Compliance
A plain-English guide to using the free HHS and ASTP/ONC Security Risk Assessment Tool for HIPAA Security Rule work, including what the tool does well, where small practices get stuck, and when outside help is worth it.
If you need a HIPAA risk assessment, the free HHS SRA Tool is a good starting point for a small practice, not a finish line. It helps you walk through questions, threats, vendors, and scoring, but HHS is explicit that the tool is not required and does not guarantee compliance.
Sources: HHS guidance on risk analysis, HealthIT.gov Security Risk Assessment Tool page, SRA Tool v3.6.1 User Guide, HIPAA Security Rule summary
Use the SRA Tool if you are a solo clinic, small group, or business associate that needs a structured way to start a HIPAA Security Rule risk analysis. Get help if the environment is spread across multiple systems, multiple vendors, multiple locations, or if you already know the answers are going to expose serious gaps you cannot remediate alone.
That is the practical line.
HHS says risk analysis is a required implementation specification under the Security Rule. HHS also says there is no single required methodology for doing it.
That is why the SRA Tool exists.
HealthIT.gov says the desktop application walks users through the security risk assessment process with multiple-choice questions, threat and vulnerability assessments, and asset and vendor management. The workbook version uses the same content and scoring approach for teams that need more flexibility than the Windows application.
But the same page also says the tool is provided for informational purposes only, is not required, and does not guarantee compliance with federal, state, or local laws.
That disclaimer matters. A completed workbook is not the same thing as a defensible HIPAA program.
HHS's risk-analysis guidance is the key anchor here.
The scope is not just your EHR. HHS says the analysis has to consider potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the organization creates, receives, maintains, or transmits.
That means your scope usually includes:
This is where many teams use the tool too narrowly. They answer for the server room they remember, not the actual environment they run.
As of May 28, 2026, the HealthIT.gov page lists SRA Tool version 3.6.1.
The current tool stack gives you three things that matter in practice:
The tool breaks the work into sections rather than forcing you to invent a methodology from scratch. That lowers the chance that a small practice skips entire safeguard families.
HealthIT.gov says all information entered into the desktop tool is stored locally on the user's computer and HHS does not collect, view, store, or transmit it. For a healthcare practice, that makes adoption easier because you are not pushing your self-assessment data into a government portal.
The Excel Workbook version is not an afterthought. HealthIT.gov says it contains the same content and formulas in a spreadsheet format, which is useful when the owner, office manager, outside IT, and compliance lead need to review findings together.
The current 3.6.x release line also includes review-and-approval tracking, updated report content, and risk-scale language aligned to NIST's "moderate" terminology (introduced in version 3.6, with 3.6.1 a maintenance update).
The wrong way is to open it alone on a Friday afternoon and click through from memory.
The right way is to use it as a working session tool.
Before answering questions, list every system, device, location, workflow, and vendor touching ePHI. HHS's guidance specifically tells organizations to identify ePHI they create, receive, maintain, or transmit, including external sources such as vendors and consultants.
If the map is thin, the assessment will be thin.
That usually means some combination of:
The tool is easy to misuse when one person guesses at everyone else's systems.
If MFA is purchased but not enforced, it is not done. If backup exists but nobody has tested a restore, the risk is still there. If a vendor says they are HIPAA-ready but no one has confirmed the contract and the access path, that is not closure.
This is where the tool becomes useful. It highlights gaps. It does not close them for you.
The assessment belongs beside your asset inventory, vendor list, policies, training records, incident log, and remediation tracker. A tool file by itself is not a compliance file.
For a small or medium-sized practice, it is genuinely useful for:
This is why HHS's own risk-analysis guidance still points readers to the tool as useful for small and medium-sized practices and business associates.
This is where people get themselves in trouble.
The tool is not enough when the issue is not "how do I organize the questions?" but "how do I untangle the environment?"
If you have multiple clinics, a parent entity, or shared systems across locations, scoping becomes architectural, not clerical.
Most modern healthcare compromise starts with identity, mailboxes, and remote access. The tool will ask about safeguards, but it does not independently verify whether your Microsoft 365 or Google Workspace tenant is actually hardened.
