Federal regulators have closed dozens of HIPAA enforcement cases in the past two years, and nearly all of them trace back to the same root cause. Failure to conduct an adequate security risk analysis was again the top finding in 2025, and ransomware attacks were the most common triggering event. Penalties for that single gap have ranged from tens of thousands of dollars for small practices to seven-figure sums for larger organizations. Examples include a $3 million settlement tied to a phishing breach and an $800,000 penalty tied to insider threats at a hospital system. This article explains what a HIPAA Security Risk Assessment (SRA) covers, how SRA software handles that work, and where a self-administered tool starts to fall short. The short answer: an SRA tool can structure the process and produce a defensible paper trail. Organizations with complex environments, prior incidents, or thin internal security expertise generally get more reliable results by pairing the tool with HIPAA security consulting rather than running the assessment alone.
What Counts as a HIPAA Security Risk Assessment?
A HIPAA Security Risk Assessment is the documented analysis of risks and vulnerabilities to electronic protected health information (ePHI) that the HIPAA Security Rule requires of covered entities and business associates. The rule, at 45 CFR 164.308(a)(1)(ii)(A), requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The analysis is not a one-time form to file away. It is the foundational HIPAA Security compliance activity, since every other Security Rule safeguard is supposed to be built on what the analysis identifies.
Regulators treat this requirement as the backbone of enforcement. The Office for Civil Rights (OCR) has announced recent HIPAA enforcement actions that reinforce the same point: failure to conduct an adequate risk analysis remains a persistent and costly mistake. That focus has intensified in recent years. OCR has an active enforcement initiative targeting noncompliance with the risk analysis provision of the Security Rule, and recent settlements show the pattern repeating across organization sizes, from a $25,000 penalty against a small imaging practice to multi-million-dollar resolutions against larger covered entities.
What Does an SRA Tool Actually Check?
A HIPAA SRA tool is software that walks an organization through the required risk analysis using structured questions rather than a blank page. The Office of the National Coordinator for Health Information Technology, working with OCR, developed a downloadable SRA Tool to help healthcare providers conduct a security risk assessment as required by the Security Rule. The federal version runs as a desktop application or an Excel workbook, and both formats cover similar ground.
The tool typically checks these areas:
- Administrative safeguards, including workforce training and access management policies
- Physical safeguards, such as facility access and device controls
- Technical safeguards, including encryption, audit logging, and authentication
- Asset and vendor inventories tied to ePHI exposure
- Likelihood and impact ratings for identified threats and vulnerabilities
Data entered into the federal tool stays on the organization's own machine. The tool stores all entered information locally on the user's computer, and the Department of Health and Human Services (HHS) does not collect, view, store, or transmit any of it. That design protects confidentiality, but it also means the output is only as strong as the answers entered.
Where HIPAA SRA Tools Run Into Limits
An SRA tool organizes the required questions but does not interpret the answers against an organization's actual environment. Use of the tool is neither required by nor guarantees compliance with federal, state, or local laws, and it is not intended as an exhaustive or definitive source on safeguarding health information. The federal tool states its own scope plainly: it targets medium and small providers, and it may not be appropriate for larger organizations.
That boundary matters because most enforcement findings do not cite a missing tool. They cite an analysis that was incomplete or never updated. Federal guidance calls for review and updates at least annually, or whenever a significant change occurs in an organization's environment, operations, or technology. A single assessment does not satisfy that ongoing obligation. A tool populated once during onboarding and never revisited after a cloud migration, a merger, or a staffing change produces exactly the kind of stale documentation OCR has penalized repeatedly.
When Does HIPAA Security Consulting Make Sense?
HIPAA security consulting adds judgment to the process that a questionnaire cannot supply on its own: interpreting ambiguous answers, prioritizing remediation, and tailoring the scope to an organization's actual systems. A few situations tend to call for that outside judgment:
- Multiple systems or locations. Organizations running several electronic health record instances, cloud platforms, or office sites often need scoping decisions a generic tool was not built to make.
- Prior breach or OCR inquiry. Corrective Action Plans typically require revising risk analysis procedures, strengthening controls, and submitting regular compliance reports to OCR. That work benefits from experienced guidance rather than a first attempt.
- Thin internal security staff. Smaller covered entities and business associates without a dedicated security role often lack the bandwidth to translate findings into a workable remediation plan.
- Vendor and business associate complexity. A growing list of subcontractors handling ePHI raises shared-responsibility questions that a questionnaire alone will not resolve.
- Upcoming regulatory change. HHS has delayed final action on proposed Security Rule updates, but many expected changes, such as stronger authentication and encryption requirements, are worth preparing for in advance rather than waiting for a final rule.
In each of these cases, a consultant reviews the same ground an SRA tool covers but adds context: which findings pose the greatest exposure, which fixes are realistic given budget and staff, and how the documentation will read if OCR ever asks for it.
HIPAA Privacy Consulting and the Security Risk Assessment
HIPAA privacy consulting addresses a related but distinct set of obligations, covering how protected health information (PHI) is used, disclosed, and governed through policy rather than how systems are secured technically. A security risk assessment focuses on ePHI protection under the Security Rule, while privacy consulting typically covers patient rights, authorization forms, and breach notification procedures under the Privacy Rule. Organizations preparing for a full compliance review often benefit from addressing both tracks together, since a risk analysis frequently surfaces policy gaps that fall outside an SRA tool's technical scope.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in HIPAA readiness for small and midsize businesses in healthcare and health technology. Our vCISOs and compliance managers help organizations choose the right approach, configure compliance tools if needed, and get audit-ready without wasted time.
