What Is the Gap Analysis?

After you complete your Security Risk Assessment, the portal automatically generates a Gap Analysis report. This report compares your current security controls against the full set of HIPAA Security Rule requirements and surfaces every area where your organization falls short. Think of it as your compliance X-ray — it shows exactly where you are healthy and where there is work to do.

The Gap Analysis is not a grade or a judgment. It is a tool. Every organization, including well-run ones, has gaps — especially on first assessment. The goal is to identify them honestly and address them systematically.

Accessing Your Gap Report

From the Privacy Officer dashboard, navigate to Gap Analysis in the left menu. The report loads with a summary dashboard at the top showing your overall compliance percentage, a count of gaps by severity, and a breakdown by domain (administrative, physical, technical).

Scroll down to see the full gap list. Each row represents one control requirement. Use the Filter by Severity dropdown to focus on specific urgency levels.

Understanding Severity Levels

The portal uses four severity levels to classify gaps:

Critical

Controls that are required (not addressable) under HIPAA and are currently absent or severely deficient. Examples: no encryption on devices containing ePHI, no workforce training program, no risk assessment process. Critical gaps must be addressed before all others. They represent the highest legal exposure and the most likely breach vectors.

High

Required or strongly recommended controls that are significantly incomplete. Examples: audit logging enabled but never reviewed, access controls exist but terminated employees are not promptly deprovisioned. High gaps should be addressed within 30–60 days.

Medium

Controls that are partially implemented or addressable safeguards that are missing. Examples: contingency plan exists but has never been tested, physical access logs are kept but no one reviews them. Medium gaps should be addressed within 60–90 days.

Low

Documentation gaps, best practices that are not strictly required, or controls that are present but could be strengthened. Low gaps should be tracked and addressed as part of ongoing improvement but are not urgent.

Tip: Sort your gap list by severity descending and start at the top. Don't try to fix everything at once — HIPAA does not require perfection, it requires a documented, good-faith effort to address identified risks.

Reading Individual Gap Entries

Click any gap row to expand the detail panel. Each gap entry includes:

The specific HIPAA citation (e.g., § 164.312(a)(2)(iv)) so you can look up the exact regulatory language
What was found — a plain-English description of the control deficiency
Recommended remediation — specific actions to close the gap
Estimated effort — low, medium, or high effort to implement the fix

Important: The gap report reflects the state of your organization at the time of assessment. If you implement a fix, re-run the relevant SRA questions to update your report. The gap report is only as current as your most recent SRA responses.

Next Steps

Once you understand your gaps, move to Step 4 to create formal Remediation Plans for each gap. The portal links remediation plans directly to gap entries, creating an auditable record of your compliance work.