mean?
Each question is weighted by how often OCR cites that requirement in settlements. The risk analysis, access controls, encryption and training carry more weight than, say, maintenance records. A high score means fewer and lighter gaps; it isn't a compliance rating, because no such rating exists.

Sources

Rules, figures and enforcement examples on this page were checked against these in October 2026. Regulations and prices change, so confirm before you rely on them.

  1. 45 CFR 164.308, 164.310, 164.312, 164.316 (eCFR)
  2. OCR: Guidance on Risk Analysis Requirements
  3. ONC/OCR: Security Risk Assessment Tool
  4. HHS: resolution agreements and civil money penalties

Written by the AccuSights compliance team and updated October 2026. Figures are quoted from the sources named here and were current when checked. This page is general information, not legal advice.

Next step

Want the real risk analysis, written for you?

The one OCR asks for first, written by people who've done hundreds, with a ranked fix list. One fixed fee.

Take the 3-minute Cyber Hygiene Test

See how we use your information

The regulator has the final say. We help interpret, scope and get you ready; we do not certify.

3-min test