HIPAA template · Security, Privacy and Breach Notification Rules
Security Risk Analysis (SRA) Report
Completed Security Risk Analysis artifact required by 45 CFR §164.308(a)(1)(ii)(A), the most frequently cited deficiency in OCR HIPAA investigations. Written for your company, citing the requirements below.
- Sections
- 9
- Requirements
- 1
- Formats
- PDF, Word
- Shelf
- 12 HIPAAdocuments in all
No card needed to start.
- Cites
- §164.308(a)(1)(ii)(A)
- Formats
- PDF and Word
Sections
Each written around your company: your tools, your roles, your review dates.
- Executive Summary
- Scope and Methodology
- ePHI Inventory and Data Flows
- Threat Sources and Vulnerabilities
- Risk Analysis
- Risk Determination Matrix
- Remediation Plan
- Review and Update Schedule
- Approvals
Requirement it is written to
As named in the template description.
§164.308(a)(1)(ii)(A), as named in the template description: Completed Security Risk Analysis artifact required by 45 CFR §164.308(a)(1)(ii)(A), the most frequently cited deficiency in OCR HIPAA investigations.
Recent changes
Updates from official sources that name this policy. All policy updates
22 Oct 2026 · The HIPAA Journal
HIPAA Journal details penalties for HIPAA violationsReview the Security Risk Analysis (SRA) Report to ensure it includes risk management activities, as OCR will expand its enforcement initiative to cover risk management in 2026.
22 Oct 2026 · The HIPAA Journal
OCR and state attorneys general issue HIPAA violation fines and settlementsReview the risk analysis policy to ensure it addresses the failures cited in recent OCR settlements, such as incomplete risk analysis and lack of risk management.
6 Jan 2025 · Federal Register
HHS proposes changes to the HIPAA Security RuleReview the risk analysis policy to include requirements for technology asset inventory and mapping of ePHI movement.
- HIPAA8 sections
Sanction Policy
Cites§164.308(a)(1)(ii)(C) §164.530(e)(1)PDF · WordCites HIPAA §164.308(a)(1)(ii)(C), named in the template description; HIPAA §164.530(e)(1), named in the template description. - HIPAA5 sections
HIPAA Security Rule Policy
Cites§164.308(a)(1) §164.308(a)(2) §164.310(a)(1) +5 +6PDF · WordCites §164.308(a)(1), Security Management Process (HIPAA); §164.308(a)(2), Assigned Security Responsibility (HIPAA); §164.310(a)(1), Facility Access Controls (HIPAA), and 5 more. - HIPAA4 sections
HIPAA Privacy Rule Policy
Cites§164.502(a) §164.524(a) §164.308(a)(4) +4 +5PDF · WordCites §164.502(a), Uses and Disclosures of PHI (HIPAA); §164.524(a), Access of Individuals to PHI (HIPAA); §164.308(a)(4), Information Access Management (HIPAA), and 4 more. - HIPAA4 sections
HIPAA Breach Notification Policy
Cites§164.308(a)(6) GDPR Art. 33 GDPR Art. 34 +4 +5PDF · WordCites §164.308(a)(6), Security Incident Procedures (HIPAA); GDPR Art. 33, Breach Notification to Authority (GDPR); GDPR Art. 34, Breach Communication to Data Subject (GDPR), and 4 more. - HIPAA5 sections
Access Control Policy
Cites§164.312(a)PDF · WordCites HIPAA §164.312(a), named in the template description. - HIPAA5 sections
Audit Controls Policy
Cites§164.312(b)PDF · WordCites HIPAA §164.312(b), named in the template description.
HIPAA on its own
- Documents
- 12
- Plan
- HIPAA Starter
- Price
- $99 a month or $950 a year
HIPAA Starter covers HIPAA only. HIPAA plus one more framework is Growth, $199 a month.
Your first policy is free. No card needed to start.