Feds Release Updated HIPAA Security Risk Analysis Tool

Federal regulators have updated their HIPAA security risk assessment tool that’s long been aimed at helping small and midsized providers and business associates with risk analysis – an activity that many healthcare organizations can’t seem to get right.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The U.S. Department of Health and Human Services Office for Civil Rights and its Assistant Secretary for Technology Policy – formerly known as the Office of the National Coordinator for Health IT – jointly released version 3.6 of the Security Risk Assessment tool on Tuesday, saying the latest update contains “enhancements and improvements based on current cybersecurity guidance and user feedback from previous versions.”

The free SRA tool is an application that walks users through the security risk assessment process using a wizard-based approach, guiding users through multiple-choice questions, threat and vulnerability assessments, and asset and vendor management, HHS said. References and additional guidance are provided along the way. Reports are available to save and print after the assessment is completed.

HHS has offered various iterations of the SRA tool for at least the last 10 years (see: Risk Analysis, Encryption Stressed in HITECH Act Final Rules).

Faulty risk analysis has long been the most common finding on HHS OCR’s HIPAA breach investigations and audits (see: Why Do HIPAA Risk Analyses Miss the Mark So Often?).

In October 2024, the agency named risk analysis as a top enforcement priority, launching an initiative to crack down on weak risk assessments that can contribute to compromises of protected health information.

Since then, HHS OCR has highlighted risk analysis in nearly a dozen HIPAA enforcement actions. That includes an HHS OCR corrective action plan and $175,000 financial settlement last month with certified public accounting firm BST & Co. CPAs, LLP, a HIPAA business associate in the wake of the agency’s investigation into a 2020 ransomware breach (see: Accounting Firm Pays Feds $175K for HIPAA Ransomware Breach).

What’s in the Update?

HHS said the update includes several key features, including:

• A new “reviewed-by” confirmation button to record approvals and dates for audit tracking;
• An updated risk scale aligned with the National Institute of Standards and Technology, changing “medium” to “moderate”;
• Enhanced reports with section-specific details and updated disclaimers;
• Refreshed library files to mitigate vulnerabilities in outdated components;
• Enhanced content for questions, responses and education.

But what stands out about the update, and does the refreshed tool go far enough to make a difference? Some experts see improvements, but say more work needs to be done.

“The addition of a reviewed-by confirmation button really stands out,” said Dave Bailey, vice president of consulting services at security and privacy firm Clearwater. “Covered entities and business associates often struggle with demonstrating that their risk analysis was formally reviewed and approved – a key point of OCR scrutiny,” he said.

“Having a built-in feature that time-stamps approvals strengthens the audit trail, which is critical when proving due diligence during investigations,” he said.

Also, he said, “the updated, NIST-aligned risk scale is also a step forward, since it helps organizations speak a common risk language that aligns with broader frameworks,” he said.

Tom Walsh, president of privacy and security consultancy tw-Security, said the improvement that stands out most to him is the enhanced content for questions, responses and education feature.

“For years I have done an analysis of each release of the SRA tool. Each revision has been better at addressing threats and risks beyond basic HIPAA Security Rule requirements,” he said.

“However, there is still a list of keywords and topics that are a part of cybersecurity and IT that are still not found in either the questions or the educational part of the tool,” he said. That includes “phishing” – a primary way ransomware is delivered – and “cyber insurance,” he said.

Even with the latest updates, the SRA tool remains geared toward smaller organizations, and still has limitations, Bailey said.

“It is not dynamic enough for complex environments like large health systems or organizations with extensive third-party/vendor ecosystems,” he said. “It doesn’t fully integrate with ongoing risk monitoring, leaving gaps in timeliness – organizations still need to ensure they revisit and refresh their analysis regularly,” he said.

The tool provides guidance, not a substitute for having a true enterprise-wide risk management program, Bailey said. “Many organizations mistakenly believe using the tool alone checks the HIPAA compliance box, when OCR expects a more comprehensive approach.”

Walsh offers a similar assessment. “The SRA tool still aligns too closely with the HIPAA Security Rule, a rule that is outdated. Cybersecurity risks go beyond HIPAA and electronic protected health information,” he said. “Therefore, the tool is not a comprehensive – ‘thorough’ – risk analysis tool.”

Also, while the target audience for the tool is smaller healthcare sector organizations such as physician practices, “my years of experience tell me that most practice managers could not complete the questions in the SRA tool by themselves,” he said. “They would need assistance from their IT support vendor.”

Risk Analysis Wish List

So, what could HHS OCR do to its SRA tool in the future to better guide regulated entities in improving their HIPAA security risk analysis practices?

“One thing that could be helpful – tagging each question in the SRA with who – by job title – might be best qualified to answer a particular question,” Walsh said. For example, tagging an SRA question with “Is this a question for IT? My EHR vendor?” would be useful, he said.

Also, HHS should create a weighted value for questions, “as not all questions are as important as others,” Walsh suggests. “For example, having or lacking multifactor authentication is far more important than a written policy on user access,” he said.

Overall, Bailey said he would like to see HHS OCR expand resources tailored for larger and more complex organizations, perhaps through companion guidance that shows how to scale from the SRA tool to enterprise cyber risk management.

“More case-based examples, lessons learned from enforcement actions and sector-specific templates would also go a long way toward helping organizations move from a ‘checklist’ mindset to a true risk-based strategy,” he said.

“The updated SRA tool is a step in the right direction, particularly for resource-constrained organizations. The tool should be viewed as a starting point, not the finish line,” he said.

“We often remind clients that the goal is to operationalize risk analysis into an ongoing process – aligned with business goals, tied to governance and continuously refreshed as threats, technologies and organizational changes evolve.”

ASTP and OCR said they are hosting live webinars on Sept. 15 and Sept. 16 to help demonstrate the SRA tool’s new features, walk through reports and answer questions.