HIPAA Risk Analysis: Follow the Patient Data

HIPAA risk assessment is a documented evaluation of threats and vulnerabilities affecting the electronic protected health information a practice creates, receives, maintains, or transmits. For independent practices, it means identifying where patient data lives, evaluating existing safeguards, and prioritizing corrective actions—not simply completing a questionnaire or relying on an EHR vendor.

HIPAA Risk Analysis: Follow the Patient Data

An OB/GYN practice may protect its main patient chart carefully while overlooking ultrasound exports, downloaded fertility records, or an old laptop used for remote charting. A useful assessment follows information through the entire practice, including the places outside the EHR.

The HIPAA Security Rule calls this process a risk analysis. It is distinct from risk management: the analysis identifies and evaluates risks; risk management implements measures to reduce them. A checklist supports both activities, but checked boxes alone do not establish that the analysis is accurate and thorough.

Set the scope before inspecting safeguards

Assign someone to coordinate the assessment and identify who can explain clinical workflows, billing, technology, and vendor relationships. A small practice can use outside expertise, but it still needs an internal owner who can approve changes and track unresolved risks.

Document the locations, systems, people, and workflows included. The scope should cover all electronic protected health information, or ePHI, not just the production EHR. Paper records and spoken disclosures also need privacy safeguards, but they should not distract from a complete electronic-data inventory for the Security Rule analysis.

Start with these checks:

• Identify every practice location, remote work arrangement, and off-site storage location.
• List EHR, billing, scheduling, portal, telehealth, email, imaging, and document-management systems.
• Include laptops, phones, scanners, ultrasound equipment, removable drives, backups, and retired devices awaiting disposal.
• Identify outside organizations that create, receive, maintain, or transmit ePHI for the practice.
• Record how information enters, moves through, leaves, and is deleted from each system.

For each inventory entry, capture the system owner, data involved, authorized users, storage location, and connected vendors. Ask staff to demonstrate actual work rather than describing only the approved process.

A small-practice scenario

For independent OB/GYN practices with limited IT support, a useful assessment starts with one practical condition: staff must be able to show where patient information goes during an ordinary workday. Written policies alone will not reveal temporary downloads, shared devices, or exceptions made when a clinician is running behind.

1. Hypothetical example: A two-clinician office exports ultrasound reports to a desktop folder before uploading them into the chart. The assessment finds that the folder remains accessible through a shared Windows account and is not included in the documented backup process. The practice records the affected data, the access weakness, and the potential consequences of disclosure or loss. It assigns an owner to replace shared access, establish an approved transfer process, and confirm recoverability. After implementation, the owner tests the workflow and saves evidence of the correction. This produces a defensible risk-management record rather than another unchecked policy promise.

Inspect the controls where work actually happens

Use the following checklist to collect evidence. A policy is useful evidence of an intended safeguard; a configuration review, access report, or observed workflow helps show whether that safeguard operates in practice.

Do not treat every recommended technology as an identical legal requirement. Under the Security Rule framework, an “addressable” implementation specification is not simply optional: the practice must assess whether it is reasonable and appropriate and document its decision and any appropriate alternative. Use the HHS Security Rule overview to distinguish regulatory requirements from implementation choices.

Give sensitive workflows their own review

OB/GYN information can create substantial harm when exposed to the wrong person. Review portal proxy access, shared contact information, and message routing alongside technical controls. These workflows may raise Privacy Rule and state-law questions as well as security risks.

• Confirm how proxy access is authorized, changed, and revoked, including when a patient's circumstances or legal status changes.
• Check whether reminders, notifications, and voicemail practices honor applicable confidential communication requirements.
• Examine how outside records are matched to the correct patient and released to the correct recipient.
• Identify exports containing reproductive, genetic, or other sensitive information and whether unnecessary copies persist.

Do not assume that a portal configuration resolves every question involving minors, personal representatives, or sensitive records. Escalate jurisdiction-specific questions to qualified counsel and document the workflow decisions that follow.

Assess vendors—including AI tools

Cloud hosting does not transfer the practice's entire HIPAA responsibility to the vendor. Determine which safeguards the vendor manages and which remain with the practice, such as user permissions, endpoint security, and account termination.

• Determine which vendors are business associates and obtain business associate agreements where required.
• Review subcontractor arrangements, incident reporting, data return or deletion, and termination provisions.
• Ask how backup, restoration, access logging, and support access work.
• Identify AI transcription or documentation tools that receive recordings, transcripts, or chart information.
• For those tools, establish permitted uses, retention, access controls, and whether data may be used for purposes beyond the contracted service.

A signed agreement does not replace security evaluation. The HHS business associate guidance explains when these relationships require contractual protections.

When evaluating IKON EMR or another EHR, request documentation and demonstrations relevant to these workflows. Record what is available, how it must be configured, and who is responsible for maintaining it; do not infer compliance from a product label.

Turn findings into a prioritized risk register

For every finding, describe the affected information, the threat, the vulnerability, existing controls, and the likely consequences. Consider confidentiality, integrity, and availability: inappropriate access, an altered record, and unavailable prenatal results are different problems that all deserve attention.

Use a consistent likelihood-and-impact method, such as defined low, medium, and high categories. Explain each rating rather than assigning unexplained scores. HHS does not prescribe one universal scoring formula.

Your risk register should include:

• Finding and evidence: What was observed, where, and when.
• Risk rating and rationale: Why the event is plausible and what harm could follow.
• Corrective action: The specific change that will reduce risk.
• Owner and deadline: Who is accountable and when completion is expected.
• Interim protection: What reduces exposure before the permanent fix.
• Validation and residual risk: How the change was tested and what risk remains.

Address urgent exposure promptly rather than waiting for the entire report. When a finding suggests an actual security incident or possible breach, activate the incident-response process separately; a remediation ticket is not a substitute for required investigation or notification analysis.

Keep evidence—and revisit the analysis

Save the assessment scope, inventory, methodology, findings, supporting evidence, and risk-management decisions. HIPAA-required Security Rule documentation generally must be retained for six years from creation or the date it last was in effect, whichever is later. That requirement should not be confused with a universal six-year retention period for every technical log.

HIPAA does not set a single annual deadline for every risk analysis. Establish a regular review schedule and update the analysis as needed after material changes, such as a new location, new AI tool, major system migration, or security incident. The HHS guidance on risk analysis describes the core elements and the need for ongoing evaluation.

The useful endpoint is not a completed questionnaire. It is a current map of patient information, a reasoned account of its risks, and documented evidence that the practice is reducing those risks without losing sight of patient care.