HIPAA Security Risk Analysis Worksheet for Small Practices
A guided risk analysis for solo and small therapy or counseling practices (45 CFR 164.308(a)(1)(ii)(A)). List where client information lives, rate each risk, plan the fixes, and print a dated report. Your work is saved in this browser only; nothing is uploaded.
Not legal advice and not a compliance certification. This worksheet follows the general approach in HHS and ONC guidance for a security risk analysis: inventory where ePHI lives, identify threats and vulnerabilities, rate likelihood and impact, document current safeguards, and plan fixes. It covers the risk analysis only, not your policies and procedures, workforce training, business associate agreements themselves, contingency plans, or breach notification. Review and update it at least once a year and after major changes such as a new EHR, a move, a new hire or a security incident.