HIPAA Risk Analysis for Small Practices: What OCR Actually Expects

Why the risk analysis comes first

The HIPAA Security Rule is flexible on purpose. A two-dentist office in Santa Maria and a regional hospital do not need the same controls, so the rule lets each practice decide what is "reasonable and appropriate." The risk analysis is the evidence behind those choices. Without it, every other security decision looks like a guess.

That is why the HHS Office for Civil Rights (OCR) asks for it first. As of October 2026, OCR's Risk Analysis Initiative is active. It looks specifically at whether covered entities and business associates completed an accurate and thorough risk analysis, and it reaches small and mid-size practices, not only large systems.

The Central Coast has many practices in that size range. Census County Business Patterns (2023) counts about 240 dentist offices and 416 physician offices in Santa Barbara County, and about 154 dentist offices and 341 physician offices in San Luis Obispo County. Most are small offices, and most share the same gaps.

What the rule actually says

Two requirements sit at 45 CFR 164.308(a)(1)(ii):

• Risk analysis: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI the practice holds.
• Risk management: security measures sufficient to reduce those risks to a reasonable and appropriate level.

An analysis without a management plan is only half the job. The documentation standard at 45 CFR 164.316 adds two more expectations. You keep the written record for six years from when it was created or last in effect, and you review and update it periodically or when your operations change.

What OCR expects to see in the document

OCR's risk analysis guidance and NIST SP 800-66 Rev. 2, the NIST guide to implementing the Security Rule, point to the same core elements. A document that holds up shows all of the following:

1. Scope: all ePHI, wherever it lives. That includes the EHR, practice management software, email, scanned documents, phones, backups, cloud storage and your billing service.
2. Data collection: where ePHI is stored and how it moves, with an inventory of systems and devices.
3. Threats and vulnerabilities: realistic ones for your office. Examples include phishing, ransomware, a lost laptop, a former employee who still has access, a compromised vendor, or a power failure.
4. Current security measures: what is actually in place today, not what the policy binder says.
5. Likelihood and impact: a rating for each threat and vulnerability pair.
6. Risk level: a resulting rating that drives priority.
7. Documentation: dated, with who performed it and how.
8. Periodic review: evidence that it gets revisited.

Next comes the risk management plan. Each significant risk gets an owner, a planned action, a target date and a status. OCR wants to see that the analysis changed something.

The blind spot: everything else on the network

Small practices usually inventory the EHR workstations and stop there. The rest of the network often goes unexamined: the printer that stores scans, check-in tablets, the smart TV in the waiting room, thermostats, point-of-sale terminals, and security cameras and door controllers. These devices often share a network with the computers that open patient charts. A weak device on a flat network is a short path to ePHI.

A good risk analysis treats this as a network risk. Is the front-desk tablet on the same network as the server? Is guest Wi-Fi truly separated? Can a device that never needs the internet reach it anyway? Keith Systems reviews this from the network side only, using segmentation, firewall rule review and guest and device Wi-Fi separation on your own network gear. For more detail, see connected-device network security and the network segmentation guide.

Checklist: gather this before you start

• A list of every system and service that creates, receives, stores or sends ePHI
• Your business associate agreements, and a list of vendors who touch ePHI
• Who has access to what, including former staff and shared logins
• Multi-factor authentication status for email, the EHR and remote access
• Backups: where they are, how often they run, and the date of the last successful test restore
• Encryption status of laptops, phones and portable drives
• A network diagram, even a hand sketch on the back of a schedule
• Your previous risk analysis, and a list of what has changed since
• Any security incidents or near misses from the past few years
• Current policies and staff training records

Common gaps that show up again and again

• A template filled out generically. If the document could describe any practice in California, it describes none.
• "Our IT company handles HIPAA." A vendor can help, but the practice owns the analysis. A network scan alone is not a risk analysis. See assessment vs. managed IT.
• No risk management plan. Findings with no owners or dates.
• Missing scope. Email, staff phones, the billing company and old backups get skipped.
• Stale analysis. Done once, years ago, before the EHR switch or the second location.
• Ratings with no reasoning. "High" or "low" with no explanation of why.

The proposed rule change, as of October 2026

HHS proposed a major overhaul of the Security Rule in 2025. As of October 2026, the final rule is targeted for around mid-2027. It is a proposal, not a compliance deadline, and the current rule is what OCR enforces. Several ideas in the proposal, such as an asset inventory, a network map and broader use of MFA, are sound practice anyway. Work you do on them now still counts.

How Keith Systems supports a risk analysis

Jacob Keith (CISSP, CompTIA CySA+, CompTIA SecurityX) works through the analysis with your office manager and providers. The work covers interviews, the inventory, a network-side review, written findings with risk ratings, and a prioritized management plan you can act on. This supports your HIPAA preparation. It is not legal advice, and HIPAA has no official certification program for practices. Details are on the HIPAA security risk analysis page. If ransomware is your main worry, start with the medical and dental ransomware readiness guide.

Book a free security consult or call (805) 800-8163. The fee is stated in writing after the consult, before any work begins.