Quick answer
An operator’s HIPAA risk analysis should cover all ePHI it creates, receives, maintains or transmits, including local files and services outside the EHR. Describe credible threat scenarios, existing safeguards, likelihood and impact, then fund and verify mitigations. Supplier questionnaires are inputs to this analysis, not a substitute for it.
Define the enterprise being assessed
A three-facility operator is replacing its EHR. Corporate staff assess the proposed cloud service, while one site still keeps admission spreadsheets on a shared drive, another uses a scanned-record archive, and a local contractor supports network equipment. The EHR questionnaire covers only part of the operator's exposure.
HHS guidance on risk analysis describes an enterprise-wide scope encompassing ePHI wherever it is created, received, maintained or transmitted. It calls for identifying threats and vulnerabilities, assessing safeguards, likelihood and impact, documenting results and reviewing the analysis. It does not prescribe a universal numerical scoring scheme.
Begin with a scope statement listing legal entities, sites, workforce arrangements, systems and services. Identify omissions explicitly. “Corporate approved” should not hide a local application no one examined. Use interviews, asset records, system configuration and sample workflows to find ePHI paths; a software purchase list will miss informal copies.
Convert inventory entries into scenarios
This original example illustrates the difference between an asset list and risk analysis.
| ePHI location | Credible scenario | Existing safeguard to verify | Evidence still needed |
|---|---|---|---|
| Local admissions drive at Site A | Former contractor retains access to referral files | Account disablement and access review | Current membership and contractor offboarding evidence |
| Shared tablets at Site B | Lost device exposes a resident cache | Encryption, session expiry and managed wipe | Actual cache behavior without network access |
| Archive at Site C | Required records become unavailable after storage failure | Separate recoverable copy | Recent restore evidence for archived formats |
| Corporate reporting service | Broad export exposes multiple facilities | Scoped accounts and approved export paths | Effective permissions and destination inventory |
A scenario should connect a threat to a vulnerability and a consequence for confidentiality, integrity or availability. “Weak passwords” is a weakness; “a stolen credential permits bulk resident-data export because the account lacks a verified additional control” is an assessable scenario. Existing safeguards reduce risk only to the extent they operate as assumed.
Prioritize without pretending a score is a probability
The team may use qualitative likelihood and impact categories, provided their meanings are documented. Label evidence confidence separately. A high-consequence scenario with an unknown safeguard should not receive a low score merely because no incident has been reported.
For a fictional budget exercise, the operator has $45,000 available. It estimates $12,000 to close contractor-access gaps, $18,000 to establish and verify archive recovery, and $30,000 for managed mobile deployment. These are invented planning amounts, not market prices. Buying the first two leaves $15,000; it does not fund the mobile project. The decision record should therefore describe an interim mobile restriction, residual exposure, accountable approval and the next funding decision, rather than marking all three risks “planned” and effectively closed.
Compare dependencies as well as cost. An identity improvement may benefit several systems; a new monitoring service may accomplish little until required logs exist. Avoid dividing an arbitrary risk score by dollars and presenting the result as measured financial return. If expected-loss modeling is used, disclose the probability and loss assumptions and test sensitivity.
Make remediation closure observable
For each selected action, define the evidence that changes the risk assessment. Removing a contractor from a spreadsheet is insufficient if the account still authenticates. Buying backup storage is insufficient if the archive cannot be restored. A managed tablet policy is insufficient if the enrolled fleet excludes the devices actually used on evenings.
Retain the finding, chosen response, accountable approver, target date, test result and remaining uncertainty. Separate a control that is designed, implemented and verified. Exceptions need an expiry or review trigger appropriate to their circumstances, with compensating measures and residual-risk reasoning.
Use the analysis to shape platform procurement
Give bidders the scenarios they can materially affect. Ask which safeguards are supplied, which require local configuration, what evidence is available and what remains the operator's responsibility. Compare a proposed product against those needs without expecting it to solve unrelated facility infrastructure or governance problems.
Revisit the analysis after meaningful changes: a new processor, an acquired site's previously unknown archive, changed remote access, a serious incident or a different deployment model. The objective is a living account of the operator's ePHI risks and decisions. A dated report can support that work, but its existence alone does not establish that the underlying risks were addressed.
Questions & answers
Is a vulnerability scan a complete HIPAA risk analysis?
No. A scan can identify technical weaknesses, but a risk analysis also addresses scope, threats, existing controls, likelihood, impact and documentation across the organization’s ePHI.
Must every organization use the same scoring formula?
HHS does not prescribe one universal methodology. Whatever method is chosen should make evidence, assumptions, priorities and reassessment understandable.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.