ePHI system inventory
Every system, device, and vendor that touches patient data, with where it lives and who can reach it.
The Problem
Your Risk Assessment Is a Checklist, Not a Risk Analysis
It shows up when an insurer, a hospital customer, or an OCR letter asks for your current risk analysis and all you have is a yes-or-no form.
Inventory
The checklist skips the texting app and the cloud scan drive.
Inventory
An inventory of every system that stores, sends, or receives patient data.
Scoring
Yes-or-no answers can't show which risk matters most.
Scoring
Each threat and weakness pair scored for likelihood and impact, then ranked.
Evidence
Answers rely on memory instead of checked settings.
Evidence
MFA, encryption, backup, and access settings checked in the systems themselves.
Follow-up
Findings sit in a report nobody acts on.
Follow-up
A risk management plan with owners, dates, and a yearly re-assessment calendar.
Your office manager filled in a HIPAA risk assessment checklist two years ago. Every answer says yes. Since then you added a patient texting app, moved scans to a cloud drive, and gave the billing company remote access. The checklist mentions none of them. It didn't ask how likely each threat is or what it would cost you either. Then your cyber insurance renewal asks for a current risk analysis, with dates.
We start by listing every place ePHI lives or travels, including the texting app and the fax-to-email inbox. For each system we pair real threats with real weaknesses, check the settings ourselves, and score likelihood and impact. You get a ranked risk register and a plan that names who fixes what by when. The result is a risk analysis built from your systems, not from a template's guesses.
Every ePHI system listed
EHR, billing, texting, email, backups, and the laptops staff take home, all in one inventory.
Likelihood and impact scored
Each threat and weakness pair rated, so the ranking reflects your risk, not a generic list.
Owners and dates set
Every risk gets a fix, an owner, and a target date you can track to closure.
Our HIPAA Security Risk Assessment Process
From System Inventory to Risk Management Plan in Five Clear Steps
You confirm the system list, see the evidence we collect, review each score with us, and approve the plan before anything is final.
We ask about your locations, EHR, billing setup, and any vendors with access to patient data. You get a fixed quote and a short pre-call list, such as your last assessment and your vendor contracts.
What's Included
What You Get With a HIPAA Security Risk Analysis
Each assessment covers an ePHI inventory, threat and weakness pairs, checked safeguards, scored and ranked risks, a risk management plan, and records you keep for 6 years.
Compare Options
DeveloperLook vs Free SRA Tool vs EHR Vendor Checklist
The free HHS tool and your EHR vendor's checklist both help small practices. Here is where each stops when you need a risk analysis you can defend.
| Feature | DeveloperLookBest fit | Free SRA tool | EHR vendor checklist |
|---|---|---|---|
| Cost | Fixed price from $650 | Free to use | Often included |
| Systems covered | Every system touching ePHI | Whatever you enter | Mostly the EHR |
| Evidence | Settings checked directly | Your own answers | Vendor's own controls |
| Risk scoring | Likelihood and impact per pair | Built-in scoring | Rarely included |
| Remediation plan | Owners and dates per risk | Basic action list | Not included |
| Staff effort | A few short interviews | Many hours of questions | Low for staff |
| Vendors and apps | Texting, billing, and backups included | Only if you list them | Not covered |
| Next year | Calendar and editable register | Repeat the tool yearly | Vendor's own schedule |
DeveloperLook
Free SRA tool
- Cost
- DeveloperLook: Fixed price from $650Free SRA tool: Free to use
- Systems covered
- DeveloperLook: Every system touching ePHIFree SRA tool: Whatever you enter
- Evidence
- DeveloperLook: Settings checked directlyFree SRA tool: Your own answers
- Risk scoring
- DeveloperLook: Likelihood and impact per pairFree SRA tool: Built-in scoring
- Remediation plan
- DeveloperLook: Owners and dates per riskFree SRA tool: Basic action list
- Staff effort
- DeveloperLook: A few short interviewsFree SRA tool: Many hours of questions
- Vendors and apps
- DeveloperLook: Texting, billing, and backups includedFree SRA tool: Only if you list them
- Next year
- DeveloperLook: Calendar and editable registerFree SRA tool: Repeat the tool yearly
Projects We've Built
Healthcare Apps and Platforms We Have Built
Doctor booking apps and medical platforms we designed and built. They show our work on software that handles patient data, not risk assessment projects.
