HIPAA lists risk analysis and risk management as separate required specifications. Risk analysis assesses potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI. Risk management puts security measures in place to reduce those risks to a reasonable and appropriate level. Doing the first without the second leaves the work unfinished.
Where they sit
Both are under the security management process in 164.308(a)(1). The two others in that group are the sanction policy and the information system activity review, all four labeled Required.
Risk analysis: find and rate
This is an assessment. You identify where ePHI lives, what could go wrong, what weaknesses exist, and how likely and damaging each scenario is. Scope matters: it must cover ePHI in all forms and locations, which includes cloud services, mobile devices and vendors.
A workable method:
- Inventory systems, data stores and data flows that hold or move ePHI.
- List threats such as ransomware, lost devices, misdirected email and insider misuse.
- List vulnerabilities such as unpatched systems, weak authentication and missing logs.
- Rate likelihood and impact on a consistent scale.
- Record the result with a date and an owner.
Risk management: decide and act
For each risk, choose a treatment: reduce, transfer, avoid, or accept with sign off. Then assign an owner, a due date and a way to check that the control works. The point is a measurable reduction, tracked to closure.
One register, two views
Keep a single risk register. The analysis fills it. Management works it. Tag each row with its source analysis, the treatment, status and the date it was last reviewed. That makes the evidence trail short and clear.
How often
The text of 164.308 does not set a refresh schedule that I could confirm. A sensible habit is to refresh the analysis when something material changes, such as a new system, a vendor or an incident, and to review the register regularly. NIST SP 800-66 Rev. 2, published in February 2024, gives practical guidance for regulated entities of all sizes and maps Security Rule requirements to NIST framework subcategories and SP 800-53 controls.
What auditors dislike
- An analysis done once, years ago.
- A risk list with no owners or dates.
- Critical findings with no treatment.
Safeguard's compliance and evidence automation can keep control evidence and tasks in one place. See HIPAA requirements for covered entities.
Quick check
Is risk management part of the same requirement as risk analysis?
They are two separate required specifications under the same standard. You need both.
Sources
Last reviewed: 19 October 2026.
