Why the SRA Is Non-Negotiable

The Security Risk Assessment (SRA) is the single most important HIPAA compliance activity your organization performs. It is explicitly required under 45 CFR § 164.308(a)(1) and is the first thing OCR reviews during an audit or breach investigation. Organizations found to lack a documented, current SRA face automatic findings of non-compliance — regardless of how good their other controls are.

The SRA is not a one-time checkbox. It must be reviewed whenever there are significant operational changes (new software, new workflows, new staff roles) and at minimum annually.

Accessing the SRA in the Portal

From your Privacy Officer dashboard, click Security Risk Assessment in the left navigation, or navigate directly to the SRA section. The portal walks you through each domain of the assessment in a structured questionnaire format. You do not need to complete it in one sitting — your progress is saved automatically.

Tip: Block out 2–3 hours for your first SRA. Have your IT person or managed services provider available to answer technical questions about your systems and controls.

What Each Section Covers

The SRA is organized into the three domains HIPAA requires you to evaluate:

Administrative Safeguards

These questions cover policies, procedures, and workforce management. Topics include: security management process, assigned security responsibility, workforce training, access management, and contingency planning. For each question, select the response that most accurately reflects your current state — do not answer how you wish things were.

Physical Safeguards

These questions cover how you control physical access to ePHI. Topics include: facility access controls, workstation use policies, device and media controls, and disposal procedures. Think about every physical location where patient data can be accessed — including home offices if staff work remotely.

Technical Safeguards

These questions cover your IT controls. Topics include: access controls, audit controls, integrity controls, and transmission security (encryption). Your IT team or MSP should help with this section.

Tips for Accurate Answers

Answer based on current reality, not aspirational future state
If a control is partially implemented, choose "partial" — not "yes"
Use the notes field to document specifics (software names, dates, policy titles)
For questions about encryption, confirm with your IT vendor what is actually enabled
Involve your front desk and clinical staff for questions about physical access

Important: Do not guess on technical questions. An inaccurate SRA that overstates your controls is worse than a gap-filled one — it creates liability if a breach occurs and your actual controls don't match what you documented.

After Completing the SRA

Once you submit the SRA, the portal automatically generates your Gap Analysis report. This report identifies every area where your current controls fall short of HIPAA requirements and assigns severity levels. Proceed to Step 3 to learn how to read and act on that report.