The U.S. Department of Health and Human Services' (HHS) Office for Civil Rights (OCR), in partnership with the Assistant Secretary for Technology Policy, has released an updated version of its Security Risk Assessment Tool, a free resource intended to guide smaller health care organizations through the critical process of conducting HIPAA-compliant risk assessments.

A comprehensive risk assessment is one of the foundational requirements of the HIPAA Security Rule—but it’s also the most common compliance failure cited by OCR. The updated tool includes:

• Audit-ready tracking: A new “reviewed-by” button with a date stamp for each section, helping organizations demonstrate internal review and approval.
• NIST-aligned scoring: The risk scale has been updated to match NIST terminology, changing “medium” to “moderate.”
• Improved reporting: Enhanced reports now include section-specific approval details and user-entered information.
• Updated libraries: Installation now replaces outdated library files to reduce potential vulnerabilities.
• Refined content: Clearer questions, responses, and educational materials to reflect today’s cybersecurity environment.

The Security Risk Assessment Tool is available in two formats: a downloadable Windows desktop application and a Microsoft Excel workbook. All data entered is stored locally on the user’s device; no information is collected by or transmitted to HHS.

Practices can download version 3.6 of the Tool, along with the user guide, on the HHS SRA Tool webpage.

On-Demand Security Webinar

ONC recently held two webinars with a training session and overview of the Security Risk Assessment Tool 3.6. The slides and a recording of the webinar is posted below.  

• Webinar Slides
• Webinar Recording