A HIPAA Security Risk Analysis We Could Defend

The clinic could name its EHR on every insurance form. It could not show, with a dated document, where electronic protected health information actually lived or which risks would hurt first.

That is the usual starting point for a HIPAA security risk analysis. A multi-provider practice in Encino came to Secure Techies after a cyber-insurance renewal and a new specialist group’s BAA asked for more than a logo slide. They were new to us. We had no leftover diagrams, no prior tickets, and no reason to assume the last binder still matched the floor.

This case study records how we scoped the work, what we examined, how we ranked findings with the practice manager in the room, and what they left with. Client identifiers stay out. The method does not.

Why the clinic called

The practice sits in the same risk class as other healthcare offices we support: an EHR that cannot go down during clinic hours, billing that touches the same patients, Microsoft 365 in every room, and a staff too small to own a full-time security function. Headcount is not an exemption. The Security Rule still expects an accurate, thorough analysis of risks to ePHI. The text lives in 45 CFR 164.308, not in a vendor brochure.

Two documents forced the issue:

1. A cyber-insurance application that asked for the date of the last risk analysis, MFA coverage, and whether restores were tested. See how those questions usually arrive in our cyber insurance requirements guide.
2. A BAA packet from a referring specialist group that wanted to know who could open a chart, who administered the tenant, and which vendors touched ePHI.

The last written analysis was three years old. It still described a clinic server that was no longer the system of record. Staff had changed. A billing vendor had changed. Shared nurse-station logins had not.

What a HIPAA security risk analysis actually is

HHS’s Security Rule is administrative, physical, and technical safeguards for electronic PHI. The risk analysis is the keystone of the administrative set. NIST’s SP 800-66 Revision 2 is the public handbook many assessors still use to translate those safeguards into questions a clinic can answer. It is guidance. It is not a license we stamp on the door.

ONC and HHS also publish a free Security Risk Assessment tool. We did not hand the practice manager that tool and walk away. We used it as a completeness check after the floor walk, not as the engagement. A questionnaire nobody maps to live systems is how three-year-old binders happen.

Microsoft will sign a BAA for Microsoft 365 under its HIPAA/HITECH offering. That is Microsoft’s paperwork for Microsoft’s service. It does not replace the clinic’s own analysis of how staff actually use mail, OneDrive, and the EHR session on top of that tenant.

CISA’s healthcare cybersecurity page is useful context for the threat side. It is not a substitute for a clinic-sized ePHI map.

What this engagement was not

Secure Techies sells compliance and security audits as assessments, gap analysis, and documentation support. We do not issue HIPAA certifications, OCR determinations, or SOC 2 reports. Those stay with the regulator or the assessor the client hires.

We wrote that limit into the statement of work. The practice wanted a dated analysis it could defend. It did not want a seal we did not earn.

Out of scope on purpose:

• A full penetration test
• Rewriting every policy on day one
• Changing the EHR application (that stays with the EHR vendor)
• Pretending a four-week review replaces ongoing cybersecurity operations and a help desk

In scope:

• ePHI inventory and data flow
• Identity and workstation access
• Microsoft 365 tenant controls that touch patient communication
• Closet, Wi-Fi, and physical workstation reality
• Vendor and BAA hygiene
• Backup, restore proof, and the after-hours phone tree

For a different assessment shape, see the IT risk assessment for a financial services firm. That engagement used NIST CSF 2.0 for a wealth office. This one used the Security Rule for a clinic. Mixing those two packets is how firms fail questionnaires.

How we ran the four weeks

Week 1: scope and interviews

The first half-day was a workshop, not a scan. We listed systems, vendors, who could approve a change, and which laptops left the building. The practice manager walked us through a check-in. A provider walked us through a room change. We scheduled the closet walk after the last patient, not during.

That workshop prevented the usual failure mode: scanning the guest Wi-Fi and writing a report nobody on the floor recognizes.

We also asked leadership to write down, before they saw our findings, where they thought the risk lived. Most named phishing. Almost nobody named the shared nurse-station login, or the billing vendor without a current BAA, or the restore that had not been tested.

Weeks 2 and 3: evidence and the floor

Evidence came from the tenant, the EHR vendor’s access export, backup jobs, BAA files, and people. A screenshot of a setting beats a memory of a setting.

The technical work followed the same rule we use in a network vulnerability assessment: breadth first, then judgment. We discarded noise. A plugin count is not a risk ranking for a clinic that has to keep charts open.

The Microsoft 365 review used the same discipline as our Microsoft 365 security checklist: MFA coverage, forwarding, external sharing, and whether audit logs were actually on. Microsoft documents MFA as the control that stops a stolen password from becoming a tenant takeover (how Entra multifactor authentication works). The clinic had MFA on most users and missing on a privileged mailbox used for vendor resets.