Carepoint Medical App Design & Development
- Medical
- Booking System
- Dashboard
HealCon Doctor Booking App Design & Development
- Medical
- Booking System
- Dashboard
DocLink Doctor Booking App Design & Development
- Business
- Medical
- Booking System
MediPulse Medical App Design & Development
- Medical
- Booking System
- Dashboard
What Our Clients Say
What Clients Say After Launch
Feedback from teams we have built platforms, apps, and websites for.
We had a pretty specific idea of what we wanted our website to become, but I wasn’t sure how easily we could explain all of it to a development team. There were quite a few moving parts, and we were working toward a deadline, so I expected a few things to get lost along the way. That never really happened. They understood what we were trying to achieve, kept us updated throughout the process, and got everything ready within the agreed timeline. The final site feels much easier to navigate, works beautifully on mobile, and is noticeably smoother for our customers. It was a huge relief seeing the original idea actually turn into the website we had in mind.
The mobile experience is probably my favourite part of the new site. We had spent a lot of time making sure the desktop version looked right, and the team kept pushing us to think about how everything would actually feel on a phone too. They were right. The navigation is clean, the interactions feel natural, and everything we’ve tested so far works exactly as it should. They also went through the links, forms, integrations, and other details more than once before launch, which I really appreciated. And even after going live, we could still reach out when something came up. The whole process felt friendly, organised, and surprisingly straightforward.
What I appreciate most is that the website is actually easy for us to manage now. We can update content ourselves instead of sending a developer a message every time we need to change something small. They also paid attention to the technical SEO side, which mattered to us because we didn’t want a new website to create problems for the traffic we already had. I’ve probably asked more questions than I should have since launch, but every question has been handled patiently and without any fuss. The team is easy to work with, they explain things clearly, and when we need something changed, they focus on getting it done rather than making the process complicated.
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
1,250+
Projects shipped
10+
Years of experience
Top 3%
Upwork Top Rated Plus
5 stars
Average review score
Want results like these?
Tell us what you are building. You get a reply within 24 hours on business days, then a written estimate.
Work Culture
Why Practices Trust Us With Their HIPAA Risk Analysis
A risk analysis only helps if it matches your office and gets acted on. These habits keep ours accurate, readable, and easy to repeat next year.
We check, not ask
Where a questionnaire would ask whether MFA is on, we look at the setting. Your risk scores then rest on facts, not on someone's memory.
Clinic hours come first
Interviews and checks happen around patient schedules, often early or late. Front desk and clinical staff aren't pulled away during busy sessions.
Honest about the free tool
If the free HHS tool, filled in carefully, covers your two-room practice, we'll tell you before we quote. Paying us should buy evidence and ranking you can't do alone.
Minimum access to patient data
We review settings, user lists, and logs, not patient charts. Where access is needed, it's read-only and removed when the check ends.
Findings in plain language
Each risk is written so the office manager understands the fix. Technical detail sits in an appendix for your IT provider.
Built to repeat yearly
The inventory and scoring sheet are yours to update. Next year's assessment starts from this one instead of a blank form.
Overview
What do HIPAA risk assessment services include?
DeveloperLook provides HIPAA risk assessment services that build the Security Rule risk analysis from your real systems. We inventory every system holding ePHI, check safeguards in the settings, score each risk by likelihood and impact, and write a risk management plan. Assessments start at $650 and take 1 to 5 weeks.
DEVELOPERLOOK
Project facts · HIPAA Security Risk Assessment Services
- Service
- HIPAA security risk assessment (ePHI inventory, risk scoring, risk management plan)
- Typical timeline
- 1 to 2 weeks for one practice, 3 to 5 weeks for multi-site
- Platforms
- athenahealth, eClinicalWorks, Epic, Dentrix, Microsoft 365, Google Workspace
- Built with
- Tenable Nessus, Microsoft Entra ID, Intune, Google Admin console, Excel
- Experience
- 10+ years of development experience and 1,250+ shipped projects
- Post-launch support
- 30 days of questions and re-scores
- Communication
- Calls in US, UK, and AU business hours
- Starting price
- From $650 USD, fixed scope after a free call
Reviewed 27 Oct 2026 by Saimul Islam
Good fit
Small medical and dental practices
Your practice runs one EHR, a patient texting app, and an outside billing company, and you need a HIPAA risk analysis that covers all three.
