HHS Releases Updated Security Risk Assessment Tool

Posted By Steve Alder on Sep 10, 2025

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) and the Assistant Secretary for Technology Policy (ASTP) have announced the release of an updated version of the Security Risk Assessment (SRA) Tool.

The SRA tool was developed to help small to medium-sized healthcare providers comply with the security risk assessment provision of the HIPAA Security Rule, one of the foundational requirements of the Security Rule. A HIPAA risk assessment failure is the most commonly identified HIPAA Security Rule violation, and OCR currently has an active enforcement initiative targeting noncompliance. Through its investigations of complaints, data breaches, and compliance audits, OCR commonly discovers that HIPAA-regulated entities have either failed to conduct a risk assessment or that risk assessments are inaccurate or incomplete. For instance, a risk assessment is conducted based on an incomplete or out-of-date asset inventory.

The enforcement initiative was announced by OCR in October 2024 when the first penalty was imposed on Bryan County Ambulance Authority in Oklahoma. Since then, OCR has imposed 10 financial penalties for risk analysis failures, making it the most common reason for security-related HIPAA civil monetary penalties and settlements.

The SRA tool is an invaluable tool for small and medium-sized healthcare providers, as it guides them through the process of conducting a risk assessment. The latest release, version 3.6, includes several updates to improve usability. A new assessment confirmation button has been added with a reviewed-by date for each section, allowing users to confirm that a section has been reviewed and approved, which will be saved for audit records.

The risk scale has been updated to align with NIST scoring, with the score of “medium” changed to “moderate”. Updated library files will be installed when the new version is installed, mitigating vulnerabilities that may exist in outdated versions. The reports have been updated with new content, including section-specific approval/reviewed-by details and additional information entered by users. There have also been improvements to questions, responses, and education to make the SRA Tool more relevant to the evolving cybersecurity environment and to improve ease of use.

OCR and ASTP are hosting two live webinars this month on the SRA Tool. Experts will provide an introduction to the SRA tool, demonstrate the new features and enhanced reports, and will be available to answer questions about the tool and new features. The webinars will be held on September 15, 2025, at 12 p.m. ET, and on September 16, 2025, at 3 p.m. ET. You can register for the webinar on this link.