HIPAA Glossary · Security Rule concepts
Risk analysis
The accurate, thorough assessment of risks to all ePHI the organisation holds — the foundational Security Rule requirement.
Context
Required by §164.308(a)(1)(ii)(A). The most commonly cited gap in enforcement; the first document OCR requests; the subject of OCR's Risk Analysis Initiative with 14+ settlements to date. A defensible risk analysis is asset-based, threat-paired, scored with a stated methodology, and current. See [the risk analysis guide](/guides/hipaa-risk-analysis/) and [the Initiative post](/blog/ocr-risk-analysis-initiative/).
Related terms
- Risk management — The follow-through to risk analysis: implementing measures that reduce identified risks to a reasonable and appropriate level.
- Administrative safeguards — The management layer of the Security Rule — risk analysis, workforce security, training, incident procedures, contingency planning, evaluation.
Where this fits
This is one of 50+ terms in the HIPAA Glossary. For how HIPAA is structured end-to-end, see the Security Rule guide and the Privacy Rule guide.