The moment you have a practice management vendor, cloud backup, imaging platform, outsourced billing, IT support, secure messaging, and a handful of smaller apps, vendor risk becomes a project of its own.
If you are doing the assessment after a phishing event, ransomware scare, or mailbox compromise, you do not just need a questionnaire. You need an honest remediation plan and evidence trail.
The hardest part is not producing an SRA file. The hardest part is showing that the answers match reality.
That is one reason the larger HIPAA operations article for dental practices, HIPAA cybersecurity for dental practices: what the Security Rule actually requires, spends so much time on the difference between paperwork and actual control state.
Get outside help if any of these are true:
The trigger is not size alone. The trigger is complexity plus consequences.
It should not mean buying a binder.
It should mean getting help with:
For many practices, the most urgent control gaps are the same ones that show up in other evidence-heavy environments: MFA coverage, monitored endpoints, backup testing, vendor access, and role clarity. That overlap is why pages like what controls do cyber insurers require in 2026 often feel familiar even outside insurance.
Here is the split I usually recommend.
We do not act as your lawyer or your HIPAA Privacy Officer.
Where we fit is the technical safeguard side after or alongside the assessment: hardening Microsoft 365 identity, improving endpoint coverage, getting visibility into suspicious account activity, and turning backup and incident-response claims into evidence. That usually means some combination of managed ITDR, managed detection and response, and support building a cleaner operational baseline before the next annual review.
If you are in dental specifically, start with the bigger compliance picture in HIPAA cybersecurity for dental practices.
No. HHS says it is informational, not mandatory, and it does not guarantee compliance.
No. HealthIT.gov says the desktop application stores information locally on the user's computer and HHS does not collect, view, store, or transmit that data.
Yes. HealthIT.gov offers an Excel Workbook version for users who need more flexibility than the Windows desktop application.
No. It helps you perform one, but the actual requirement is the risk analysis itself and the remediation work that follows.
Bring in help when scope is unclear, vendors are numerous, cloud identity and email are in play, an incident already happened, or you need evidence that your answers are real and your gaps are being closed.
It covers every system that creates, receives, maintains, or transmits ePHI — the practice-management and imaging platform, Microsoft 365 or Google Workspace email, file shares and scanned charts, cloud backup, operatory workstations and laptops, remote access, and any vendor that touches patient data. Scoping to only the server room is the most common mistake. For the full dental picture, see HIPAA cybersecurity for dental practices.
Last updated
June 12, 2026. We refresh this content as the threat landscape and tools evolve.
FAQ
No. HHS says the tool is provided for informational purposes only and is neither required by nor a guarantee of compliance with federal, state, or local law.
HHS and ONC say the tool is useful for small and medium-sized health care practices and business associates working to comply with the HIPAA Security Rule.
No. The HealthIT.gov SRA Tool page says all information entered into the desktop application is stored locally on the user's computer and HHS does not collect, view, store, or transmit it.
Yes. HealthIT.gov provides an Excel Workbook version that uses the same content and scoring approach for users who need more flexibility than the Windows application.
Get help when the scope is messy, multiple vendors or locations are involved, cloud identity and email are in scope, an incident already happened, or you need a defensible remediation plan rather than just a completed questionnaire.
It covers every system that creates, receives, maintains, or transmits electronic protected health information — the practice-management and imaging platform, Microsoft 365 or Google Workspace email, file shares and scanned charts, cloud backup, laptops and operatory workstations, remote access, and any vendor that touches ePHI. Scoping to only the server room is the most common mistake.
Related reading
Skilled nursing and home health are HIPAA covered entities; assisted living often handles PHI too. What senior-care operators must protect, the proposed Security Rule changes, and the controls that keep residents and revenue safe.
Read articleNo — HIPAA doesn't cover pets, and there's no federal law requiring vets to safeguard animal health records. But veterinary practices still run on payment data and cloud software that ransomware loves. The real risk, and what to do about it.
Read articleWhat dental cyber insurance actually covers in 2026, the underwriting questionnaire controls carriers review, and how to pass the application without overspending.
Read article