A security risk analysis is where you find out what you actually have, where ePHI actually lives, and which risks deserve attention first. It is also the one HIPAA requirement most small practices skip or fake.
Most small healthcare practices cannot answer three basic questions with confidence: where does electronic protected health information live, who can reach it, and what would happen if it were encrypted or stolen tomorrow. A HIPAA security risk analysis exists to answer those questions in writing. It is not a checklist someone downloads and signs. It is a structured review of the systems, vendors, accounts, and workflows that touch ePHI, followed by an honest assessment of what could go wrong and how likely that is.
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. That requirement applies to a five-person dental office the same way it applies to a hospital system. Scale changes the effort, not the obligation. OCR enforcement actions consistently cite the absence of a current, documented risk analysis as a contributing failure, and the Breach Notification Rule then adds notification duties to individuals, HHS, and, for breaches affecting more than 500 people, the media.
The business case is stronger than the regulatory one. Analysis of healthcare breach data indicates providers with fewer than 50 employees experienced roughly three times the breach rate of large providers in 2023, and small and mid-sized providers accounted for about 70% of healthcare breaches while representing only about 30% of exposed records. Attackers are not skipping independent clinics. They are finding them easier to reach. Meanwhile healthcare represented roughly 7% of global breach counts in 2023 but about 31% of exposed records, which tells you how data-dense these incidents are.
A security risk assessment for healthcare done properly gives a practice owner something rare: a prioritized list. Not forty findings of equal weight, but a short set of exposures that genuinely matter, ranked by likelihood and impact on patient care and revenue. That list is what drives budget decisions, vendor conversations, and the [HIPAA cybersecurity](hipaa-cybersecurity) work that follows.
If your last ePHI risk analysis was a template your IT provider filled out three years ago, you do not have a current one. Ask when it was last performed, what changed since, and what was actually fixed.
How Sentree scopes, tests, and documents cybersecurity and HIPAA security risk for independent practices, and what you should expect to receive at the end.
The work starts with inventory. You cannot protect ePHI you have not located. In a typical independent practice that means the EHR or practice management system, imaging and diagnostic platforms, the email tenant, cloud file storage, patient portals, telehealth tools, clearinghouses, outsourced billing, and the workstations and mobile devices staff use to reach all of it. Most practices discover ePHI in places they did not expect: scanned documents in a shared drive, referral attachments sitting in mailboxes, exports on a front-desk computer, backups held by a vendor nobody has spoken to in two years.
Next comes access. Who has an account, what can each account reach, and what happens when someone leaves. Shared logins are still common in small practices because they are convenient at the front desk, and they make it impossible to answer the question every breach investigation asks: whose account did this. Administrative accounts, vendor remote-access accounts, and dormant accounts from former employees are all reviewed, along with whether multifactor authentication is actually enforced rather than merely available. MFA matters, but attackers steal sessions and trick users into approving prompts, so configuration and coverage get tested rather than assumed.
Then the technical layer. Patch status and unsupported systems feed directly into vulnerability management priorities. Reported medical-device attacks rose roughly 60% in 2023 over 2022, with about 35% of providers acknowledging at least one device-related incident and about a quarter of healthcare infrastructure attacks aimed at EHR systems, so connected clinical equipment is part of scope. Email configuration is reviewed because business email compromise and credential phishing remain the most common way attackers reach a practice, which is why email security for healthcare practices and phishing risk among healthcare employees are assessed together rather than separately.
Backup and recovery get tested against a question, not a product name: how long would it take to restore the EHR and resume seeing patients. A backup you have never restored is an assumption. Recovery time is what determines whether a ransomware event is a bad week or an existential one, and it ties directly to your incident response plan for medical practices.
Finally, vendors and documentation. Business associate agreements, vendor security posture, and the administrative safeguards HIPAA requires are reviewed and mapped to recognized frameworks such as the NIST Cybersecurity Framework and SP 800-53, using the published HIPAA crosswalks. You receive a plain-English findings report, a risk register with likelihood and impact ratings, a remediation roadmap sequenced by priority and cost, and documentation that stands up if OCR asks what you did and when.
Tell us about your practice and we will schedule a focused risk analysis tailored to your specialty and compliance requirements.