Run a HIPAA security risk assessment for a small practice

Help me conduct and document a HIPAA Security Rule risk analysis for our practice. Practice size and locations: [e.g. "9 staff, 1 office, some remote billing staff"] Systems that hold or touch ePHI: [EHR/PM, email, texting, fax, imaging, cloud storage, billing service, patient portal, personal phones] Devices: [workstations, laptops, tablets, medical devices on the network] Current safeguards: [e.g. MFA, encryption, backups, antivirus, access reviews, training, locked server closet] Vendors with ePHI access: [LIST - and whether we have signed BAAs] Last assessment and known incidents: [DATE / DETAILS or "none"] Work through: 1. An inventory of where ePHI is created, received, stored, and sent, including paper-to-digital points like scanning and fax. 2. For each asset: threats and vulnerabilities (e.g. phishing, ransomware, lost device, former employee access, unpatched systems), current controls, likelihood (low/medium/high), impact (low/medium/high), and risk level. 3. Gaps against the administrative, physical, and technical safeguards, noting which are "required" versus "addressable" and that addressable items still need a documented decision. 4. A remediation plan prioritized by risk, with owner, cost range as [ESTIMATE], and target date. Return the risk register as a table, then the remediation plan, then a list of policies and documentation we should have on file. Do not assume a control exists unless I said so; mark unknowns as [CONFIRM]. This is a working draft; have it reviewed by our privacy/security officer or a qualified HIPAA consultant.