A HIPAA risk analysis, built and kept current.
The HIPAA Security Rule requires an accurate and thorough risk analysis today, whatever happens to the proposed update. The Blueprint is a readiness assessment, not a full risk analysis. The full risk analysis is delivered in the Operator Program during the first quarter, and we map your policies to it, track your business associate agreements (BAAs), and keep all of it current.
The update is proposed. The risk analysis is required now.
Plenty of vendors are selling fear about a new HIPAA rule. Here is the plain status, as of October 2026.
If it is finalized as proposed, it would remove the "addressable" category, which today lets a practice adopt an equivalent safeguard or document why one does not apply. Controls like multi-factor authentication (MFA) and encryption would become mandatory, and the rule would add yearly asset inventories, network maps, and compliance reviews.
We do not build your plan around a rule that may change. We build it around what is required today, which already covers most of that list, and keep it ready for the direction the proposal points.
Earliest target for a final Security Rule update, after HHS moved it to its long-term actions list. Long-term usually means no final rule within 12 months.
Source: Clark Hill, on the Fall 2026 Unified Agenda (July 2026).
Enforcement action under the HHS Office for Civil Rights (OCR) Risk Analysis Initiative, announced mid-2026. Missing or weak risk analysis keeps showing up as the finding.
Source: Nixon Peabody (July 2026).
A template is not a risk analysis.
Some practices have something they call a Security Risk Analysis that is really a downloaded template, partly filled in, last updated when the electronic health record (EHR) went in.
-
It is the first document asked for after a breach
A practice is far more likely to face OCR after a breach or complaint than from a random audit. When that happens, the risk analysis is what gets reviewed first.
-
Insurance applications ask for it
Cyber and practice insurance applications often ask whether you have a current risk analysis. A real one lets you answer yes and back it up.
-
Your EHR vendor covers only its own walls
The EHR protects patient data inside its system. It does not check your workstations, your former staff's access, your other vendors, or your front office.
Three safeguard categories, every requirement.
The Security Rule groups safeguards into administrative, physical, and technical. We assess against the rule as it stands today and note where the proposed update would raise the bar.
Security management process
The risk analysis itself, the risk management plan, sanction policy, and review of system activity.
Workforce security and access
Authorization and supervision, clearance, termination procedures, and how access is granted and changed.
Security awareness and training
Security reminders, malware protection, login monitoring, password management, and proof that training happened.
Incidents and contingency planning
Incident procedures, data backup, disaster recovery, emergency operations, and testing of each.
Business associate agreements
An inventory of every business associate, the BAA on file for each, and the security terms in those contracts.
Facility access
Facility security plan, access control and validation, maintenance records, and contingency operations.
Workstations and devices
Workstation use and placement, device and media controls, disposal, reuse, and backup.
Access and audit controls
Unique user IDs, emergency access, automatic logoff, encryption, and review of audit logs.
Integrity, authentication, transmission
Protecting patient data from improper change, confirming who is signing in, and encrypting data in transit.
The Security Risk Analysis, with the proof behind it.
Delivered in the Operator Program during the first quarter. A document with a stated method and scope, every safeguard rated on impact and likelihood, and every finding tied to the evidence that shows the control is real.
- Scope and methodPractice profile, where patient data lives, systems in scope, and dates.
- Threats and vulnerabilitiesThe reasonably expected threats to the confidentiality, integrity, and availability of patient data.
- Safeguard analysisEach administrative, physical, and technical safeguard: current state, gaps, and priority.
- Risk ratingImpact and likelihood scored for each finding, with the reasoning written out.
- Evidence appendixPolicy excerpts, configuration exports, training records, and the BAA inventory.
- Risk management planThe companion plan the rule requires: prioritized fixes, owners, and target dates.
Find the gaps first. Then close and keep them closed.
We keep HIPAA readiness current as staff, vendors, and systems change. It runs through the same two steps as the rest of our work.
The 21-Day Do More With Less Blueprint for Healthcare Practices
A readiness assessment, not a full risk analysis. A readiness score and risk map organized around the Security Rule safeguards, so you see where the HIPAA gaps are and what to fix first.
- Risk map and quick wins across the three safeguard categories
- Policy recommendations, including AI use with patient data
- A 12-month roadmap and an insurance questionnaire evidence pack
The Operator Program
The full Security Risk Analysis and risk management plan, delivered during the first quarter and then kept current, with your policies and BAA inventory maintained alongside it.
- Quarterly risk reviews and policies kept current
- Vendor and business associate reviews on Growth and Partner
- Incident response on call on Partner
The full Blueprint fee is credited toward the first quarter of an Operator Program retainer if you sign within 30 days of the readout. We work alongside your IT provider and your EHR vendor.
What practices ask before they start.
Is the new HIPAA Security Rule final?
No. The update was proposed in January 2025 and has not been finalized. HHS has moved it to its long-term list with a target of no earlier than July 2027, and has not said whether a final rule will be published. If it is finalized, the proposal gave practices about 240 days to comply. The risk analysis requirement applies today either way.
We already have a risk analysis from a template or a vendor. Do we need this?
It depends on what you have. A partly filled template with no risk ratings and no evidence will not hold up when someone asks for proof. If you have a current analysis done by a qualified party, we review it and tell you plainly whether it needs a refresh.
Is the Blueprint a HIPAA risk analysis?
No. The Blueprint is a readiness assessment, not a full HIPAA Security Rule risk analysis. The full risk analysis is delivered in the Operator Program during the first quarter.
Do you sign a business associate agreement?
Yes. We sign a business associate agreement (BAA) before touching any system with patient data. We provide ours or review yours. No patient data before a signed BAA.
How much of our time does this take?
The Blueprint takes about 2 hours of your time in total. Building the full risk analysis in the Operator Program takes a few working sessions with your practice manager and a clinical lead. We do the document review, configuration capture, and writing.
Can this help with our insurance application?
Yes. Insurance applications often ask whether you have a current risk analysis. Every Blueprint includes a cyber insurance questionnaire evidence pack, and the risk analysis gives you a documented answer.
What does it cost?
The Blueprint is $4,500 for practices up to 50 employees and $7,500 for 51 to 150. The full risk analysis and ongoing upkeep run inside the Operator Program, which starts at $4,000 a month. The full Blueprint fee is credited toward the first quarter of an Operator Program retainer if you sign within 30 days of the readout.
This page is general information, not legal advice. For questions about your specific obligations, talk with your healthcare counsel.
HIPAA readiness
Know where your practice actually stands.
A 30-minute call. Bring what you have today, even if it is a half-finished template, and any deadline driving the question. You leave knowing what is missing and what to do first.