The HIPAA Risk Analysis Health Systems Ask For

The HIPAA Risk Analysis Health Systems Ask For

You did the demo. The clinical team loved it. Someone in the meeting said "this is exactly what we need," and you started mentally spending the commission.

Then an email arrives from the hospital's information security team. It has a 140-question spreadsheet attached and one line that ruins your week: "Please provide your most recent HIPAA Security Risk Analysis."

If you have never written one, or yours lives in a folder called "old stuff," this post is for you. Below are the questions vendors ask us most, answered in plain English.

Why is a hospital asking me for a HIPAA risk analysis?

Because if your product touches their patients' data, you are a business associate, and the HIPAA Security Rule applies to you directly.

The rule requires every covered entity and business associate to carry out "an accurate and thorough assessment" of the risks to the confidentiality, integrity and availability of electronic protected health information (ePHI). You will find it at 45 CFR 164.308(a)(1)(ii)(A), in case you need something to read at bedtime.

The health system wants proof you did yours. If you get breached, it is their patients on the notification letters and their logo in the news story. A signed business associate agreement says you promise to protect the data. The risk analysis shows you have actually looked at how.

Can't I send them our SOC 2 report?

You can, and you should. It just probably won't end the conversation.

A SOC 2 report is an auditor's opinion on your controls against the Trust Services Criteria. A HIPAA risk analysis is a document about one specific thing: where ePHI lives in your environment, what could go wrong with it, and how likely and how bad each of those things would be.

Some health system reviewers will accept a SOC 2 Type II plus a HIPAA control mapping. Many will still ask for the risk analysis, or at least a summary of it. The safest move is to send both to avoid a second round of emails.

What does a HIPAA risk analysis contain?

HHS guidance lists nine elements. A health system reviewer will look for all of them, usually in this order:

1. Scope. Every place ePHI is created, received, stored or sent. That includes laptops, backups, log files, support tickets and the S3 bucket somebody named "test-final-2."
2. Data collection. Where the data actually is, documented, as opposed to where everyone assumes it is.
3. Threats and vulnerabilities. Ransomware, phishing, a misconfigured cloud setting, a departing engineer who still has admin access.
4. Current security measures. What you already have in place against each threat.
5. Likelihood. How probable each threat is, given those measures.
6. Impact. How bad it would be if it happened.
7. Risk level. Likelihood combined with impact, so you know what to fix first.
8. Documentation. All of the above, written down. If it isn't written down, a regulator will assume it didn't happen.
9. Review and updates. A date you will look at it again, plus a trigger for doing it sooner (new product, new cloud provider, acquisition).

Attach a risk management plan that lists each risk, an owner, a fix and a due date. Reviewers increasingly ask for this as a separate item.

What makes a health system reviewer wince?

They have read hundreds of these, so they spot the problems fast. The common ones:

1. It's dated 2019. Your product, team, and cloud setup have all changed since then. The document has not.
2. The scope covers production and nothing else. Your support team exporting patient records to a spreadsheet to debug an issue is also in scope.
3. It still says [COMPANY NAME] on page 3. Nothing builds trust with a hospital like a template you forgot to fill in.
4. Every risk is rated "low." Reviewers read that as "we didn't look very hard."
5. There is no remediation plan. Listing risks and then doing nothing about them is worse than not listing them, because now there is a written record that you knew.
6. It came out of a free tool built for a three-doctor clinic. The HHS Security Risk Assessment Tool is useful for small practices. A 150-person SaaS company with a multi-region cloud setup will need something more detailed.

Is anyone actually enforcing this, or is it paperwork for the sake of paperwork?

The HHS Office for Civil Rights (OCR) is enforcing it, and hospital security teams read the settlements.

OCR launched its Risk Analysis Initiative in October 2024 to go after organizations that never properly assessed where their ePHI lived. In April 2026, it announced four ransomware settlements on the same day, totalling $1,165,000, and each organization was found to have no compliant risk analysis. A later settlement with an employer health plan became the initiative's 14th action.

The pattern goes back further. Paubox reports that a missing or inadequate risk analysis was cited in more than 75% of HIPAA resolution agreements involving security incidents from 2020 to 2024.

Business associates appear as named respondents in these cases too. When a hospital asks for your risk analysis, they are asking for the first document an investigator would ask them for.

What's happening with the new HIPAA Security Rule?

It's still a proposal, but health systems are already asking for parts of it.

HHS published a proposed overhaul of the Security Rule in January 2025. It would make the risk analysis far more prescriptive, with a written technology asset inventory, a network map showing how ePHI moves, and a set review schedule. It would also turn encryption and multi-factor authentication from "addressable" into required.

The final rule was targeted for May 2026. That date came and went, and the federal regulatory agenda now lists July 2027 for final action. Check the current status before you quote a date to a customer.



In practice, the bigger hospital systems have stopped waiting. Expect questions about your asset inventory, MFA coverage and encryption at rest to show up in vendor questionnaires now, whatever the final rule ends up saying.

 6 - 10 weeks until a defensible program

How long does a risk analysis take, and how much do I share?

For a SaaS company with a fairly tidy setup, expect a few weeks rather than a few months. Most of that time goes on step one: finding out where patient data actually ends up. It is always more places than engineering thinks.

Things that slow it down:



1. No asset inventory, so you are building one from scratch.
2. Data flowing to third parties nobody wrote down (analytics tools, AI APIs, a support platform).
3. Nobody owning the project, so it waits behind every sprint.

On sharing: you don't have to hand over the full document. It lists your weaknesses in detail, and it would make excellent reading for an attacker. Most vendors share an executive summary or attestation letter under NDA, covering the scope, method, date, overall findings and the status of the remediation plan. Offer a call with your security lead if the reviewer wants more.

FAQs

Is there an official HIPAA certification? No. HHS does not certify anyone as HIPAA-compliant. Anyone selling you an official "HIPAA certificate" is selling you a nice PDF.

Do business associates need their own risk analysis? Yes. The Security Rule applies to business associates directly. Your customer's risk analysis does not cover your systems.

How often should we update it? The current rule says to review it periodically and when your environment changes. The proposed rule would set a fixed schedule. Most health systems expect one dated within the last 12 months.

Is a risk analysis the same as a risk assessment? People use the terms interchangeably. The regulation says "risk analysis," so use that wording when you respond to a hospital.

Can we do it ourselves? You can. The catch is objectivity, because rating your own risks tends to produce a lot of "low." Many vendors bring in an outside firm, especially for their first one.

What framework should we follow? NIST SP 800-30 for the risk method, and NIST SP 800-66 Rev. 2 for how it maps to HIPAA. Reviewers recognize both.

Got a hospital waiting on your risk analysis?

Cloudsapio helps SaaS companies get through health system security reviews without losing the deal to a spreadsheet. Book a free 45-minute gap analysis with our team and we'll tell you what your risk analysis is missing, what the reviewer is likely to push back on, and what to fix first. Book your free gap analysis.

Ready to move faster?

Too much to do,

too important to ignore.