A clean HIPAA review describes one date. After it, systems change, staff come and go, and new threats appear, so monitoring should continue: keep the risk analysis current, review who accesses electronic protected health information (ePHI), and re-evaluate whenever something material changes. This post explains the idea. It is not legal advice.
What does the Security Rule expect?
The HHS Office for Civil Rights treats a risk analysis as the first step in identifying and implementing safeguards under the Security Rule. Its guidance, posted in 2010 and described on HHS pages as updated annually as appropriate, says there is no fixed template, and that an organization should choose the approach that fits its size, systems and environment.
NIST SP 800-66 Revision 2, published in February 2024, is a cybersecurity resource guide for implementing the Security Rule. It helps regulated entities of any size protect ePHI against reasonably anticipated threats and impermissible uses or disclosures, and maps each Security Rule standard to NIST Cybersecurity Framework subcategories and SP 800-53 controls.
For the monitoring itself, NIST SP 800-137 describes information security continuous monitoring as visibility into assets, awareness of threats and vulnerabilities, and visibility into how well deployed controls are working. Its stated aim is ongoing assurance that controls stay aligned with risk tolerance and a timely response when they are found inadequate.
What should you watch after the audit?
Group the work by question.
What changed?
- New systems, vendors or data flows that touch ePHI
- New software versions and new open source dependencies in those systems
- Staff changes and role changes
Who touched ePHI?
- Access logs reviewed on a set schedule, with a named reviewer
- Alerts for unusual access, such as bulk record views or after-hours access
- Accounts that should have been closed
Are controls still working?
- Backups restored on a test basis, not only completed
- Encryption settings checked against the intended state
- Vulnerability scans run on a schedule, with fixes tracked to closure
Who else holds our data?
- Business associate list kept current
- Evidence from each associate, such as a security questionnaire, on an annual cycle
What triggers an out of cycle risk review?
Define triggers so people do not wait for the annual cycle. Common ones: a new application that stores ePHI, a move to a new cloud provider, a security incident, a merger, or a major vulnerability in a component you run.
How does software inventory help?
Many ePHI systems depend on open source libraries. A software bill of materials per release lets you answer "does this new vulnerability affect a system that holds ePHI?" quickly, and gives the risk analysis a factual list. Safeguard's compliance automation and scanning produce dated records that can feed the evidence file. They support your program. They do not make you compliant, and the Security Rule obligations stay with your organization.
What to do
- Date-stamp your last risk analysis and schedule the next one.
- List the triggers that force an early review.
- Assign an owner for access log review and a review frequency.
- Schedule vulnerability scans for systems that touch ePHI, and track fixes.
- Keep a current register of business associates and their evidence.
- Store each month's monitoring records in one dated location.
Quick check
Is a HIPAA audit result valid for a year?
HIPAA has no certificate that expires on a date. The duty to assess and manage risk is continuous, so keep your risk analysis current and re-evaluate when your environment changes.
Does NIST SP 800-66 replace the Security Rule?
No. It is a guide that maps the rule to NIST resources. The Security Rule itself is the requirement.
Sources
- HHS: Guidance on Risk Analysis
- NIST SP 800-66 Rev. 2, Implementing the HIPAA Security Rule
- NIST SP 800-137, Information Security Continuous Monitoring
Last reviewed: 18 October 2026.
