Completed Security Risk Analysis artifact required by 45 CFR §164.308(a)(1)(ii)(A) — the most frequently cited deficiency in OCR HIPAA investigations.
A compliant Security Risk Analysis (SRA) Report for HIPAA must include the following9 sections. Each section addresses a specific control requirement that auditors will review.
Overall risk posture, count of risks by severity, and top-5 prioritized remediations.
ePHI systems in scope, assessors, methodology (NIST SP 800-30 + HHS SRA Tool), likelihood/impact scales.
Table: System | ePHI Data Types | Storage Location | Transmission Paths | Users | BA Involvement.
Threat-source catalog (adversarial, accidental, structural, environmental) paired with identified vulnerabilities, organized by Administrative / Physical / Technical safeguard category.
Table per threat-vulnerability pair: Likelihood | Impact | Existing Controls | Residual Risk | Risk Score.
Ranked list of all risks from Very High to Very Low with scoring rationale.
Table: Risk ID | Recommended Safeguard | Owner | Target Date | Re-assessment Trigger.
Ongoing risk analysis cadence and triggers per §164.308(a)(1)(ii)(B) (required continuous risk management).
Sign-off by Security Officer, Privacy Officer, and Executive Leadership.
This template shows the required structure. PoliWriter generates a fully customized Security Risk Analysis (SRA) Report that references your actual cloud providers, identity systems, tools, and team practices — ready for auditor review.
Administrative, physical, and technical safeguards.
PHI use and disclosure requirements.
Breach identification and reporting procedures.
Technical policies for controlling access to ePHI per §164.312(a).
Mechanisms for recording and examining access to ePHI per §164.312(b).
Policies to protect ePHI from improper alteration or destruction per §164.312(c).
Technical safeguards for protecting ePHI during electronic transmission per §164.312(e).
Establishes procedures for responding to emergencies affecting ePHI systems per §164.308(a)(7).