HIPAA Risk Assessment Checklist for Software

Progress

0 of 17

0% done. Ticks are saved in this browser only.

Risk analysis, 164.308(a)(1)(ii)(A): “Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”

Risk management, 164.308(a)(1)(ii)(B): “Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).”

Required done: 0 of 16
1. Prepare: 0 of 3
2. Assess: 0 of 6
3. Respond: 0 of 4
4. Maintain: 0 of 4

1. Prepare

Set the scope45 CFR 164.308(a)(1)(ii)(A) · Core stepList every system, environment and vendor that creates, receives, keeps or sends ePHI: production, staging with real data, backups, laptops, analytics, support tools and LLM providers.
Map where ePHI flows45 CFR 164.308(a)(1)(ii)(A) · Core stepDraw each flow from entry to deletion: forms, APIs, queues, logs, exports, emails. Note which fields are ePHI and where they are encrypted.
Name owners and the method45 CFR 164.308(a)(2) · Core stepName the security official, the people who run the analysis, and the rating scale you will use for likelihood and impact.

2. Assess

List threatsNIST SP 800-30 r1 · Core stepWho or what could harm ePHI: stolen credentials, a leaked API key, ransomware, an insider, a vendor breach, a misconfigured bucket, an outage.
List vulnerabilities45 CFR 164.308(a)(1)(ii)(A) · Core stepWeak points each threat could use: missing MFA, broad IAM roles, unpatched dependencies, ePHI in logs, no restore test, unsigned webhooks.
Record current controls45 CFR 164.308(a)(1)(ii)(A) · Core stepFor each pair, note the control already in place and whether it works (with evidence: config, screenshot, test result).
Rate likelihoodNIST SP 800-30 r1 · Core stepRate how likely each threat is to use each vulnerability, given current controls, on the scale you chose.
Rate impactNIST SP 800-30 r1 · Core stepRate the harm to confidentiality, integrity and availability of ePHI if it happens: patients affected, records exposed, downtime.
Set a risk level45 CFR 164.308(a)(1)(ii)(A) · Core stepCombine likelihood and impact into one level per risk and rank the list. This ranked list is the risk analysis.

3. Respond

Plan the fixes45 CFR 164.308(a)(1)(ii)(B) · Core stepTurn each risk above your threshold into a ticket with an owner, a due date and the control that will reduce it.
Write down accepted risks45 CFR 164.308(a)(1)(ii)(B) · Core stepFor any risk you accept, record why it is reasonable and appropriate, and who signed it off.
Check vendor agreements45 CFR 164.308(b) · Core stepConfirm a business associate agreement is in place with every vendor in scope.
Report to leadershipNIST SP 800-30 r1 · RecommendedShare the top risks, the plan and the accepted risks with whoever owns the budget.

4. Maintain

Keep the analysis on file45 CFR 164.316(b)(1) · Core stepStore the analysis, ratings and decisions in writing, versioned, where auditors can find them.
Keep it for six years45 CFR 164.316(b)(2)(i) · Core stepKeep each version for 6 years from when it was created or last in effect.
Re-run it when things change45 CFR 164.308(a)(8) · Core stepRe-assess after a new vendor, a new data flow, new infrastructure or an incident, not only on a calendar.
Review activity regularly45 CFR 164.308(a)(1)(ii)(D) · Core stepReview audit logs, access reports and alerts, and feed what you find back into the risk list.

Ask OceanLab to help close the gaps

Opens an email to OceanLab with this result and a link to your inputs. Nothing is sent until you press send, and there is no sign-up.

Prefer a form? Use the contact page.

Method

How this is calculated

The steps serve two Required specifications in 45 CFR 164.308(a)(1)(ii): (A) risk analysis and (B) risk management, quoted on the page from the CFR on govinfo.

The order follows NIST SP 800-30 Rev. 1: prepare, assess (threats, vulnerabilities, likelihood, impact, risk level), respond and maintain. Documentation and retention steps cite 164.316.

