Free guide · HIPAA Security Rule

The HIPAA Security Risk Analysis Checklist

The risk analysis OCR asks for first, and the safeguards it should cover.

  • How to scope ePHI, systems and business associates
  • Administrative, physical and technical safeguards to test
  • Where the 2025 Security Rule proposal stands

Get the free guide

Free PDF. We'll email you a copy too.

What's inside

5 sections, built to be used, not just read

Scope the analysis

4 items to check, with plain-English explanations.

Administrative safeguards

6 items to check, with plain-English explanations.

Physical safeguards

3 items to check, with plain-English explanations.

Technical safeguards

6 items to check, with plain-English explanations.

Rate and treat the risks

5 items to check, with plain-English explanations.

Common gaps we find

A quick reference table you can share with your team.

Your next 30 days

A short action plan so the guide turns into progress.

Who it's for

Built for

  • Medical practices and clinics
  • Health tech and SaaS companies that handle ePHI
  • Business associates such as billing, IT and cloud providers

Rather talk it through?

We run HIPAA security risk analyses for practices, health tech companies and their business associates, and help close what we find.

Book a 30-minute call