Ask a behavioral health director when their organization's last HIPAA security risk assessment was performed, and the most common answer is a pause. The second most common is a year that starts with "20" and ends uncomfortably long ago.
That matters because the Security Rule doesn't treat the risk analysis as a nice-to-have. It's a required administrative safeguard — and in practice, it's the first document the Office for Civil Rights requests when investigating a breach or running an audit. Arriving at that conversation without one doesn't just look bad; it's routinely cited in enforcement actions and settlements.
What a real risk assessment actually contains
A risk assessment is not a network scan, and it's not a certificate a vendor sells you. It's a documented analysis of where electronic protected health information lives in your organization and what could threaten it. Done properly, it covers:
- An inventory of every system that stores or transmits ePHI — your EHR, email, billing, telehealth platform, file shares, and the laptops in between
- The threats and vulnerabilities that apply to each — from ransomware to a lost laptop to a departed employee's lingering account
- The likelihood and impact of each risk, rated honestly
- The safeguards currently in place — and the gaps
- A prioritized remediation plan with owners and dates
How often is "current"?
The rule requires the analysis to be reviewed and updated periodically; the widely accepted standard is annually, plus after any significant change — a new EHR, a move to telehealth, a merger, an incident. If your assessment predates your current systems, it doesn't describe your actual risk, and regulators know it.
The knock-on benefits nobody mentions
A current risk assessment quietly powers everything else: it's the backbone of your cyber-insurance answers, the evidence funders and referral partners increasingly want, and the honest to-do list that keeps your security spending pointed at real risk instead of vendor noise.
If you can't put your hands on a risk assessment dated within the last twelve months, that's the project — before the next EHR feature, before the new laptops. For our behavioral health clients, the annual assessment is built into the service, not billed as a project.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →