{"head":{"title":"HIPAA Risk Assessment Checklist for Software | OceanLab","description":"Run a HIPAA security risk analysis step by step: scope, ePHI data map, threats, likelihood, impact and the fix plan, with 45 CFR citations. Export it.","canonical":"https://oceanlab.in/tools/hipaa-risk-assessment"},"tool":{"slug":"hipaa-risk-assessment","path":"/tools/hipaa-risk-assessment","name":"HIPAA risk assessment","h1":"HIPAA risk assessment checklist","lede":"Work through a HIPAA security risk analysis in 17 steps, from scoping ePHI to the fix plan, and export your progress.","category":"compliance","categoryTitle":"Compliance checklists","method":["The steps serve two Required specifications in 45 CFR 164.308(a)(1)(ii): (A) risk analysis and (B) risk management, quoted on the page from the CFR on govinfo.","The order follows NIST SP 800-30 Rev. 1: prepare, assess (threats, vulnerabilities, likelihood, impact, risk level), respond and maintain. Documentation and retention steps cite 164.316.","The wording is OceanLab's plain-English reading for engineering teams. The ONC / HHS Security Risk Assessment Tool is a free official alternative for small practices.","Your ticks are saved in this browser only. Export them as Markdown or print the page."],"sources":[{"label":"45 CFR 164.308 (administrative safeguards), CFR 2024 edition on govinfo","url":"https://www.govinfo.gov/content/pkg/CFR-2024-title45-vol2/xml/CFR-2024-title45-vol2-sec164-308.xml","checkedAt":"2026-10-25"},{"label":"ONC / HHS Security Risk Assessment Tool (version 3.7)","url":"https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool","checkedAt":"2026-10-25"},{"label":"NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments","url":"https://csrc.nist.gov/pubs/sp/800/30/r1/final","checkedAt":"2026-10-25"}],"faq":[{"question":"How often should we do a risk analysis?","answer":"The rule does not set a calendar. It asks you to keep it current, so re-run it when something changes: a new vendor, a new data flow, new infrastructure or an incident."},{"question":"How is this different from the HIPAA checklist?","answer":"The HIPAA checklist lists every Security Rule safeguard. This one walks through the risk analysis that decides which safeguards matter most for you."},{"question":"Does the official SRA Tool replace this?","answer":"It is a free tool from ONC and HHS aimed at small and medium practices. This checklist is shaped for software teams. Use whichever fits; the duty is the same."},{"question":"Is this legal advice?","answer":"No. It is guidance for engineering teams. Your compliance officer or counsel decides what applies to you."}],"notice":{"title":"Guidance, not legal advice.","text":"This checklist helps engineering teams run a risk analysis; your compliance officer or counsel decides what applies to you."},"updatedAt":"2026-10-25"},"related":[{"href":"/tools/hipaa-checklist","label":"HIPAA checklist","detail":"Work through every Security Rule safeguard with its citation and what it means for your code, then export your progress."},{"href":"/tools/ehr-integration-cost","label":"EHR integration cost","detail":"Pick the integration work (FHIR, SMART on FHIR, HL7 v2, patient matching) and get a cost and timeline range."},{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Turn the SOC 2 criteria into engineering tasks, pick the categories in scope, and track what is still open."}],"studies":[{"meta":{"slug":"sutura","industry":"healthdata","projectType":"Patient data hub","country":"us","tags":["healthcare","enterprise"],"compliances":["HIPAA Privacy Rule","HIPAA Security Rule","42 CFR Part 2","21st Century Cures Act (information blocking)","HL7 v2","HL7 FHIR R4 and US Core","SMART on FHIR","HL7 DS4P security labels","TEFCA","CMS Conditions of Participation"],"cover":{"src":"/case-studies/sutura/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR","description":"Designed and built a clickable patient data hub for a US health system running Epic, Oracle Health, athenahealth and eClinicalWorks: a live monitor for every HL7 v2, FHIR and HIE feed, one matched enterprise patient with a provenance-tagged record, and a duplicates queue where a person decides every uncertain match.","category":"Health Data / Patient Data Hub","client":"Northfork Valley Health"}}},{"meta":{"slug":"headgate","industry":"healthdata","projectType":"Claims & EHR integration API","country":"us","tags":["healthcare","enterprise"],"compliances":["CMS-9115-F","CMS-0057-F","HIPAA Privacy and Security Rules","HIPAA X12 transactions","HL7 FHIR R4 and US Core","SMART App Launch","FHIR Bulk Data","Da Vinci CRD, DTR and PAS","CARIN Blue Button"],"cover":{"src":"/case-studies/headgate/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization","description":"Designed and built a clickable console for the FHIR APIs a US regional health plan must run under federal interoperability rules: API health across Patient Access, Provider Directory, Formulary, Provider Access, Payer-to-Payer and Prior Authorization, a security review queue for third-party apps, and one clock for every prior authorization request, however it arrived.","category":"Health Data / Interoperability","client":"Juniper Basin Health Plan"}}},{"meta":{"slug":"loupe","industry":"clinics","projectType":"Specialty EHR","country":"us","tags":["healthcare","enterprise","ai"],"compliances":["HIPAA","21st Century Cures Act","ONC certification (FHIR R4, US Core)","DEA EPCS","FTC Eyeglass Rule","FTC Contact Lens Rule","ICD-10-CM and CPT","CMS MIPS","DICOM"],"cover":{"src":"/case-studies/loupe/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding","description":"Designed and built a clickable ophthalmology EHR for a US eye care group with seven clinics: a clinician's day at a glance, a live patient flow board with dilation timers, patient search with break-the-glass access, a chart summary with right-eye and left-eye findings side by side, and a structured exam workspace per eye.","category":"Healthcare / Specialty EHR","client":"Cedar Hollow Eye Associates"}}},{"meta":{"slug":"waypost","industry":"telehealth","projectType":"Remote patient monitoring","country":"us","tags":["healthcare","iot","enterprise"],"compliances":["HIPAA","Medicare RPM billing (CPT 99453-99458)","FDA medical device rules","ACC/AHA BP guideline","HEDIS CBP","WCAG 2.1 AA","HHS Section 504"],"cover":{"src":"/case-studies/waypost/01-home.png","width":1440,"height":1000}},"text":{"en":{"title":"Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts","description":"Designed and built a clickable remote patient monitoring platform for a US cardiology and primary care group: home blood pressure, weight and SpO2 readings from cellular devices, a risk-sorted alert queue for nurses, triage with the practice's protocol on screen, and live progress toward each patient's Medicare RPM billing requirements.","category":"Healthcare / Remote Patient Monitoring","client":"Brightwater Ridge Medical Group"}}}],"more":[{"href":"/case-studies/industry/healthdata","label":"Health data & interoperability case studies","detail":"Every OceanLab product build in Health data & interoperability."},{"href":"/case-studies/industry/telehealth","label":"Telehealth & patient apps case studies","detail":"Every OceanLab product build in Telehealth & patient apps."},{"href":"/case-studies/industry/clinics","label":"Hospitals & clinics case studies","detail":"Every OceanLab product build in Hospitals & clinics."},{"href":"/case-studies","label":"All case studies","detail":"Every OceanLab product build."},{"href":"/ai-automation","label":"AI automation","detail":"AI built into real business workflows, with people in charge."}],"today":"2026-10-25"}