HIPAA Security Risk Analysis Template (SRA)

Template Sections

1. Scope: legal entity, CE/BA role, facilities, systems with ePHI
2. Asset inventory: applications, databases, endpoints, cloud accounts, medical devices, vendors
3. Data flows: how ePHI is created, received, maintained, transmitted
4. Threats & vulnerabilities: ransomware, insider misuse, misconfig, lost media, vendor failure
5. Current controls: map to Administrative, Physical, Technical safeguards; note Required vs Addressable decisions
6. Likelihood × impact: scoring method documented
7. Risk treatment: mitigate / accept / transfer with owners and due dates
8. Sign-off: Security Officer / leadership approval, date, next review date

No binary Excel file is hosted here. Request a working tracker via contact.

How CyberSilo Helps

• CSA stores SRA rows, owners, and linked evidence
• ThreatHawk findings feed residual-risk updates

Frequently Asked Questions

Is a risk analysis Required?

Yes. Risk analysis is part of the Security Management Process under §164.308(a)(1) and is frequently cited in OCR enforcement.

How often should we update it?

When ePHI environments change materially and on a scheduled review cadence; retain documentation for 6 years under 164.316(b)(2).

Can a vendor SRA replace ours?

Vendor assessments help BA oversight but do not replace your organisation’s analysis of systems under your control.

Related HIPAA Resources

HIPAA hub · Risk assessment guide · Policies · CSA