Week 4: ranking workshop and readout

We do not mail a 70-page PDF and disappear. The ranking workshop put the practice manager, a provider, and our engineer on the same register. Each item got a likelihood, an impact, and an effort note that respected clinic hours. Items the practice could not fix this quarter were marked as accepted risk, in writing, with an owner and a review date.

The readout had three layers:

What we found

We are not going to invent a “risk score dropped 47 percent” graphic. The useful story is the pattern, which is common in clinics this size.

Identity was the real perimeter. Unique IDs existed in the EHR. The workstation that launched it used a shared Windows profile. MFA was on for most users and missing on a privileged mailbox. A former billing employee’s guest account was still live.

ePHI was wider than the EHR. Patient communication sat in Microsoft 365. Imaging sat on a share. Backups sat with a cloud tool that did not have a current BAA on file. A laptop that went home had a cached mailbox. The old analysis had not named those paths.

Paper and practice had split. Privacy and sanction documents were professionally written and three years stale. Staff described a different after-hours path than the one in the binder. OCR’s public breach portal is not this clinic’s file. It is a reminder that “we meant to update that” does not survive a reportable event.

Backup existed. Proof did not. Jobs completed. The last documented restore test was not on a calendar. A backup you have never restored is a hope, not a backup and disaster recovery control.

Waiting-room Wi-Fi and the clinical VLAN were not a story anyone could defend. Guest traffic was supposed to stop at the waiting room. The closet did not make that obvious. We did not treat that as a PCI QSA finding. We treated it as a segmentation question the analysis had to record.

None of this required a nation-state. It required an analysis that treated a multi-provider clinic like a covered entity, not like a hospital IT department with a spare hour.

How we documented treatment

A register that is 90 rows long will not get funded between patients. We kept the working list short enough for a owners’ meeting.

Week-one items (high impact, modest effort, after clinic hours where needed):

• Unique Windows logins on the nurse station, with the EHR still the clinical app
• MFA on every privileged and shared mailbox
• Disable the stale billing guest
• Schedule and document a restore test

Thirty-to-sixty-day items:

• Current BAAs for every vendor that touches ePHI, or a written decision to stop using the tool
• Tighten OneDrive and SharePoint external sharing
• Waiting-room Wi-Fi that actually stops at the waiting room
• Refresh the incident phone tree so it matches who answers

Ninety-day items:

• Annual access review on a calendar
• Vendor inventory that includes the EHR, billing, backup, and the prior IT leftover access
• A written update cycle so the analysis does not freeze again

We pointed the practice at our HIPAA compliance checklist for the hygiene that should sit under any later tool purchase, and at the Security Rule subpart so counsel could see the same sections we cited. Encino context for ongoing support lives on the Encino location page.

What the practice received

A useful analysis is short enough to read and specific enough to staff. This one had four pieces:

1. Dated written analysis. What we scoped, the ePHI map, the five items that would hurt first, and what “good enough for this clinic” looked like in 90 days.
2. Risk register. One row per finding. Likelihood, impact, effort, owner, and whether the item was treat, transfer, or accept.
3. Treatment plan. Not a wish list. Each line had a definition of done, so MFA coverage and “we talked about MFA” could not be confused.
4. Technical appendix. Tenant settings, BAA inventory, closet notes, and the EHR access export with names removed. This is the packet the next engineer can pick up without a tour.

We kept screenshots in the appendix and adjectives in the summary. Insurers want both. Providers only have time for the first.

Lessons we would repeat on the next one

Write the non-goals down. If you do not say “this is not a HIPAA certification” in the statement of work, someone will read the report as if it were.

Inventory ePHI before you scan. The gap between “it is in the EHR” and “it is also in the mailbox that went home” is usually the most useful page in the packet.

Rank with the practice manager, not at the practice manager. A score we invented in Canoga Park will lose to whatever the loudest provider remembers from a conference.

Respect clinic hours. Disruptive workstation changes belong after the last patient unless the outage already is the disruption.

Keep the closet photo. Diagrams lie. Racks rarely do.

Planning your own HIPAA security risk analysis

If your insurer, a referring group, your counsel, or your own partners are asking for a current analysis, start with a scoped review. Bring the last questionnaire, the EHR admin contact, the BAA folder, and whoever actually opens the closet. We will tell you what belongs in a four-week HIPAA security risk analysis and what belongs in later cybersecurity operations.

Secure Techies works from Canoga Park with clinics across Los Angeles and Southern California. We sign a BAA when we handle ePHI. Schedule a consultation if you want the same kind of dated analysis this client left with.

For the hygiene list that sits under this packet, use the HIPAA compliance checklist. For a non-healthcare assessment of the same shape, see the financial firm IT risk assessment.