The HHS Security Risk Assessment (SRA) Tool is a free, downloadable resource developed by the Office of the National Coordinator for Health Information Technology (ONC) in collaboration with the HHS Office for Civil Rights (OCR). It helps covered entities and business associates conduct a security risk analysis as required by the HIPAA Security Rule - specifically 45 CFR 164.308(a)(1)(ii)(A), which mandates an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI).
The tool is explicitly targeted at small and medium-sized providers (including many Critical Access Hospitals, rural clinics, solo practices, and similar organizations with limited IT resources and simpler environments). The official page states: "The target audience of this tool is medium and small providers; thus, use of this tool may not be appropriate for larger organizations." This aligns with guidance that smaller entities often have fewer variables (e.g., workforce members, systems) and more direct control, allowing tailored safeguards that differ from those needed in large, complex health systems with thousands of devices, intricate networks, and extensive shadow IT.
Key features include a guided, wizard-based questionnaire (156 questions in recent versions) covering administrative, physical, and technical safeguards. It helps identify threats/vulnerabilities, assess risks, suggest corrective actions, and generate reports (including remediation plans and audit-ready tracking with "reviewed-by" dates). There are two formats: a Windows desktop app (local storage, no HHS data transmission) and an Excel Workbook (cross-platform flexibility). Version 3.6 (current as of late 2025 updates) includes usability improvements, NIST-aligned risk scoring ("moderate" instead of "medium"), updated libraries, and better reporting.
It is not mandatory to use this tool, and using it does not guarantee full HIPAA compliance. It is a starting point - not exhaustive or definitive - and should be paired with expert advice for complex environments or when technical vulnerability scanning is needed (the tool itself is questionnaire-based and does not perform scans). Larger organizations may find it useful as a baseline or educational reference, but it often lacks depth for their scale.
For a 25-bed CAH or similar small/rural setup, this is often a practical, no-cost first step before engaging consultants (e.g., for validation or deeper analysis). Download it at https://www.healthit.gov/privacy-security/security-risk-assessment-tool/. Always document your process and consider follow-up with a qualified expert to ensure the output meets your specific risks.
