Is the Free HHS SRA Tool Enough for a Small Practice?
The free HHS SRA Tool helps small practices document risk. Here is when it is enough, where it falls short, and what to do after.
If you run a small medical or dental practice, you know you need a HIPAA security risk analysis, and you may have found that HHS offers a free tool for it. So the fair question is: is the HHS SRA Tool enough for a small practice?
The honest answer: for some practices, yes. For many, the tool is a good start, and the gap shows up after the last question is answered.
The short answer, up front
The free tool is fine on its own when:
- 1Your practice is small and simple: one location, a handful of systems, few vendors with access.
- 2Someone on your team has the time and patience to work through every section carefully.
- 3You already have a habit of fixing what the tool finds and writing down what you did.
- 4Nothing big has changed since your last review: no new EHR, no new location, no remote staff.
It falls short when the findings sit in a report and nothing gets fixed or tracked, when you have more than one location or remote access, or when nobody owns the follow through.
You do not need outside help if all four points above describe you. There is no rule that says a practice must hire someone. The tool exists so small practices can do this work themselves.
What the HHS Security Risk Assessment Tool actually is
The Security Risk Assessment Tool was built by ONC in collaboration with the HHS Office for Civil Rights to help providers do the risk assessment the HIPAA Security Rule requires. Its target audience is small and medium providers, and ONC notes it may not be appropriate for larger organizations.
Version 3.7 comes as a Windows application and an Excel workbook. Your answers stay on your own computer. HHS does not collect, view, store or transmit anything you enter.
Version 3.7 also added helpful updates:
- 1A scope question so the assessment covers every location that creates, receives, maintains or transmits ePHI.
- 2A remote access and telework question.
- 3A modernized asset inventory.
- 4Review triggers that tell you when to update the assessment.
The tool is also candid about its limits. It reminds users that the survey alone may not identify all risks in an organization. That is worth taking seriously.
Where small practices get stuck
The tool helps you find and record risk. It does not fix anything. That second half, risk management, is where many practices stall.
Federal audit data backs this up. In OCR's 2016 to 2017 audits, 63 covered entities were reviewed on Security Rule compliance. Only 14 percent of them were substantially fulfilling their responsibilities for risk analysis, and 94 percent failed to implement appropriate risk management activities. The problem was rarely knowing that risk existed. It was what happened, or did not happen, afterward.
If you want the common mistakes inside the assessment itself, we covered those in what practices get wrong on the HIPAA SRA. Here we will stay on the follow through.
What "after the tool" looks like
A finished survey is a snapshot. Staying in good shape means doing four things with it:
- 1Rank what you found by how likely it is and how much harm it could cause.
- 2Give each item an owner and a target date.
- 3Keep a short written record of what you did, when, and why.
- 4Repeat the review when something changes: new software, a new location, staff turnover, or an incident.
That is a light routine, and a practice manager can run it. The hard part is keeping it going in a busy office.
A note on the proposed Security Rule update
In January 2025, HHS published a proposed rule to update the Security Rule (Federal Register document 2024-30983, 90 FR 898). It is still a proposed rule, not a final one, so nothing in it is required today.
It is still useful for readiness. The proposal says an accurate and thorough risk analysis already requires an inventory of your technology assets and a map of how ePHI moves through your systems, and it would make those steps explicit. If you build an asset list and a simple data flow now, you are ready whichever way the final rule lands.
For a plain walkthrough of a full assessment, see HIPAA risk assessment for outpatient practices. If you are weighing a one time assessment against ongoing help, Assessment vs Annual, in plain English lays out what each one leaves you holding.
When outside help makes sense
You might want a second set of eyes if:
- 1Your team does not have the time or the technical background to dig into every answer.
- 2You have had a security incident, even a small one.
- 3You have several locations, remote staff, or many vendors with system access.
- 4You finished the tool before, but the follow up stalled and little got fixed.
- 5You want a clear, dated record of your analysis and your plan.
A led assessment at Harborline takes 2 to 4 weeks. It covers the same ground as the SRA Tool, checks the answers against what is actually in place, and ends with a written, ranked plan your team or your IT provider can work through.
The bottom line
The free HHS SRA Tool is a solid, well built resource, and using it beats doing nothing. For a small, simple practice with someone who follows through, it can be enough.
Where it falls short is not the survey. It is everything after it. Risk analysis and risk management are two different jobs, and you need both.
If you are not sure your current process covers both, send us a note and we will help you figure out where your practice stands.
Frequently asked questions
Can a small practice use the free HHS SRA Tool for its risk analysis?
Yes. ONC and HHS OCR built it for small and medium providers to help with the risk assessment the Security Rule requires. Using the tool does not by itself mean you are compliant; the Security Rule asks for an accurate, thorough risk analysis plus risk management that addresses what it finds.
How often should we update our risk assessment?
Review it on a regular schedule and whenever something significant changes, such as new technology, a new location, staffing changes or a security incident. Version 3.7 of the tool includes review triggers to help with this. Many practices do a full review once a year as a habit.
What is the difference between risk analysis and risk management?
Risk analysis finds and documents the threats and weak spots that apply to your practice. Risk management is fixing them, tracking progress and updating as things change. The Security Rule requires both.
Sources (verified 2026-11-02)
- 1ONC Security Risk Assessment Tool page: https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool
- 2Federal Register, HIPAA Security Rule NPRM, Jan 6, 2025, doc 2024-30983, 90 FR 898: https://www.federalregister.gov/documents/2025/01/06/2024-30983/hipaa-security-rule-to-strengthen-the-cybersecurity-of-electronic-protected-health-information
- 3HHS OCR, 2016-2017 HIPAA Audits Industry Report (December 2020): https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf
Send us three times that work
Use the contact page to send three times that work, and we will set up a short call about fit and scope.
Harborline · Contact · harborlinesec.com
Related Harborline pages
Further reading
HIPAA Security Risk Analysis: What Practices Get Wrong
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
HIPAA Risk Assessment for Outpatient Practices
A plain-language guide to HIPAA risk assessments for small outpatient clinics. What it covers, how long it takes, and what happens after.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.