Does a 5-person practice need a HIPAA risk analysis?
Short answer: Yes. The HIPAA Security Rule requires every covered entity to do a risk analysis, and there is no exemption for small practices. The rule lets a small office scale the work to its size, so a 5-person practice needs a lighter analysis, not none at all.
Why size doesn't get you out of it
The requirement is part of federal law (the HIPAA Security Rule, 45 CFR 164.308). It applies to every covered entity, which includes nearly every practice that bills insurance electronically. OCR has settled cases with small practices where the main finding was a missing risk analysis.
What "scaled to your size" means
- Fewer systems to review, so it goes faster.
- Simpler safeguards can be reasonable, for example two-step login (MFA) and good backups, rather than the systems a hospital would use.
- You still need it in writing, and you still need to act on what it finds.
Signs yours is out of date
- Nobody can find it, or it's more than a year old.
- It was a vendor's template with your name typed in.
- You've changed EHR, IT provider or office since it was written.
Common questions
We use a cloud EHR. Doesn't the vendor handle HIPAA?
The vendor protects its own systems. Your logins, devices, email, Wi-Fi and staff habits are still yours to assess.
Does a small practice need a penetration test too?
Insurers and health plans increasingly ask for one, and HHS has proposed adding it to the Security Rule. It is a separate check from the risk analysis.
Harborline helps outpatient medical, dental and behavioral health practices with about 5 to 100 staff. We run the HIPAA Security Rule risk analysis, do penetration testing in-house, and work alongside your IT provider until the fixes are verified. Tell us what you're facing and we'll set up a free 30-minute scoping call.
Contact us