Assessment vs Annual, in Plain English
A practice admin's plain-English guide to the difference between a one-time HIPAA risk assessment and an annual security program: What each leaves you holding, and how to tell which one your practice needs.
If you run the office at a small practice, you have probably been asked some version of this question by an owner-physician, a broker, or your MSP: "Do we just need the HIPAA risk assessment, or do we need the whole annual thing?"
It is a fair question, and the short answer is that they do different jobs. One gives you a clear picture of where you stand today. The other keeps that picture true for the rest of the year. This post explains both in plain terms so you can tell which one fits your practice right now.
(If you want the side-by-side comparison table, it lives on our one-time vs annual page. This post is about what each one actually feels like from the front office.)
What the risk assessment is
The HIPAA Security Rule requires every covered practice to do an accurate and thorough assessment of the risks to the electronic patient information it holds (HHS guidance on risk analysis). That is the risk assessment. It is not optional and it is not a one-page checklist.
A good one answers four questions:
- 1Where does patient information live? The EHR, yes, but also email, scanned faxes, the billing vendor, the shared drive, and the laptop that goes home on weekends.
- 2What could realistically go wrong with each? A phished email account, a lost laptop, a ransomware event at your MSP, a vendor breach.
- 3What protects it today, and does that protection actually work? Not "we have MFA," but which accounts have it and which do not.
- 4What should be fixed first? A ranked list, written for the people who will do the work, usually your IT team or MSP.
At Harborline, the assessment usually takes two to four weeks from kickoff to the written findings, depending on how many systems and vendors are involved and how quickly documents come back.
What you hold at the end: A written risk analysis, a ranked work plan, and a clear view of your biggest gaps. That documentation is often one of the first things an auditor, an insurer, or an OCR investigator asks to see.
What the assessment does not do
The assessment is a snapshot. It is true on the day it is written.
HHS says as much in its own guidance: The risk analysis process "should be ongoing," and it names the moments that should trigger a fresh look, such as a security incident, a change in ownership, turnover in key staff, or new technology (HHS).
Then the practice keeps moving. A new provider joins. The MSP changes the backup product. Someone sets up a new scheduling tool and connects it to the EHR. The front desk turns over. Six months later, the document in the binder describes a practice that no longer quite exists.
The assessment also does not close the gaps it finds. It tells you what to fix and in what order. Someone still has to own the work plan, chase the MSP, and collect proof that each fix is actually done.
What the annual program adds
An annual security program is the assessment plus the follow-through. In Harborline's annual program, the risk assessment is the first quarter, and the rest of the year is about keeping it true and getting the work plan finished:
- 1Quarterly check-ins. Four times a year we sit down with you, review what changed, update the risk picture, and move the work plan forward. Short meetings with a written follow-up, not a new report each time.
- 2An owned work plan. The fixes from the assessment get an owner, a target date, and a place to record proof. We work with your IT team or MSP; they run the technology, and we make sure the agreed gaps actually close.
- 3Evidence kept current. When the cyber insurance policy renewal arrives, or a payer sends a security questionnaire, the answers and the proof are already in one place. (Our post on what underwriters ask for now covers what that proof looks like.)
- 4A yearly reassessment. At the end of the year the assessment is refreshed, so the next one starts from a known baseline instead of from scratch.
- 5Questions answered in between. Send a short email when a vendor contract, a new tool, or an odd login alert makes you wonder whether it matters.
What you hold at the end of the year: A current risk assessment, a work plan with the highest-priority items closed and documented, and a year of records showing the practice kept watch. That last part is the piece many small practices are missing when someone asks.
Why "once and done" is getting harder to defend
Two things are pushing practices toward ongoing work rather than a single report.
First, the track record. In its 2016 and 2017 audits of 166 covered entities and 41 business associates, HHS found that most had not put in place the Security Rule requirements for risk analysis and risk management, the two pieces that are supposed to keep the picture current. HHS summarized those results in its January 2025 proposed rule (Federal Register).
Second, the rules may change. In January 2025, HHS proposed updates to the Security Rule that would make several reviews explicitly yearly, including a compliance audit at least once every 12 months and an update of the technology asset inventory at least once every 12 months (Federal Register notice). It is still a proposal, and its timing, final form, and whether it takes effect at all remain uncertain. Still, HHS guidance has pointed the same way for years: regulators expect the picture to be kept current, not filed away.
So which one do you need?
A one-time assessment can be the right call when:
- 1You have never had a real risk assessment and need a baseline before you decide anything else.
- 2Your IT team or MSP is strong and already runs a disciplined fix-and-document process, and you mainly need an independent view of the gaps. In that case the assessment is a check on good work, not a replacement for it.
- 3You are planning a bigger change, such as an EHR switch or a move, and want a clean snapshot before and after.
The annual program usually fits better when:
- 1Your last assessment found gaps that are still open a year later.
- 2Your cyber insurance policy renewal or payer questionnaires keep turning into a scramble for proof.
- 3Nobody in the practice owns security as a job, and the MSP waits to be told what to do.
- 4You add providers, locations, or vendors every year.
If you are unsure, start with the assessment. The annual program starts with the assessment too, so the findings carry forward either way, and they usually make the next decision obvious.
The short version
- 1The risk assessment tells you where you stand and what to fix first. Expect two to four weeks.
- 2The annual program keeps that answer true all year and gets the fixes to done, with proof.
- 3The risk analysis is required by the Security Rule (45 CFR 164.308). Keeping it current is what makes it useful when someone asks.
If you would like to talk through which fits your practice, send us a note with three times that work, and we will set up a short call about fit and scope.
Send us three times that work
Use the contact page to send three times that work, and we will set up a short call about fit and scope.
Harborline · Contact · harborlinesec.com
Further reading
What Underwriters Ask For Now (Evidence, Not Theater)
What cyber insurance questionnaires ask small practices about MFA, backups, and EDR, and the evidence a practice admin should have ready before signing.
HIPAA Risk Assessment for Outpatient Practices
A plain-language guide to HIPAA risk assessments for small outpatient clinics. What it covers, how long it takes, and what happens after.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.