HIPAA Service

HIPAA Security Risk Assessment

A Security Risk Analysis (SRA) is required annually under 45 CFR §164.308(a)(1)(ii)(A) — and it's the #1 finding in OCR enforcement actions against medical practices. Atascocita IT delivers a NIST 800-30 aligned HIPAA risk assessment built specifically for Northeast Houston clinics.

What's included in your risk assessment

We inventory every system that touches electronic Protected Health Information (ePHI) and score threats against likelihood and impact — the exact methodology OCR uses during a breach investigation.

Full ePHI data-flow mapping (EHR, imaging, billing, backups)
Administrative, physical & technical safeguard review
Vendor & Business Associate Agreement (BAA) audit
Threat/vulnerability register with likelihood × impact scoring
Prioritized remediation roadmap with cost estimates
OCR-ready executive summary and evidence archive

Who needs a HIPAA Risk Assessment?

Every Covered Entity and Business Associate — from a two-provider family practice in Atascocita to a multi-location surgical group in Kingwood. The HHS Office for Civil Rights expects a fresh SRA whenever your environment changes (new EHR, new location, staff turnover, ransomware event) and at minimum once per calendar year.

Typical timeline

Most Northeast Houston practices complete the full engagement in 2–3 weeks: kickoff and discovery in week one, on-site technical review in week two, and the deliverable presentation in week three.

Frequently asked questions

How much does a HIPAA risk assessment cost in Texas?

For a typical single-location medical practice in Atascocita, Humble, or Kingwood, engagements run $2,500–$6,500 depending on user count, number of systems, and whether penetration testing is bundled. Atascocita IT provides a fixed-fee quote after a free 30-minute scoping call.

Does this satisfy the 2026 HIPAA Security Rule NPRM updates?

Yes. Our methodology already incorporates the proposed 2026 changes — mandatory encryption of ePHI at rest and in transit, annual technical testing, and network segmentation of ePHI systems.