On this page
A HIPAA risk assessment, which the Security Rule calls a risk analysis, is a required "accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate" (45 CFR 164.308(a)(1)(ii)(A)). HHS says it "is an ongoing process" (HHS), and its tracking bulletin lists "Addressing the use of tracking technologies in the regulated entity's Risk Analysis and Risk Management processes" among the requirements regulated entities must meet when using tracking technologies with access to PHI (HHS), so website forms, tracking scripts and marketing vendors that can reach ePHI belong in it. Curve Compliance, which signs a BAA on every plan and offers a free website scan that lists the trackers on a page, checked each source below on November 2, 2026.
Book a call. Want to know what your site sends before you score it? Curve's team reviews what your website sends to Meta, Google and TikTok with you. Curve Compliance then sends conversions server-side and strips PHI before data reaches an ad platform. Setup is done by Curve's team, typically live in about a week. Book a call with Curve.
What the rule requires
Risk analysis sits under the security management process standard, which requires policies "to prevent, detect, contain, and correct security violations." Four implementation specifications follow, all Required: risk analysis; risk management, to "Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level"; a sanction policy; and information system activity review, such as "audit logs, access reports, and security incident tracking reports" (45 CFR 164.308(a)(1)). The rule applies to covered entities and business associates alike.
The rule does not prescribe a method. HHS says "the Security Rule does not prescribe a specific risk analysis methodology," and the rule lets each organization weigh its size, its technical capabilities, the costs of security measures and "The probability and criticality of potential risks" (HHS; 45 CFR 164.306(b)). The result also drives other decisions: HHS says organizations should use it to decide, for example, "whether and how to use encryption" (HHS). For the safeguards it feeds, see the three types of HIPAA safeguards.
Risk analysis, risk assessment and the SRA Tool
The regulation says risk analysis; most people say risk assessment; HHS and HealthIT.gov use both. They mean the same required exercise. It is a different thing from a CCPA risk assessment under California law; see CCPA risk assessments for health advertisers.
HHS's Office of the National Coordinator for Health IT, with OCR, publishes the Security Risk Assessment (SRA) Tool. HealthIT.gov says "The SRA Tool is a desktop application that walks users through the security risk assessment process using a simple, wizard-based approach," with an Excel workbook version, and that "The target audience of this tool is medium and small providers; thus, use of this tool may not be appropriate for larger organizations." Entries stay on your machine: "All information entered into the tool is stored locally on the user's computer." Version 3.7 adds a reminder that "the SRA Tool survey alone may not identify all risks present in an organization" (HealthIT.gov). That is the gap marketing tools fall into.
Step by step
HHS's risk analysis guidance lists the elements any method must cover (HHS):
- Scope. All ePHI the organization creates, receives, maintains or transmits, "regardless of the particular electronic medium in which it is created, received, maintained or transmitted or the source or location of its e-PHI."
- Data collection. "An organization must identify where the e-PHI is stored, received, maintained or transmitted."
- Threats and vulnerabilities. Identify and document reasonably anticipated threats and the vulnerabilities they could exploit.
- Current security measures. Assess what is in place and whether it is configured and used properly.
- Likelihood and impact. Estimate how likely each threat is and how much harm it would do.
- Level of risk. Assign a level to each threat and vulnerability pair, with corrective actions.
- Documentation. The rule "requires the risk analysis to be documented but does not require a specific format."
- Periodic review. Update it as the environment changes.
Adding marketing tools to the inventory
HHS's sample questions include: "What are the external sources of e-PHI? For example, do vendors or consultants create, receive, maintain or transmit e-PHI?" (HHS). On a healthcare website, the answer often includes marketing tools. HHS's tracking bulletin says the ePHI a regulated entity collects through its website must be "protected and secured in accordance with the HIPAA Security Rule," and OCR's "principal interest in this area is ensuring that regulated entities have identified, assessed, and mitigated the risks to ePHI when using online tracking technologies" (HHS).
| Marketing system | Where it touches ePHI | Questions for the risk analysis |
|---|---|---|
| Ad pixels and tags (Meta, Google Ads, TikTok and others) | Scripts on pages where patients book, log in or describe symptoms | Which pages load them? What does each send? Does the vendor sign a BAA? |
| Analytics, session replay and heatmaps | Page views, clicks and typed text on those same pages | Is form input masked? Who can see recordings? Is there a BAA? |
| Online forms, chat and schedulers | Names, contact details, reasons for visit | Where are answers stored? Who can view or export them? How long are they kept? |
| CRM and email tools | Lead and patient records used for follow-up | Is there a BAA? Who has access? Are campaigns built from patient data? |
| Call tracking | Caller numbers and recordings | Is there a BAA? Where do recordings go? |
| Agencies and freelancers | Logins to any of the above | Is the agency a business associate with its own BAA and subcontractor BAAs? |
To build the first column for your own site, run Curve's free website scan, which lists the tracking scripts on a page with a risk level for each; this guide explains the results. For mapping where data flows next, see a network map for marketing tools.
