HIPAA Risk Assessment Tool
The HIPAA Security Rule holds every covered entity and business associate responsible for protecting electronic protected health information (ePHI) across Administrative, Physical, and Technical safeguards — and a documented Security Risk Analysis is the foundational, most-cited requirement in OCR enforcement. Most practices assume their EHR vendor has it handled and find out otherwise after a breach. This free interactive tool walks you through 18 safeguard questions, scores your readiness in real time, flags every gap with its §164 citation, and highlights the four high-leverage moves — SRA, MFA, PAM, and encryption at rest — that cut your risk fastest. It is a self-assessment, clearly labeled — not a formal SRA and not legal advice.
HIPAA Risk Assessment
18 questions across the HIPAA Security Rule's Administrative, Physical, and Technical safeguards. Mark each as In Place / Partial / No. Get a live compliance score, per-safeguard breakdown, flagged gaps, and prioritized next steps. 100% browser-only — nothing is sent to LayerLogix.
This is a self-assessment, not a formal Security Risk Analysis (SRA) and not legal advice. The HIPAA Security Rule requires a documented, organization-wide SRA. Use this as a readiness gut-check, then complete a real SRA.
Administrative Safeguards
Security Risk Analysis (SRA) completed
An accurate, thorough, organization-wide risk analysis of confidentiality, integrity, and availability of ePHI has been conducted and documented within the last 12 months.
Risk management plan in place
Security measures are implemented to reduce risks and vulnerabilities found in the SRA to a reasonable and appropriate level.
Sanction policy for violations
A documented sanction policy applies appropriate penalties against workforce members who fail to comply with security policies and procedures.
Security & Privacy Officer assigned
A named Security Official (and Privacy Official) is responsible for developing and implementing required policies and procedures.
Security awareness & training program
All workforce members receive recurring security awareness training, including phishing, malware, and password/login monitoring.
Incident response & breach procedures
Documented procedures exist to identify, respond to, mitigate, and report suspected or known security incidents and breaches.
Contingency plan (backup & DR)
A data backup plan, disaster recovery plan, and emergency-mode operation plan exist and have been tested.
Business Associate Agreements (BAAs)
Signed BAAs are in place with every vendor that creates, receives, maintains, or transmits ePHI on your behalf.
Physical Safeguards
Facility access controls
Physical access to systems and facilities housing ePHI is limited to authorized personnel (locks, badges, visitor logs).
Workstation use & security
Policies govern proper workstation use and physical safeguards restrict access to workstations that access ePHI.
Device & media controls / disposal
Policies govern receipt, removal, reuse, and secure disposal/sanitization of hardware and media containing ePHI.
Technical Safeguards
Unique user IDs & access control
Each user has a unique identifier; access to ePHI is restricted to those who need it (least privilege), with emergency access procedures.
Privileged Access Management (PAM)
Privileged accounts are managed, application allowlisting/ringfencing limits what can run, and least-functionality is enforced.
Multi-factor authentication (MFA)
MFA is enforced for remote access, email, EHR, and all privileged accounts that can reach ePHI.
Audit controls / logging
Hardware, software, and procedural mechanisms record and examine activity in systems containing ePHI.
Integrity controls
Mechanisms protect ePHI from improper alteration or destruction (e.g., checksums, version control, change monitoring).
Encryption at rest
ePHI on endpoints, servers, databases, and backups is encrypted at rest (a recognized addressable safe harbor).
Encryption in transit
ePHI transmitted over networks (email, EHR, portals, file transfer) is encrypted using TLS or equivalent.
Close these first — they deliver the most risk reduction per dollar:
- Security Risk Analysis (SRA) completed
- Privileged Access Management (PAM)
- Multi-factor authentication (MFA)
- Encryption at rest
What We Offer
Comprehensive solutions tailored for Houston-area businesses
18 Safeguard Questions
Covers all three HIPAA Security Rule safeguard categories — Administrative, Physical, and Technical — mapped to their 45 CFR §164 citations so you know exactly which requirement each question answers.
Live Compliance Score
Your overall readiness percentage and per-safeguard breakdown recompute in real time as you answer In Place / Partial / No. See where you stand at a glance.
High-Leverage Items Flagged
The tool highlights the items that deliver the most risk reduction per dollar: a current Security Risk Analysis (SRA), MFA, PAM, and encryption at rest. Fix these first.
Gap List with Citations
Every No or Partial is flagged with its §164 citation and a plain-English recommendation, so your remediation plan writes itself.
Download Your Report
Export a dated text report of your score, per-safeguard breakdown, flagged gaps, and prioritized next steps. Bring it to your compliance officer or your MSP.
100% Browser-Only
Nothing is sent to LayerLogix servers, never logged, never stored. Your answers — and any sense of where your ePHI is exposed — stay on your device.
Why Choose LayerLogix?
Serving businesses throughout the Greater Houston area including Houston, The Woodlands, Sugar Land, Dallas, Fort Worth, Austin, San Antonio.
Know Where Your ePHI Is Exposed
Most practices assume they are covered by their EHR vendor. The tool walks you through what you are actually responsible for under the Security Rule.
Prioritize the SRA First
A documented Security Risk Analysis is the foundational requirement and the most-cited gap in OCR enforcement. The tool puts it front and center.
See the High-Leverage Technical Wins
MFA, PAM, and encryption at rest close the controls breaches exploit most — and the tool flags exactly which you are missing.
Reduce OCR Enforcement Exposure
A documented self-assessment and remediation plan demonstrate good-faith effort if the Office for Civil Rights ever comes knocking.
Free Forever
No email gate, no signup, no upsell on the tool itself. We earn the conversation by giving you a genuinely useful starting point.
Our Process
Frequently Asked Questions
Does this satisfy the HIPAA Security Risk Analysis requirement?▼
What are the three HIPAA safeguard categories?▼
Why does the tool emphasize SRA, MFA, PAM, and encryption?▼
Is my data sent anywhere?▼
Who needs to comply with the HIPAA Security Rule?▼
What do I do after I export my report?▼
Do you provide HIPAA Risk Assessment Tool in Houston and nearby areas?▼
What does HIPAA Risk Assessment Tool cost for a Houston business?▼
Ready to Get Started?
Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, The Woodlands, Sugar Land, and the surrounding Greater Houston area.