HIPAA Security Risk Analysis: What Practices Get Wrong
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
If you run a medical, dental, or specialty practice with roughly 5 to 100 staff, you have probably been told you need a HIPAA security risk analysis. You may already have a binder, a vendor checklist, or a PDF from three years ago. That is common. The problem is not that you ignored the rule. The problem is that many practices buy the wrong thing and then discover the gap when a broker, payer, or OCR letter asks for proof.
This post is a plain-English list of what usually goes wrong, and what good looks like instead. Harborline serves practice admins and owner-physicians. We do not sell free assessments. A typical single-site HIPAA / 360 Risk Assessment is a fixed fee, scoped on a short call. The optional Annual Security Program is available if you want continuity after the first report.
1. Treating a scan or checklist as the risk analysis
A vulnerability scan lists technical issues. A checkbox PDF lists policies that may or may not match reality. Neither is a full Security Rule risk analysis.
A real analysis looks at people, process, technology, and vendors. It produces a written picture of risk to electronic protected health information, ranked findings, and owners for the work. If someone hands you only a scan and calls it your HIPAA risk assessment, ask what written analysis you can give a broker or counsel.
2. Buying a one-time souvenir and never running the plan
Controls drift. People leave. Vendors change. Carriers and payers ask again next year. A strong assessment that nobody runs becomes an expensive souvenir.
The Security Rule expects ongoing risk management. For a small team, that means a calendar, not a full-time security department. The Harborline Annual Security Program is built for that light rhythm: reassessment, quarterly check-ins, and capped async Q&A so renewals stop feeling like emergencies.
3. Confusing a risk assessment with a penetration test
A Security Rule risk assessment answers: where is the practice exposed as a business and regulated entity? A penetration test answers: what can a tester break technically in a scoped set of systems?
OCR and many cyber insurance applications start with a current risk analysis. Pen testing can be valuable later or in parallel. It does not replace Security Rule documentation. Harborline leads with the flat-fee assessment. Technical testing is scoped separately when you need it. See also our comparison on risk assessment vs penetration testing.
4. Leaving MFA, backups, and training out of the picture
Many practices focus on the EHR and forget the rest of the footprint:
- 1Email and remote access without multifactor authentication
- 2Backups that exist but have no dated restore test
- 3Training logs that do not match the current roster
- 4Business associates who touch PHI without a current inventory
Carriers increasingly ask for evidence on those points, not just yes/no attestations. A useful risk analysis surfaces those gaps with owners and timing, not a vague improve security note.
5. Waiting for a deadline to open the binder
Insurance renewal, a hospital questionnaire, or an OCR letter should not be the first time anyone opens last year's report. If the analysis is stale, say so honestly and plan the update. Harborline typical single-site delivery is 2 to 4 weeks after kickoff, depending on access to people and documents. If your deadline is inside that window, say so on the scoping call. We will tell you what fits.
6. Expecting the assessor to replace IT or counsel
Harborline owns the security and compliance program work: priorities, documentation, and evidence verification. Your IT team or MSP keeps running the technology. Counsel handles legal strategy on OCR or litigation matters. We do not do hands-on engineering as part of the standard assessment, and we do not replace your lawyer.
What a usable risk analysis should give you
- 1A current written risk analysis you can show leadership, counsel, or your broker
- 2Findings ranked by what to fix first, in language a practice admin can use
- 3Evidence you can reuse for insurance, payers, and regulator requests
- 4A clear path into annual rhythm if you want continuity, not a one-time binder
Dollar-of-risk figures, when used, are planning estimates for prioritization. They are not actuarial advice or coverage promises.
How fees work
Every Harborline service is a fixed fee, quoted in writing after a short scoping call. That covers the typical single-site assessment, extra remote or on-site locations (on-site visits add travel at cost), the Physical Security Walkthrough add-on, and the Annual Security Program. A typical single-site remote assessment often takes 2 to 4 weeks.
Educational content and a 30-minute scoping call are free. The assessment itself is always a paid engagement.
Book a 30-minute scoping call
Bring your site count, renewal date, last analysis date, or questionnaire if you have one. No SOW until both sides agree it makes sense.
Harborline · Contact · harborlinesec.com
Related Harborline pages
Further reading
HIPAA Compliance Guide for Practice Admins (Short)
A short HIPAA compliance guide for practice admins and owners at 5 to 100 staff clinics. What to keep current, what to ignore, and when to scope a flat-fee assessment.
HIPAA Security Rule: What Good Looks Like for Practices with 5 to 100 Staff
A practical picture of HIPAA Security Rule readiness for outpatient practices. Administrative, physical, and technical safeguards without enterprise theater.
Immutable Backups, Ransomware, and Insurance Evidence for Practices
Why cyber insurers ask for immutable or offline backups and a dated restore test. A practical evidence checklist for medical and dental practices.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.