# HIPAA Security Rule risk analysis and compliance

> The HIPAA Security Rule requires covered entities, such as health plans and most healthcare providers, and their business associates to protect electronic protected health information with administrative, physical and technical safeguards. CyberAccord performs the required risk analysis, assesses gaps against the Security Rule, writes your security policies and builds a prioritized remediation plan.

Source: https://www.cyberaccord.com/compliance/hipaa · Last reviewed: 2026-10-21

We help covered entities and business associates protect electronic protected health information, starting with the risk analysis the HIPAA Security Rule requires. You get a clear picture of your risks and a practical plan to address them.

## Key facts

- **Who it applies to:** Covered entities and their business associates
- **What it protects:** Electronic protected health information (ePHI)
- **Enforced by:** HHS Office for Civil Rights (OCR)
- **Foundation:** A documented, current security risk analysis

## Who must comply with HIPAA?

HIPAA applies to covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically. It also applies to business associates, the vendors that create, receive, maintain or transmit protected health information on a covered entity's behalf.

That second group is wide. Cloud and IT providers, billing companies, software vendors and consultants can all be business associates, and they carry their own direct obligations under the Security Rule.

## What does the Security Rule require?

The Security Rule requires administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of ePHI. Everything starts with an accurate and thorough risk analysis, followed by risk management to bring those risks down to a reasonable level.

Missing or outdated risk analyses are among the issues OCR raises most often in its enforcement actions. The analysis should be reviewed periodically and whenever your environment changes. HHS has also proposed updates to the Security Rule, and we track that rulemaking for our clients.

## What we do

We perform a NIST-based, HIPAA-focused risk analysis that identifies where ePHI lives, the threats to it and the controls in place. We then test your environment against the Security Rule's standards and implementation specifications to find gaps.

From there we write the security plan and policies you need and give you a remediation plan ranked by risk, so your team knows what to fix first. Our approach is designed to fit around clinical and business operations, not interrupt them.

## What you get

- Security risk analysis covering systems that store or transmit ePHI
- Gap assessment against the HIPAA Security Rule standards
- Risk-ranked remediation plan
- Security policies and procedures written for your organization
- Security plan documenting administrative, physical and technical safeguards
- Guidance on business associate relationships and agreements

## How it works

1. **Scope and inventory.** We identify where ePHI is created, stored and transmitted, including systems run by vendors.
2. **Risk analysis and gap assessment.** We assess threats, vulnerabilities and existing safeguards, and compare your program against the Security Rule.
3. **Remediation plan and policies.** We deliver a prioritized plan and the written policies and procedures the Security Rule expects.
4. **Ongoing support.** We help you implement fixes and update the risk analysis as your environment changes.

## Frequently asked questions

### Is there an official HIPAA certification?

No. HHS does not certify organizations as HIPAA compliant, and no third party can issue an official certification. What you can show is documented evidence: a current risk analysis, policies, safeguards and a record of managing risk.

### We are a software vendor, not a healthcare provider. Does HIPAA apply to us?

It does if you create, receive, maintain or transmit protected health information on behalf of a covered entity. In that case you are a business associate, you will usually sign a business associate agreement, and the Security Rule applies to you directly.

### How often do we need a risk analysis?

The Security Rule does not set a fixed calendar interval, but it expects the analysis to be kept current and reviewed periodically and when your environment changes. Many organizations review it at least annually as a practical baseline.

### What is the difference between the Privacy Rule and the Security Rule?

The Privacy Rule governs how protected health information may be used and disclosed in any form. The Security Rule focuses on safeguarding electronic PHI. Our work centers on the Security Rule, and we coordinate with your privacy officer or counsel on Privacy Rule questions.

### Can you test our systems as part of HIPAA work?

Yes. Vulnerability assessments and penetration testing are useful inputs to a risk analysis because they show which weaknesses are real and exploitable. We scope testing to the systems that handle ePHI.

## Related

- [Data Privacy](https://www.cyberaccord.com/compliance/data-privacy): Data privacy compliance for GDPR and CCPA/CPRA, including data mapping, gap assessment, security controls and Data Protection Impact Assessments.
- [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing): Manual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- [Managed Security](https://www.cyberaccord.com/services/managed-security): Managed device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you.
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso): A part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com
- Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054