Document risks to ePHI
Identify where ePHI is held and how it moves, including relevant systems, locations, and business associates. The analysis records risks and the evidence supporting the findings.
HIPAA risk assessment.
An organization-wide analysis of risks to the electronic protected health information (ePHI) you create, receive, maintain, or transmit. We document systems, threats, vulnerabilities, safeguards, and prioritized risk-management actions.
- 2–4 weeksTypical delivery window
- All ePHISystems, locations, and vendors in scope
- Evidence mappedConclusions tied to what was reviewed
- Written planOwners, priorities, and next actions
When to use this service.
Support assessment requests
Use the documented analysis when responding to appropriate leadership, insurance, audit, or regulatory requests. Each request has its own scope and requirements.
Update an outdated analysis
Reassess when systems, locations, vendors, or threats change. A current analysis should reflect the environment and inform ongoing risk management.
Best fit: healthcare providers, dental groups, behavioral health organizations, and business associates that need a current, organization-wide analysis of risks to ePHI.
Not the right fit: organizations seeking a private HIPAA certification, legal advice, MIPS attestation completion, or an assessment limited to one device while other ePHI systems remain out of scope.
One analysis, four phases.
Each phase is a set of sub-services with documents you keep, and nothing assumes you have anything in place today. We never need actual patient records, only the systems that hold them.
-
Phase 01 · The foundation
Locate the ePHI
ePHI inventory and data flow: every system, device, and vendor touching patient data, and how it enters, moves, and leaves, from the EHR to the copier hard drive. Access and workforce review: every account checked, shared logins flagged, MFA verified, and the leaver process tested against reality.
-
Phase 02 · The risk analysis
Analyze the risk
Safeguard-by-safeguard analysis: every Administrative, Physical, and Technical safeguard scored met, partial, missing, or unverified, with its 45 CFR citation and a facility walkthrough. Risk determination: gaps ranked by real likelihood and impact, with the written decision memo for every addressable specification.
-
Phase 03 · The remediation
Fix and document
BAA register and vendor cleanup: every vendor touching PHI verified against a signed agreement, and the missing ones chased. Remediation plan and policy set: every risk on one tracked plan with an owner and a date, plus the HIPAA policies the rule expects, written to match how you actually operate and formally adopted.
-
Phase 04 · The defensible file
Prove and prepare
Contingency and breach readiness: backups verified with a live restore test, downtime procedures documented, and the notification duties and clocks written down before they are needed. The attestation pack: the full analysis assembled and signed by a CISSP-credentialed assessor, shaped to stand up to a MIPS audit or an OCR request.
The free snapshot on this site gives you a working price range. Your written quote itemizes each phase and sub-service. Your organization remains responsible for implementation and ongoing compliance; this analysis gives you the documented, prioritized path.
HIPAA risk analysis requirements.
HHS describes risk analysis as foundational and ongoing. It must cover all ePHI, document threats and vulnerabilities, assess likelihood and impact, and feed a risk-management process. No single assessment method guarantees compliance.
- HHS risk analysis guidanceRequired elements and ongoing review
- HHS OCR audit programCurrent audit scope and enforcement context
- CMS 2026 Security Risk Analysis measureMIPS measure requirements and attestation responsibility
- HHS certification guidanceWhy private certification is not HHS recognition
Sources last reviewed August 27, 2026. This page is general information, not legal advice.
Client reviews.
American Addiction Centers
We needed a security assessment that understood behavioral-health data and clinical operations. The advisors kept the conversation grounded, focused us on the risks that mattered most, and stayed involved so remediation did not become a side project.
Forefront Dermatology
I thought the assessment would just become another IT list. Hardenwell Cybersecurity Advisors helped turn it into priorities, and their follow-up kept clinic leadership out of the technical back-and-forth.
Schweiger Dermatology Group
Our biggest concern was disruption. The Hardenwell team understood that security work cannot slow down busy practices. They helped IT focus on the highest-risk items first and phase the rest around normal operations.
Frequently asked questions.
Standard assessment activities do not require patient-level records. We request redacted evidence and agree secure handling procedures before collection. Do not submit PHI through the website or booking form.
The documented analysis and resulting risk-management work can support the applicable measure. This engagement does not complete MIPS attestation or every Promoting Interoperability requirement. Your practice and MIPS advisor should confirm the current CMS specification.
We identify all locations and ePHI flows, assess shared systems, and review site-specific risks. Any sampling method and limitations are documented so the report does not imply that unreviewed areas were individually tested.
Consult qualified healthcare counsel promptly. We can scope a current assessment and help organize security evidence alongside your counsel. We do not provide legal representation, backdate records, or guarantee a regulatory outcome.
No. You receive a documented security risk analysis and risk-management plan, not a certification or a guarantee of HIPAA compliance. Your organization must also address its other applicable HIPAA obligations.
Why Hardenwell.
A dedicated advisor
A named, CISSP-certified advisor leads your engagement, with specialist support where needed. Responsibilities and the agreed deliverables are documented before work begins.
No referral commissions
We do not receive referral commissions from auditors, testing firms, brokers, or software vendors. External services are identified separately so you can review their scope and fees.
A written remediation plan
Everything we write is simple enough for leadership to approve and specific enough for your IT team or MSP to implement. One document, both audiences.
Book your HIPAA scope call.
Thirty minutes with an advisor.
We’ll cover your locations, EHR and supporting systems, current deadline, and the evidence already available. You’ll leave knowing the likely scope, timing, and next step.
Prefer phone or email?
(754) 216-9664 [email protected]
Do not include PHI or sensitive records in booking notes. See our Privacy Policy.