HIPAA Risk Assessment for Websites
The HIPAA Security Rule requires a formal risk assessment. Here is how to conduct one for your website and web-based systems, with a structured methodology.
Why Risk Assessment Is the Foundation of HIPAA
The HIPAA Security Rule's risk analysis requirement (45 CFR § 164.308(a)(1)(ii)(A)) is not just one item on a compliance list — it is the foundation that justifies every other security decision. The OCR has consistently cited failure to conduct a thorough risk analysis as the primary violation in its largest enforcement actions, including cases involving multi-million dollar fines.
A risk assessment documents what ePHI you have, where it lives, what threatens it, and what you are doing about those threats. For websites, this means identifying every place your site creates, receives, maintains, or transmits ePHI — including form submissions, database records, log files, backup copies, and data shared with third parties.
Step 1: ePHI Inventory
Before you can assess risk, you must know what ePHI exists and where. Create a comprehensive inventory:
- Web form submissions containing health information
- Patient portal records and session data
- Appointment and scheduling database records
- Uploaded documents (intake forms, insurance cards, lab results)
- Email or chat transcripts containing health information
- Web server and application log files (check if PHI appears in URLs or request bodies)
- Backup files and archives
- Data shared with analytics, CRM, or marketing platforms
For each data element, document: what type of PHI it is, where it is stored, who can access it, and what security controls are in place.
Step 2: Threat and Vulnerability Identification
HIPAA requires identifying all reasonably anticipated threats to ePHI. For websites, the primary threat categories include:
- External threats: SQL injection attacks, XSS exploits, brute force login attempts, phishing targeting admin credentials, DDoS attacks that cause data unavailability
- Internal threats: Unauthorized employee access, accidental disclosure, misconfiguration of access controls
- Environmental threats: Hosting provider outage, data center fire or flood, hardware failure causing data loss
- Third-party threats: Compromise of a vendor with access to ePHI, vendor changing data handling practices without notice
Technical scanners like HIPAA Guard help identify vulnerability-level issues — insecure configurations that make specific threats more likely to succeed.
Step 3: Likelihood and Impact Scoring
For each identified threat-vulnerability pair, assess the likelihood that the threat will exploit the vulnerability and the impact if it does. A simple 3x3 matrix (Low/Medium/High for both likelihood and impact) produces a risk score for each item.
Example: An expired SSL certificate on your patient portal has High likelihood of enabling a man-in-the-middle attack scenario and High impact because it would expose ePHI transmitted by patients. This becomes a Critical risk requiring immediate remediation.
By contrast, a weak password policy for a blog admin account that has no access to ePHI might be Medium likelihood, Low impact — a risk to manage, but not a HIPAA-critical emergency.
Step 4: Documentation and Risk Management Plan
The risk assessment is a living document that must be formally maintained. After scoring each risk:
- Assign an owner responsible for each risk item
- Define a remediation timeline based on risk level
- Document the specific security measures that will mitigate each risk
- Record the residual risk after controls are applied
- Establish a review schedule — at minimum annually, and after any significant change
HHS's free Security Risk Assessment (SRA) Tool provides a structured template for this documentation. Completed risk assessments should be retained for at least six years and must be producible during an OCR investigation or audit.