Quick answer
- There is no single HIPAA-required schedule for performing risk analysis
- Review risks periodically based on your environment and circumstances
- Reassess when meaningful changes occur that may affect the security of ePHI
What HIPAA expects
HIPAA Security Rule risk analysis is intended to be an ongoing process.
The appropriate frequency can vary based on factors such as changes to systems,
technology, operations, vendors, and newly identified risks affecting ePHI.
When an additional review may be appropriate
- Adding or changing an EHR, telehealth platform, or billing system
- Working with a new vendor that creates, receives, maintains, or transmits ePHI
- Moving information to new cloud services, systems, or devices
- Changing access permissions, workflows, or security controls
- Identifying new threats, vulnerabilities, or security concerns
What to review
- Where ePHI is created, received, maintained, and transmitted
- Potential threats and vulnerabilities
- Who has access and whether access remains appropriate
- Existing administrative, physical, and technical safeguards
- Vendor relationships and relevant documentation
Start with a structured review
A structured assessment can help organize your review,
identify potential gaps, and determine which areas may need further attention.
Use the
HIPAA Compliance Assessment
to review key HIPAA requirements, identify potential gaps,
and receive recommended next steps.
Need a simple checklist?
Get HIPAA checklist PDF →