Completing a HIPAA Security Risk Analysis (SRA) is an important part of protecting electronic protected health information (ePHI), but the work does not stop when the SRA is finished. The SRA identifies and evaluates risks. The Risk Management Plan documents how the organization will respond, who is responsible, when action should occur, and what evidence will show the work was completed.
An easy way to remember the difference is:
SRA = What are our risks?
Risk Management Plan = What are we doing about them?
Under the HIPAA Security Rule, regulated entities must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI, then implement reasonable and appropriate security measures to reduce those risks. A Risk Management Plan helps show that identified risks were not only found, but were reasonably addressed, assigned, tracked, and supported with documentation.
What Happens After the SRA?
An SRA may uncover concerns such as:
- A laptop containing ePHI is not encrypted.
- Multi-factor authentication (MFA) has not been implemented.
- Former employees’ accounts are not disabled promptly.
- A vendor with access to ePHI does not have an appropriate Business Associate Agreement (BAA).
Finding these problems is only the first step. Next, the organization should decide how each risk will be addressed. The risks identified during the SRA should flow into a Risk Management Plan, where they can be prioritized, assigned, tracked, and documented through completion.
What Should Be in a Risk Management Plan?
A Risk Management Plan does not have to be complicated; many organizations use a spreadsheet or similar tracking tool.
For each identified risk, consider documenting:
- Risk: What problem or vulnerability was identified?
- Risk level: How serious is the risk?
- Corrective action: What will be done to reduce the risk?
- Owner: Who is responsible?
- Target date: When should it be completed?
- Status: Is it open, in progress, completed, or being monitored?
- Completion date: When was the corrective action finished?
- Evidence: What demonstrates that the action was completed?
Which Risks Should You Address First?
Organizations may identify many risks during an SRA, and not all have the same urgency. This is where prioritization matters.
Two factors commonly considered are:
- Likelihood: How likely is it that the threat could occur or take advantage of the vulnerability?
- Impact: If it happened, how serious would the consequences be?
For example, an unencrypted laptop containing ePHI may be addressed before outdated software on a system that does not store ePHI because the potential impact is greater. A 3×3 risk matrix provides a simple way to compare these factors and determine which risks should receive attention first. High-likelihood, high-impact risks receive higher priority.
HIPAA does not require one scoring system; what matters is a reasonable, consistent process for evaluating and prioritizing risks.
What Happens to Lower-Priority Risks?
Prioritizing risks does not mean lower-priority risks should be forgotten.
They should remain on the Risk Management Plan until they are addressed, accepted, transferred, or monitored based on a reasonable decision.
- Higher risks may require immediate or accelerated corrective action.
- Moderate risks may be scheduled for remediation within a reasonable timeframe.
- Lower risks may have longer target dates or be monitored while higher-priority issues are addressed.
The organization should be able to show that it identified the risk, evaluated it, and made a reasonable decision about how it would be handled.
The Plan Continues Throughout the Year
A Risk Management Plan should be a living document, not something created after the SRA and filed away until next year.
Security risks can be discovered at any time, including through:
- Security or phishing incidents
- Vulnerability scans
- Internal audits
- New software or systems
When a new risk is discovered, the organization does not need to wait for the next formal SRA. The risk can be evaluated, prioritized, assigned to an owner, and added to the plan during the year. The plan should also be updated as corrective actions are completed or circumstances change.
Keep Evidence of What Was Completed
Closing an item should mean more than changing its status to “Complete.” Whenever possible, keep evidence showing what was actually done.
Examples include:
- A screenshot showing MFA was enabled
- An updated policy
- An encryption report
- A signed BAA
- An IT ticket documenting completion
This creates a record showing that the organization moved from identifying a risk to managing it.
From SRA to Risk Management
The process works best as a continuous cycle: Identify → Evaluate → Prioritize → Assign → Remediate → Document → Monitor → Reassess.
The SRA identifies where risks exist. The Risk Management Plan provides the roadmap for deciding what should be addressed first, who is responsible, when it should be completed, and how progress will be documented.
Most importantly, risk management does not end with the annual SRA. Risks identified during the SRA and new risks found during the year should be added to the plan, and completed corrective actions should be documented. That ongoing process turns the SRA from a compliance exercise into an active tool for protecting ePHI.
Ready to turn your SRA findings into action? TMC can help you set up a Risk Management Plan that gives your organization a practical framework for prioritizing risks, assigning next steps, and tracking progress.