# Run a HIPAA security risk assessment for a small practice

A structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/run-a-hipaa-security-risk-assessment-for-a-small-practice

## Prompt

```text
Help me conduct and document a HIPAA Security Rule risk analysis for our practice.

**Practice size and locations:** [e.g. "9 staff, 1 office, some remote billing staff"]
**Systems that hold or touch ePHI:** [EHR/PM, email, texting, fax, imaging, cloud storage, billing service, patient portal, personal phones]
**Devices:** [workstations, laptops, tablets, medical devices on the network]
**Current safeguards:** [e.g. MFA, encryption, backups, antivirus, access reviews, training, locked server closet]
**Vendors with ePHI access:** [LIST - and whether we have signed BAAs]
**Last assessment and known incidents:** [DATE / DETAILS or "none"]

Work through:
1. An inventory of where ePHI is created, received, stored, and sent, including paper-to-digital points like scanning and fax.
2. For each asset: threats and vulnerabilities (e.g. phishing, ransomware, lost device, former employee access, unpatched systems), current controls, likelihood (low/medium/high), impact (low/medium/high), and risk level.
3. Gaps against the administrative, physical, and technical safeguards, noting which are "required" versus "addressable" and that addressable items still need a documented decision.
4. A remediation plan prioritized by risk, with owner, cost range as [ESTIMATE], and target date.

Return the risk register as a table, then the remediation plan, then a list of policies and documentation we should have on file. Do not assume a control exists unless I said so; mark unknowns as [CONFIRM]. This is a working draft; have it reviewed by our privacy/security officer or a qualified HIPAA consultant.
```

## What to fill in

- e.g. "9 staff, 1 office, some remote billing staff"
- LIST - and whether we have signed BAAs
- DATE / DETAILS or "none"
- ESTIMATE
- CONFIRM

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.