HIPAA Security Risk Assessment
The SRA your
assessor actually
expects.
Required under 45 CFR 164.308(a)(1). Most Business Associates don't have one. The Office for Civil Rights cites it in nearly every enforcement action. We've delivered hundreds. Ours hold up.
Book a ConversationThe Legal Requirement
This is not
optional.
The HIPAA Security Rule requires every covered entity and business associate to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information. That requirement lives at 45 CFR 164.308(a)(1)(ii)(A) and it applies to you if you touch ePHI — regardless of company size.
Most small and mid-size Business Associates don't have one. They've signed BAAs with hospital systems, health plans, and clinics. They process patient data daily. And they've never documented a formal risk analysis. The OCR knows this. It's the first thing they ask for.
When a breach happens — or when OCR audits — the absence of an SRA is not a technicality. It is the primary violation. Penalties for willful neglect start at $10,000 per violation and can reach $1.9 million per category per year.
45 CFR 164.308(a)(1)(ii)(A)
"Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate."
A SOC 2 report does not satisfy your HIPAA SRA obligation. Neither does a security questionnaire, a penetration test, or a vendor-provided compliance checklist. These are different instruments designed for different purposes. Confusing them is one of the most common and costly mistakes we see.
The SRA is the foundation. Every other safeguard in the HIPAA Security Rule — access controls, audit logs, encryption, incident response — is built on top of a documented risk analysis. Without it, you have controls without a rationale. OCR will find that gap.
The 2026 HIPAA Security Rule updates raise the bar further: encryption at rest and in transit and multi-factor authentication for any system touching ePHI move from addressable to required. Organizations that haven't run an SRA recently need one now — the regulatory environment has changed.
Who This Is For
If you sign BAAs,
you need this.
We built this assessment specifically for companies that handle ePHI on behalf of covered entities — not for large health systems with internal GRC teams.
Common target
Healthcare SaaS companies
You've signed your first hospital contract. You're handling patient data. You don't have a dedicated compliance officer. This is exactly who we built this for.
Common target
Medical billing & RCM firms
You process claims, verify benefits, and handle ePHI across dozens of covered entity clients. Every BAA you've signed creates a separate SRA obligation.
Common target
Telehealth technology vendors
Your platform transmits clinical data between patients and providers. That ePHI exposure requires a documented risk analysis — regardless of your team size.
Common target
Healthcare staffing agencies
Your workforce accesses patient records inside covered entity systems. That access creates a business associate relationship and a corresponding SRA requirement.
Common target
AI & ambient scribe vendors
Your product processes real-time clinical conversations and generates documentation inside EHRs. That's ePHI — and an AI risk assessment should accompany your SRA.
Common target
Healthcare IT & MSPs
You manage infrastructure, cloud environments, or end-user devices for hospitals and clinics. Your BAA makes you a business associate. Your SRA is overdue.
The Assessment
What you get.
What it covers.
-
01
ePHI Asset Inventory
A complete inventory of every system, application, and workflow that creates, receives, maintains, or transmits ePHI — mapped to your environment, not a generic template.
-
02
Threat & Vulnerability Analysis
Identification and documentation of threats and vulnerabilities to each ePHI asset, evaluated against your current technical, administrative, and physical safeguards.
-
03
Risk Ratings & Register
Every identified risk rated by likelihood and impact using NIST SP 800-30 methodology. A prioritized risk register that drives your remediation decisions, not a spreadsheet you'll never open again.
-
04
OCR-Defensible Documentation
Written documentation of the assessment methodology, scope, findings, and risk decisions — structured to satisfy OCR audit requests and demonstrate good-faith compliance.
-
05
Remediation Roadmap
A prioritized, time-bound plan aligned to your risk ratings, with assigned ownership and defined success criteria. Not a list of recommendations — an actionable program.
Why it matters who delivers it
An SRA is only as defensible as the methodology behind it. Software-generated assessments from $25/month platforms produce documentation. They do not produce judgment.
I spent 16 years as Founder and CISO of ClearDATA — the healthcare cloud security company — without a single reportable breach across a customer base that included major health systems, health plans, and hundreds of business associates. I've sat across the table from OCR investigators. I know what they look for and what fails under scrutiny.
What you're buying from Bowen & Company is not a PDF. It's the risk judgment of someone who has lived inside this program at scale.
— Chris Bowen, Founder & CEO
Common Questions
What organizations
ask us first.
Get Started
Let's get you
covered.
A 30-minute conversation is enough to scope your SRA and tell you exactly what you need. No sales process. No proposal theater. We either fit or we don't — and we'll tell you which.
Book a conversation. 30 minutes to scope your environment and confirm fit.
Receive a fixed-scope proposal. Price, timeline, and deliverables defined upfront. No surprises.
Complete the assessment. Typically 2–4 weeks depending on complexity. OCR-defensible documentation delivered.