Skip to main content
Harborline
Guide for practice admins

Choosing a HIPAA Risk Assessment for a small practice

By Harborline team · Reviewed

If you run the office at a small practice, a HIPAA risk assessment can feel like one more thing on a long list. It does not have to be hard. This guide walks you through how to pick an assessor you can trust, so the work is useful and not just a form you file away.

Five questions to ask any assessor

  1. 1

    How do you run the assessment?

    Ask them to walk you through the steps. A good answer covers your systems, your people, your vendors and your physical office, not just a questionnaire.

  2. 2

    Does your method follow NIST SP 800-30?

    This is the risk method HHS points to for the Security Rule. You want risks rated by how likely they are and how much harm they would cause.

  3. 3

    Who will actually do the work?

    Ask whether the people on your kickoff call are the people doing the analysis, and how much healthcare experience they have.

  4. 4

    What will we receive at the end?

    Ask to see a sample. You should get a written risk analysis, a ranked list of fixes and evidence you can reuse with insurers and payers.

  5. 5

    Will you stay while we fix things?

    Many findings take months to close. Ask whether they check in, answer questions and confirm the evidence once fixes are done.

Red flags to watch for

  1. The whole assessment is a self-service checklist or software score.
  2. You get a long list of findings with no ranking and no plain next steps.
  3. No one talks to your staff, your IT contact or your MSP.
  4. The report looks the same as every other practice's report.
  5. No one can tell you who will answer questions after delivery.

Where Harborline fits

  1. Outpatient medical, dental and behavioral health practices with about 5 to 100 staff.
  2. Practices that want a real Security Rule risk analysis delivered in 2 to 4 weeks after kickoff, fixed fee, scoped on a short call.
  3. Teams that want a ranked plan in plain English and a partner who stays for the year through the Annual Security Program.
  4. Practices that also need a penetration test. Penetration testing is done in-house by our team. We don't take over your IT or EHR changes; your IT provider makes the fixes, and we verify them.

Where Harborline does not fit

  1. Large hospitals and health systems that need an enterprise team on site.
  2. Practices looking for a free assessment or a quick checkbox.
  3. Teams that want us to run their IT. Your IT provider makes the fixes, and we verify them.
FAQ

Common questions

Does a small practice really need a HIPAA risk assessment?

Yes. The HIPAA Security Rule asks every practice that handles electronic patient information to complete a risk analysis and keep it current. Size changes how big the job is, not whether it applies.

How long does a risk assessment take for a small practice?

For a typical single-site remote assessment, Harborline delivers in 2 to 4 weeks after kickoff. The pace depends mostly on how quickly your team can join short sessions and share documents.

Is compliance software the same as a risk assessment?

No. Software can help you track tasks and policies. A risk analysis looks at your actual systems, people and vendors, rates the risks and gives you a ranked plan to fix them.

What should we receive at the end?

A written risk analysis, a ranked list of fixes in plain language, and evidence you can reuse for insurers, payers and auditors.

What does it cost?

Harborline charges a fixed fee, scoped on a short call. We confirm scope together and quote the fee on that call.

Want to talk it through? A 30-minute scoping call is free and confirms fit and scope.

Book a 30-minute scoping call