HIPAA security risk analysis: what healthcare organizations should actually review in 2026

A HIPAA security risk analysis should explain where electronic protected health information exists, how it could be compromised, what safeguards are in place and what the organization will do about identified risk.

Start with the actual ePHI environment

Before scoring risks, map where ePHI is created, received, maintained or transmitted. That may include EHR systems, billing platforms, clearinghouses, payer portals, Microsoft 365, file shares, laptops, remote workstations, mobile devices, backups and third-party applications.

Review identity and access

• How users are provisioned and terminated.
• Whether shared accounts exist.
• How privileged access is assigned.
• Authentication and MFA coverage.
• Guest, vendor and remote access.
• Periodic access review practices.

Review endpoint and device protections

Identify whether devices accessing ePHI are managed, encrypted, supported, protected by endpoint security and configured with appropriate screen-lock and patch controls. Exceptions should be documented rather than assumed away.

Review audit controls and visibility

The HIPAA Security Rule includes an audit-controls standard. The risk analysis should therefore consider whether relevant systems create useful logs, who reviews them, what alerts exist and whether the organization can investigate suspicious activity.

Review ransomware and recovery exposure

HHS enforcement activity in 2026 continues to highlight ransomware and risk analysis. Backups are only one part of resilience. Organizations should understand backup isolation, administrative access, retention, restoration procedures and when recovery was last tested.

Review third parties and business associates

Healthcare environments depend heavily on billing vendors, MSPs, cloud providers, EHR vendors and other service providers. The assessment should identify which relationships involve ePHI, what contractual safeguards apply and what security evidence is available.

Turn findings into a risk-management process

The assessment is not complete when risks are listed. Each material finding should have an owner, treatment decision, target date and evidence of remediation or an accepted exception. That makes the risk analysis useful for both security operations and compliance.

What about the proposed HIPAA Security Rule?

The proposal points toward more prescriptive cybersecurity expectations, but organizations should distinguish preparation from current legal obligation. A sensible approach is to meet the Security Rule that is in force while improving controls that reduce real risk—such as access management, encryption, vulnerability management, logging, incident preparedness and control verification.