Practices attesting to Promoting Interoperability
You attest every calendar year and need a dated security risk analysis for that period, not last year's file with a new date on it.
Health tech vendors and business associates
Your SaaS stores ePHI for clinics, and a hospital customer asked for your HIPAA security assessment before renewing the contract.
Practice managers with an IT provider
Your IT provider handles devices, but nobody owns the HIPAA IT risk assessment that ties devices, apps, and vendors together.
Groups after an incident or merger
You just bought a second practice or had a phishing incident, and your old HIPAA assessment no longer matches your systems.
Not a fit
Need the full HIPAA program
You need policies, BAAs, training, and safeguards built, not only the assessment. Our HIPAA Compliance Services page covers the full program.
Customer asks for HITRUST
A customer contract asks for HITRUST, not a HIPAA risk analysis. Our HITRUST Certification Support page covers choosing and preparing for the right assessment.
Solo practice under $650
You're a solo provider with one EHR and a budget under $650. The free HHS SRA Tool, filled in carefully, is a reasonable place to start.
Want a HIPAA certificate
You want a certificate that says you're HIPAA compliant. HHS doesn't recognize private HIPAA certifications, so we don't sell one.
Not sure we're the right fit?
Book a free call or message us. We'll tell you honestly whether we're the right team.
Pricing
Transparent Starting Prices for HIPAA Security Risk Assessment Services
These are starting points in USD. Your final price depends on your locations, the systems that hold ePHI, and the vendors with access, and you get a fixed proposal after a free call.
For Agencies
White-Label HIPAA Risk Reviews for MSPs and Healthcare IT Providers
You own the client relationship. We supply the inventory, evidence checks, and scored risk register under your brand, so clinic clients get a risk analysis that matches the systems you manage.
How the partnership works
White label: your client only ever sees your brand
Your clientSees only your brand
You, the agencyOwn the relationship
DeveloperLookBehind your brand
Share the clinic brief
Send locations, EHR, key vendors, and any prior assessment or insurer request.
- Client needs
- You share the details
- Details received
We assess and score
We run the inventory, evidence checks, and scoring, then send you the draft.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Review and deliver
You review the findings and deliver the final report under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
- Your client
- You, the agency
- DeveloperLook
Share the clinic brief
Send locations, EHR, key vendors, and any prior assessment or insurer request.
- Client needs
- You share the details
- Details received
We assess and score
We run the inventory, evidence checks, and scoring, then send you the draft.
- Scope and plan
- Proposal to resell
- Your quoteYOUR LOGO
Review and deliver
You review the findings and deliver the final report under your brand.
- Done by our team
- Your brand on it
- Handed to your clientDone
Partner with DeveloperLookDelivered under your brand
The Right Technology for Your Project
Technology Stack
We assess the EHR, practice software, and cloud tools your clinic already runs, and use standard scanners to check internet-facing systems.
- athenahealth
- eClinicalWorks
- Epic
- Dentrix
- Microsoft 365
- Google Workspace
- OneDrive
- Dropbox
- Microsoft Entra ID
- Microsoft Intune
- Google Admin console
- BitLocker
- Tenable Nessus
- HHS SRA Tool
- Microsoft Excel
- Veeam
01 / 04
Related Services
Practices often follow the assessment with the full HIPAA program, a vulnerability assessment, clinic security work, or HITRUST preparation.
Cybersecurity Services
DeveloperLook provides cybersecurity services for businesses without a security team. We assess identity, email, devices, cloud, and web apps, fix the gaps you approve, and recheck every fix, so you get a cybersecurity service provider that does the work.
