# HIPAA Risk Analysis Report — Template

## Executive Summary

| Field | Value |
|-------|-------|
| Organization | [Organization Name] |
| Assessment Period | [Start Date] to [End Date] |
| Methodology | NIST SP 800-30 Rev. 1 aligned with OCR Nine Essential Elements |
| Lead Assessor | [Name, Title, Certifications] |
| Assessment Team | [Names and Qualifications] |
| Overall Risk Posture | [ ] Critical [ ] High [ ] Medium [ ] Low |

---

## OCR Nine Essential Elements Compliance

| Element | Status | Evidence |
|---------|--------|----------|
| 1. Scope — All ePHI identified | [ ] Complete [ ] Partial [ ] Not Done | |
| 2. Data Collection — ePHI locations documented | [ ] Complete [ ] Partial [ ] Not Done | |
| 3. Threats/Vulnerabilities — Identified and documented | [ ] Complete [ ] Partial [ ] Not Done | |
| 4. Current Security Measures — Assessed | [ ] Complete [ ] Partial [ ] Not Done | |
| 5. Likelihood — Determined | [ ] Complete [ ] Partial [ ] Not Done | |
| 6. Impact — Determined | [ ] Complete [ ] Partial [ ] Not Done | |
| 7. Risk Level — Determined | [ ] Complete [ ] Partial [ ] Not Done | |
| 8. Documentation — Finalized | [ ] Complete [ ] Partial [ ] Not Done | |
| 9. Periodic Review — Scheduled | [ ] Complete [ ] Partial [ ] Not Done | |

---

## ePHI Asset Inventory

| Asset Name | System Type | ePHI Categories | Volume (Records) | Location | Owner |
|-----------|------------|-----------------|------------------|----------|-------|
| | | | | | |

---

## Risk Register

| Risk ID | Asset | Threat | Vulnerability | Likelihood (1-5) | Impact (1-5) | Risk Score | Risk Level | Mitigation Plan | Owner | Target Date | Status |
|---------|-------|--------|--------------|------------------|-------------|-----------|-----------|----------------|-------|------------|--------|
| R-001 | | | | | | | | | | | |

---

## Risk Summary

| Risk Level | Count | Percentage |
|-----------|-------|-----------|
| Critical (20-25) | | |
| High (12-19) | | |
| Medium (6-11) | | |
| Low (2-5) | | |
| Minimal (1) | | |
| **Total** | | 100% |

---

## Mitigation Plans (Critical and High Risks)

### Risk [ID]: [Threat Description]

| Element | Detail |
|---------|--------|
| Risk Score | [Score] ([Level]) |
| Mitigation Measures | 1. [Measure] 2. [Measure] 3. [Measure] |
| Timeline | [Implementation dates] |
| Responsible Party | [Name, Title] |
| Target Risk Score | [Score] ([Level]) |
| Resources Required | [Budget, personnel, technology] |
| Risk Acceptance | [ ] Approved by [Name, Title] on [Date] |

---

## Approval

| Role | Name | Signature | Date |
|------|------|-----------|------|
| CISO / Security Officer | | | |
| Privacy Officer | | | |
| CIO / Executive Sponsor | | | |

## Next Review

| Field | Value |
|-------|-------|
| Scheduled Next Review | [Date — no later than 12 months] |
| Trigger Events | New systems, incidents, regulatory changes, organizational changes |