Scoring tracker risk
HHS's guidance gives one way to set a level: "The risk level determination might be performed by assigning a risk level based on the average of the assigned likelihood and impact levels" (HHS). For trackers, three facts move the score most: whether the page itself is about a health condition, a booking or a login; whether the vendor has signed a BAA; and what fields leave the browser.
Impact is not abstract. HHS says a disclosure of PHI to a tracking vendor with no permission and no BAA carries "a presumption that there has been a breach of unsecured PHI unless the regulated entity can demonstrate that there is a low probability that the PHI has been compromised" (HHS; 45 CFR 164.402). A federal court vacated one part of the bulletin in 2024, about unauthenticated public pages; see what the court changed. If the scan finds ad pixels on booking or condition pages, book a call and Curve's team will show you what each platform receives.
Documenting and updating
Keep the analysis, the risk levels and the corrective actions, and retain them for six years from creation or the date last in effect, whichever is later (45 CFR 164.316(b)); see HIPAA document retention. On timing, HHS says "The Security Rule does not specify how frequently to perform risk analysis," and that "Some covered entities may perform these processes annually or as needed (e.g., bi-annual or every 3 years) depending on circumstances of their environment." It names triggers such as a security incident, a change in ownership, staff turnover or plans "to incorporate new technology" (HHS). A new ad platform, form tool or chat widget is new technology.
HHS has proposed making this more specific. Its December 2024 proposed rule would require a written risk analysis that includes "A review of the technology asset inventory and network map" and "Identification of all reasonably anticipated threats to the confidentiality, integrity, and availability of ePHI" (HHS). It is still a proposed rule; HHS says "the current Security Rule remains in effect" (HHS; Federal Register).
How Curve Compliance helps
Curve Compliance helps with the marketing rows of your risk analysis. Curve's free website scan lists the pixels and trackers on a page, and Curve's team reviews what your website sends to Meta, Google and TikTok with you and shows what's likely triggering a flag. Curve then replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with only a fixed list of fields per platform and contact identifiers off by default on Meta, Google Ads and TikTok.
Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what the platform accepted, which gives you evidence for the analysis. Curve is SOC 2 Type II and signs a BAA on every plan, and Curve's team does the setup, typically live in about a week. The analysis itself is yours, so talk to your counsel or security adviser about scope and method.
Sources, checked November 2, 2026: HHS, Guidance on Risk Analysis; HHS, Use of Online Tracking Technologies; HHS, Summary of the HIPAA Security Rule; HHS, Security Rule NPRM fact sheet; HealthIT.gov, Security Risk Assessment Tool; eCFR, 45 CFR 164.306, 164.308, 164.316 and 164.402; Federal Register, 90 FR 898 (2025).
Frequently Asked Questions
What is a HIPAA risk assessment?
It is the Security Rule's required risk analysis: an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of the ePHI a covered entity or business associate holds (45 CFR 164.308(a)(1)(ii)(A)).
Is a HIPAA risk assessment required?
Yes. Risk analysis and risk management are both marked Required in the Security Rule, for covered entities and business associates (45 CFR 164.308(a)(1)).
Is there a free HIPAA risk assessment tool?
ONC and OCR publish the Security Risk Assessment (SRA) Tool on HealthIT.gov as a Windows app and an Excel workbook, aimed at "medium and small providers" (HealthIT.gov). For the website part, Curve's free website scan lists the trackers on a page.
How often should a risk analysis be done?
The rule sets no fixed interval. HHS says it should be ongoing, that some entities do it annually or as needed, and that new technology, incidents or ownership changes should prompt an update (HHS).
Should website trackers be in a risk analysis?
Yes, where they can touch ePHI. HHS lists addressing tracking technologies in the risk analysis and risk management processes among regulated entities' obligations (HHS).
What is the difference between risk analysis and risk management?
Risk analysis finds and rates the risks to ePHI; risk management is putting in place "security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level" (45 CFR 164.308(a)(1)(ii)).
What is the new HIPAA rule in 2026?
For risk analysis, the change to watch is HHS's proposed Security Rule update, published January 6, 2025, which would require a written analysis built on an asset inventory and network map; it is not final (Federal Register; HHS). See the new HIPAA rules in 2026.
Talk to Curve Compliance
Book a call. Want the marketing rows of your risk analysis to be short? Curve Compliance strips PHI before data reaches an ad platform, logs every send in Event Logs and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.