HIPAA Compliance Services
DeveloperLook provides HIPAA compliance services for medical practices, clinics, and health tech vendors. We map where patient data lives, document the security risk analysis, set up policies and BAAs, and fix the safeguards an investigator asks about.
HITRUST Certification Support
DeveloperLook provides HITRUST certification support for health tech and healthcare vendors. We match e1, i1, or r2 to your customer contracts, plan cloud inheritance, fix the gaps, and organize evidence in MyCSF before your External Assessor starts.This page
HIPAA Security Risk Assessment Services
Pairs with the 6 services around it
Cybersecurity for Medical Practices
DeveloperLook provides cybersecurity for medical practices: we review your Security Rule safeguards and switch on what's missing. MFA, unique EHR logins, device encryption, audit logs, and backup restore tests are set up after patient hours.
HIPAA Compliance for Business Associates
DeveloperLook sets up HIPAA compliance for business associates: the software, billing, IT, and transcription vendors that handle patient data for providers. We read every BAA you signed, map the data, and build the safeguards and records your clients expect.
HIPAA Compliance for Dental Offices
DeveloperLook sets up HIPAA compliance for dental offices, from solo practices to dental groups. We review the front desk, operatories, and imaging PCs, write your policies, collect business associate agreements, and train your team with signed records you can show.FAQ
Frequently Asked Questions
Straight answers on cost, how often you need one, what it must include, and how it's done.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Our HIPAA risk assessment services start at $650 for one location with up to 8 systems holding ePHI. Multi-site assessments with a vulnerability scan and vendor review start at $1,450. Projects that also fix the top 5 risks and re-score them start at $2,900. You get a fixed quote after a free call.
It's the documented risk analysis the Security Rule requires at 45 CFR 164.308. It identifies where electronic patient data lives, what could threaten it, and how likely and harmful each threat is. The rule calls it a risk analysis, and it feeds the risk management plan that comes next.
Its main purpose is to find and rank the risks to ePHI, so you fix the most serious ones first. The Security Rule uses it as the basis for choosing safeguards. Without it, you can't show why you picked your controls, and OCR now runs an enforcement effort focused on risk analysis failures.
Yes, for every covered entity and business associate that handles ePHI. The risk analysis is a required implementation specification, not an addressable one, so size alone doesn't excuse it. A small practice can run a simpler one, but it still needs to be accurate, thorough, and written down.
The Security Rule sets no fixed interval, and HHS guidance treats risk analysis as an ongoing process. In practice we recommend a full review every 12 months and an update after any major change. A yearly cycle also lines up with insurance renewals and attestation programs that ask for a current analysis.
HIPAA itself doesn't set a frequency, but other programs do. Clinicians and hospitals in Medicare Promoting Interoperability must conduct or review a security risk analysis at least once each calendar year. HHS has also proposed a rule requiring a review at least every 12 months, though it is still a proposal as of October 2026.
Once a year as a baseline, plus whenever something important changes. Triggers include a new EHR or practice management system, a move to cloud storage, a new location, a merger, and any security incident. Updating an existing register after a change takes hours, which is why we hand over an editable inventory.
You define the scope, then inventory where ePHI is created, stored, and sent. Next, list threats and weaknesses for each system, check current safeguards, and rate likelihood and impact. Finally, assign risk levels, write the results down, and plan fixes. These steps follow HHS guidance on risk analysis, and we add evidence checks at each one.
Use the free HHS SRA Tool, or bring in outside help for the evidence checks. The tool walks a small practice through questions and scoring. What it can't do is look at your settings, so the answers depend on staff memory. We perform the checks directly and hand back a register your team can keep current.
You get 30 days of questions and re-scores for any risks you fix in that time. The register, plan, and evidence folder are yours, and the Security Rule expects that documentation kept for 6 years. Next year's review starts from your updated inventory, so it's usually quicker.
Saimul IslamFounder & CEO, DeveloperLookStill have questions?
Send a message or book a call with the team.
Free 30-min callGoogle Meet
Book a call
Book a free 30-minute call
In 30 minutes on Google Meet we walk you through how we would build it, how long it takes and what it costs. Then you get a written estimate.
Calendar not showing? Book on cal.com or send a brief.