The wording is OceanLab's plain-English reading for engineering teams. The ONC / HHS Security Risk Assessment Tool is a free official alternative for small practices.

Your ticks are saved in this browser only. Export them as Markdown or print the page.

Sources

45 CFR 164.308 (administrative safeguards), CFR 2024 edition on govinfo · checked 2026-10-25
ONC / HHS Security Risk Assessment Tool (version 3.7) · checked 2026-10-25
NIST SP 800-30 Rev. 1, Guide for Conducting Risk Assessments · checked 2026-10-25

FAQ

Questions about this tool

How often should we do a risk analysis?

The rule does not set a calendar. It asks you to keep it current, so re-run it when something changes: a new vendor, a new data flow, new infrastructure or an incident.

How is this different from the HIPAA checklist?

The HIPAA checklist lists every Security Rule safeguard. This one walks through the risk analysis that decides which safeguards matter most for you.

Does the official SRA Tool replace this?

It is a free tool from ONC and HHS aimed at small and medium practices. This checklist is shaped for software teams. Use whichever fits; the duty is the same.

Is this legal advice?

No. It is guidance for engineering teams. Your compliance officer or counsel decides what applies to you.

Related tools

Other free tools

HIPAA checklistWork through every Security Rule safeguard with its citation and what it means for your code, then export your progress.EHR integration costPick the integration work (FHIR, SMART on FHIR, HL7 v2, patient matching) and get a cost and timeline range.SOC 2 checklistTurn the SOC 2 criteria into engineering tasks, pick the categories in scope, and track what is still open.All toolsEvery OceanLab calculator and checklist, by category.

Product builds

OceanLab product builds like this

Products OceanLab designed and built. Each case study covers the screens, the scope and the rules it was built for.

Health data & interoperability·🇺🇸United States

Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR

Designed and built a clickable patient data hub for a US health system running Epic, Oracle Health, athenahealth and eClinicalWorks: a live monitor for every HL7 v2, FHIR and HIE feed, one matched enterprise patient with a provenance-tagged record, and a duplicates queue where a person decides every uncertain match.

HealthcareEnterprise

Health data & interoperability·🇺🇸United States

Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization

Designed and built a clickable console for the FHIR APIs a US regional health plan must run under federal interoperability rules: API health across Patient Access, Provider Directory, Formulary, Provider Access, Payer-to-Payer and Prior Authorization, a security review queue for third-party apps, and one clock for every prior authorization request, however it arrived.

HealthcareEnterprise

Hospitals & clinics·🇺🇸United States

Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding

Designed and built a clickable ophthalmology EHR for a US eye care group with seven clinics: a clinician's day at a glance, a live patient flow board with dilation timers, patient search with break-the-glass access, a chart summary with right-eye and left-eye findings side by side, and a structured exam workspace per eye.

HealthcareEnterpriseAI

Telehealth & patient apps·🇺🇸United States

Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts

Designed and built a clickable remote patient monitoring platform for a US cardiology and primary care group: home blood pressure, weight and SpO2 readings from cellular devices, a risk-sorted alert queue for nurses, triage with the practice's protocol on screen, and live progress toward each patient's Medicare RPM billing requirements.

HealthcareIoTEnterprise

HIPAA risk assessment checklist

Ask OceanLab to help close the gaps

How this is calculated

Sources

Questions about this tool

Other free tools

OceanLab product builds like this

Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR

Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization

Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding

Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts

Your Next Mission-Critical
System Starts Here

Ask OceanLab to help close the gaps

How this is calculated

Sources

Questions about this tool

Other free tools

OceanLab product builds like this

Sutura - HIPAA-Compliant Patient Data Hub over HL7 and FHIR

Headgate - FHIR Interoperability API Platform for Claims, Clinical Data and Prior Authorization

Loupe - Ophthalmology EHR with Per-Eye Charting and Laterality-Aware Coding

Waypost - Remote Patient Monitoring Platform with Risk-Sorted Alerts

Your Next Mission-CriticalSystem Starts Here

Your Next Mission-Critical
System Starts Here