The Risk Analysis Workflow is the §164.308(a)(1)(ii)(A) requirement implemented as a run-book: asset-based, threat-paired, scored, and feeding the risk register. It is the first document OCR requests after an incident, and the one that cannot be created retroactively.
What it does
- Walks through scope definition, asset inventory, threat pairing, likelihood and impact scoring, and residual risk — in that order.
- Produces a defensible risk register as an output, not as a side-effect.
- Captures the methodology, so a reviewer can reproduce the scoring from the inputs.
- Supports annual re-analysis without discarding history, so year-over-year drift is visible.
How it maps to HIPAA
The workflow directly implements §164.308(a)(1)(ii)(A) (risk analysis). It feeds §164.308(a)(1)(ii)(B) (risk management — the treatment plans) and informs the “reasonable and appropriate” assessments for every addressable specification under §164.306(d).
Where it fits
The workflow is the entry point to the Risk Management module, produces the Risk Register and Treatment Plans. For the fixed-fee delivered-by-us version, see HIPAA Risk Analysis service; for the plain-language background, see the risk analysis guide.