Key Takeaways
- A HIPAA risk assessment (officially called a risk analysis) is required for therapists who handle electronic client information, no matter how small the practice.
- The goal: find where client information lives, what could go wrong, and what you're doing about it.
- HHS (Health and Human Services) offers a free Security Risk Assessment (SRA) Tool built with small practices in mind.
- There's no set schedule in the rule. HHS says the process should be ongoing, and big changes (new software, a security incident) should trigger a fresh look.
- Pasting client details into consumer AI tools can create real HIPAA risk.
- OCR (Office for Civil Rights) is actively enforcing this requirement, including against behavioral health providers.
You went to grad school to help people, not to become a part-time compliance officer.
But if you store notes in an EHR, email clients, or run telehealth sessions, HIPAA expects you to do a risk assessment. The good news? For most solo and small practices, it's very doable. No law degree required.
Here's what a HIPAA risk assessment is, how to do one step by step, and a checklist to make sure you've covered everything.
What Is a HIPAA Risk Assessment?
A HIPAA risk assessment, which HHS (Health and Human Services) calls a risk analysis, is a structured look at the risks to the electronic protected health information (ePHI) in your practice.
It's required under the HIPAA Security Rule. In HHS's words, you need to conduct "an accurate and thorough assessment of the potential risks and vulnerabilities" to the confidentiality, integrity, and availability of the ePHI you hold.
In plain English: figure out where client information lives, what could go wrong, and document it.
A few things worth knowing:
- There's no small-practice exemption. HHS does recognize that small practices have fewer systems and people to consider, so what counts as reasonable protection can look different than it would for a hospital.
- There's no required format. The Security Rule requires the risk analysis to be documented but does not require a specific format.
- Assessment and management are two different things. The risk assessment finds the problems. The risk management plan is what you do about them. You need both.
Why It's Worth Taking Seriously
OCR (Office for Civil Rights), the office that enforces HIPAA, launched a Risk Analysis Initiative in 2024. HHS says it was created to focus select investigations on compliance with the risk analysis requirement, which it calls the foundation for effective cybersecurity.
It's already reached behavioral health. In February 2026, OCR announced its 11th Risk Analysis Initiative settlement, with an Illinois substance use disorder treatment provider. After a phishing attack got into one staff member's email, OCR found the provider hadn't done an accurate and thorough risk analysis.
What Counts as PHI in a Therapy Practice?
Protected health information (PHI) is health information that can be tied to a specific person. In therapy, that covers more than you might think. Even an appointment reminder can count, since it connects someone's name to the fact that they're getting mental health care.
Here's where client information commonly hides in a therapy practice:
Electronic PHI
- Your EHR or practice management software
- Email (reminders, intake forms, clinical messages)
- Text messages, even "See you Thursday at 3"
- Telehealth platforms, including chat logs and any recordings
- Voicemail
- Billing and insurance portals
- Cloud storage and device backups
- Personal laptops and phones you use for work
Paper PHI
- Intake and consent forms
- Client files in cabinets
- Sticky notes and paper schedules
The Security Rule focuses on electronic information, but paper records are still protected under HIPAA's Privacy Rule, so it's smart to include them in your review.
A note on psychotherapy notes: HIPAA treats psychotherapy notes (the separate notes some therapists keep for their own use) differently from the rest of the clinical record, with stricter rules on disclosure. HHS's mental and behavioral health page explains the details. If you keep them, note where and how they're stored in your assessment.
HIPAA Risk Assessment Examples: Common Risks in Therapy Practices
Here's what risks tend to look like in real therapy practices, plus practical fixes:
Texting clients from your personal phone's default messaging app. Standard text messages aren't built for protecting health information. Fix: use your EHR's messaging feature or a secure messaging tool that will sign a BAA, and keep texts to logistics.
Session notes on an unencrypted personal laptop. If it's lost or stolen, so is the data. Fix: turn on built-in encryption (FileVault on Mac, BitLocker on Windows) and use a strong password.
Using free consumer email or calendar apps for client info. Free consumer versions of email and calendar tools generally don't come with a BAA. Fix: use a paid business version that offers a BAA, or use your EHR's built-in scheduling and messaging.
Shared Wi-Fi in a co-working office. Other tenants and guests may be on the same network. Fix: use a secured network or a personal hotspot for anything involving client data.
Paper files in a shared storage space. Fix: keep them locked in a space only you can access.
Telehealth on a general video app. Fix: use a telehealth platform built for healthcare that will sign a BAA. HHS has more on HIPAA and telehealth.
How to Do a HIPAA Risk Assessment: 7 Steps
HHS doesn't require one specific method. Its risk analysis guidance lays out the elements every risk analysis should include. Here's what they look like in a therapy practice.
1. Define Your Scope
List everything that touches client information:
- Devices: laptop, phone, tablet, home computer
- Software: EHR, telehealth, email, scheduling, billing, cloud storage
- Places: your office, home office, shared suites
- People: you, plus anyone else with access (a biller, virtual assistant, or supervisor)
2. Map Where Client Data Lives and Moves
For each item, note where the data is stored, who can access it, and how it's sent. A simple spreadsheet works fine:
Pay extra attention to data on the move, like email attachments and texts. That's when it's most exposed.
