Identity, Security & Compliance
HIPAA security risk assessment.
Then the fixes, done properly.
A HIPAA security risk assessment for clinics and practices: where patient data actually lives, how well it is protected, and a plan to close the gaps in order of risk. Written for the practice manager and the IT lead alike. Labor-only, vendor-neutral, scoped up front.
A HIPAA security risk assessment is a review of where a practice's electronic patient data (ePHI) lives, how it is protected, and what could go wrong. Pro IT NW, a Seattle-based, labor-only consultancy, runs it for clinics and practices across Microsoft 365, EHR access, endpoints, backups, remote access and vendors, then delivers a prioritized remediation plan and can do the fixes. It is technical work, not legal advice.
What does the HIPAA Security Rule require?
The HIPAA Security Rule makes risk analysis a required step, not an optional one. Under 45 CFR 164.308(a)(1)(ii)(A), a covered entity or business associate must "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
The next requirement in the same section, risk management, asks you to "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level". That is why an assessment that stops at a report is only half the job. HHS's own risk analysis guidance describes risk analysis as "the first step in identifying and implementing safeguards".
What does a HIPAA risk assessment cover?
Every system that holds patient data or can reach it.
- Microsoft 365: email, Teams, SharePoint and OneDrive, sharing settings, MFA and Conditional Access
- EHR access: who can sign in, from which devices and locations, and how accounts are removed when staff leave
- Endpoints: laptops, front-desk PCs and phones, encryption, patching and device management
- Backups: what is backed up, where copies live, and whether a restore has actually been tested
- Remote access: VPN, remote desktop tools, and access for outside support
- Network and Wi-Fi: guest separation, firewall rules, and medical devices on the same network as everything else
- Vendors: which outside services store or process ePHI, and whether a business associate agreement with each is on file
How does the engagement run?
Four steps, with a defined start and end.
- Scope. A call to map locations, users, systems and vendors, then a written scope and a fixed price.
- Inventory. We trace where ePHI is created, stored and sent, working in your systems under your controls.
- Analysis. Each risk is rated by likelihood and impact against the safeguards actually in place, not the ones on paper.
- Plan and fix. Findings and a prioritized plan, then optional remediation scoped separately.
What do you get at the end?
Documents your practice can keep, act on and show.
- An ePHI inventory: where patient data lives and how it moves
- A written risk analysis, each risk rated and explained in plain terms
- A prioritized remediation plan: what to fix first and why
- A short summary for the owner or practice manager, and the technical detail for IT
- If you choose remediation: the fixes made, and a record of what changed
What is this not, and who is it for?
It is technical risk work for practices that want it done for real.
- Not legal advice: your counsel and privacy or security officer own legal decisions
- Not a certification, and not a promise that you are compliant
- Not a resale channel: we sell no software or hardware, so the plan recommends what fits
- For clinics, dental and specialty practices, and multi-site groups
- For practice managers who were asked for a risk analysis and are not sure where to start, and IT leads who want a second set of senior eyes
Related
See how we work with clinical groups and practices on healthcare IT. Staff pasting patient details into ChatGPT or other AI tools? Start with an AI usage review. For sharing and data-loss controls in Microsoft 365, see Microsoft Purview data governance, and for restores you can count on, backup and disaster recovery. All of our security work lives under Identity, Security & Compliance.
FAQ
Common questions about HIPAA risk assessments.
What is a HIPAA security risk assessment?
A HIPAA security risk assessment, also called a HIPAA risk analysis, is a structured review of where a practice's electronic protected health information (ePHI) is created, stored and sent, what could threaten it, how well it is protected today, and how likely and serious each risk is. The HIPAA Security Rule lists risk analysis as a required implementation specification. The output is a written record of risks and a prioritized plan to reduce them.
Is a HIPAA risk assessment legal advice?
No. Pro IT NW does operational and technical work: finding where ePHI lives, testing how it is protected, and fixing the gaps. It is not legal advice and it is not a certification. Your counsel and your privacy or security officer own legal interpretation, policy approval and any determination about breaches or compliance status.
What systems does the assessment look at?
Everything that holds or reaches ePHI: Microsoft 365 (email, Teams, SharePoint and OneDrive), who can sign in to the EHR and from where, laptops, desktops and phones, backups and whether restores work, remote access and VPN, the office network and Wi-Fi, and the outside vendors that store or process patient data on the practice's behalf.
Do you fix what the assessment finds?
Yes, if you want us to. The remediation is scoped separately once the findings are written, so the assessment stays an honest record rather than a sales pitch. Typical fixes include MFA and Conditional Access, device encryption and management, email and sharing controls, backup changes, and tightening remote access. Your team can also do the fixes themselves using the plan, and we can train them to.
We are a small clinic. Is this sized for us?
Yes. The assessment scales to the environment. A single-location practice on Microsoft 365 with one EHR has far fewer systems to review than a multi-site group, and the scope is set on the first call to match.
How much does it cost and how long does it take?
It is scoped and priced up front, after a call about the number of locations, users, systems and vendors involved. The timeline depends on that scope and is written into it before work starts. There is no hourly meter. The remediation work, if you want it, is quoted separately against the findings.
Free checks
Not ready to talk yet? Start with one of these.
10 questions
Could you take back the keys?
Ten yes / no questions: could you remove your IT provider's access without their help and keep control? Admin accounts, domain, licenses, backups, contract dates.
Open →
Runs in your browser
Who controls your domain?
See who runs your domain's DNS, where your email goes, whether you publish DMARC, and whether on-prem Exchange is still visible. Nothing stored.
Open →
Sample report
See a Copilot readiness report
A sanitized sample assessment: findings scorecard, readiness ratings and remediation roadmap, so you can see what you would get.
Open →
Know where your patient data lives, and how safe it is.
Tell us how many locations and users you have, which EHR and email you run, and what prompted the question. We'll come back with a written scope and a fixed price.