3. Identify Threats and Vulnerabilities
Two terms that sound alike but aren't:
- Threat: something that could cause harm. Think phishing emails, ransomware, a stolen laptop, or someone at home using your computer.
- Vulnerability: a weakness that makes a threat more likely to work. Think weak passwords, no two-factor authentication, an unencrypted laptop, or an unlocked file cabinet.
HHS says to document the combinations of threats and vulnerabilities that could affect your client information.
4. Review What You Already Have in Place
Before you panic, take stock. You might already have more protection than you think:
- Does your EHR encrypt data, and do you have a BAA (Business Associate Agreement) with it?
- Is your laptop password-protected and encrypted?
- Is two-factor authentication turned on for email and your EHR?
- Are paper files locked up?
- Do you have a signed BAA with your telehealth platform, or are you using a general video app without one?
5. Rate the Likelihood and Impact
Add a second tab to your spreadsheet from Step 2 and give each risk from Step 3 its own row. Then, for each risk, ask two questions:
- How likely is it?
- How bad would it be?
A simple High, Medium, Low scale works. For example:
- Phishing email to an account without two-factor authentication: likely and high impact. Fix this first.
- Paper files stolen from a locked cabinet in a locked office: unlikely, but high impact.
6. Assign Risk Levels and Document Everything
Combine your likelihood and impact ratings to get an overall risk level for each row. HHS doesn't require a specific rubric. Its guidance gives one example: base the risk level on the average of your likelihood and impact ratings. Then write it all down. HHS says your documentation should include the risk levels you assigned and a list of corrective actions (the fixes) for each one. In your spreadsheet, that's two more columns:
You'll turn that last column into a dated plan in Step 7.
Keep your documentation for at least six years, per the Security Rule's documentation requirements.
7. Build Your Risk Management Plan
Now turn your findings into a to-do list, starting with the high-risk items:
- Turn on two-factor authentication for email and EHR (this week)
- Encrypt your laptop (within 30 days)
- Confirm BAAs with all vendors (this month)
- Switch to a HIPAA-compliant texting option (within 60 days)
A dated, written plan shows you moved from knowing about risks to doing something about them.
Using the Free Security Risk Assessment Tool (SRA Tool)
If building all of this from scratch sounds like a lot, HHS has you covered. The HIPAA Security Risk Assessment (SRA) Tool was developed by the Office of the National Coordinator for Health IT (ONC) and OCR, sitting under the HHS. It's designed to help small and medium-sized practices comply with the Security Rule.
It walks you through a series of questions, helps you document risks and safeguards, and produces a report you can keep as part of your records. It's available as a downloadable application and a spreadsheet version.
The SRA Tool won't do the thinking for you, and HHS notes there's no single method that guarantees compliance. But for a solo or small practice, it's a solid, free place to start.
Is ChatGPT a HIPAA Risk? AI Tools and Client Information
This question comes up constantly right now, so let's answer it directly.
Pasting client information into consumer AI chatbots can create real HIPAA risk. HIPAA requires a business associate agreement (BAA) with vendors that handle PHI on your behalf, and consumer versions of popular AI chatbots generally don't come with one.
"But I took the client's name out." Unfortunately, that's often not enough. HIPAA has a formal standard for de-identifying information, and it goes well beyond removing a name. Details like a rare diagnosis, a specific life event, or a location can still point back to someone, especially in a small community.
The safer path: use AI tools built for healthcare that will sign a BAA, and add every AI tool you use to your risk assessment.
Blueprint is built specifically for therapists. If AI-assisted documentation is on your radar, it's worth choosing tools that have already done the compliance work.
Business Associate Agreements: Which Vendors Need One?
A business associate agreement (BAA) is a contract with a vendor that handles PHI for you. In it, the vendor agrees to protect that information under HIPAA's rules.
Vendors that commonly need a BAA:
- EHR and practice management software
- Telehealth platforms
- Billing services and clearinghouses
- Cloud storage used for client records
- Email providers used for client communication
- AI note-taking or transcription tools
- Virtual assistants who handle scheduling or client communication
If a vendor touches client information and you don't have a BAA, add it to your risk management plan.
How Often Should You Do a HIPAA Risk Assessment?
HIPAA doesn't set a specific schedule. According to HHS, the Security Rule does not specify how frequently to perform risk analysis, and some organizations do it annually or as needed depending on their circumstances. HHS also says the process should be ongoing.
Many practices choose to review it once a year. Beyond that, HHS points to events that should prompt a fresh look, like a security incident, turnover in key staff, or bringing in new technology. For a therapy practice, that might mean:
- Switching EHRs
- Adding telehealth
- Hiring staff or contractors
- A security incident (even a near miss)
- Moving offices
- Adding any new tool that touches client data, including AI
If nothing has changed, a quick dated note that you reviewed it and it's still accurate is worth keeping.
What's Changing: The Proposed HIPAA Security Rule Update
In January 2025, HHS proposed a major update to the Security Rule, with more specific requirements around things like encryption and multi-factor authentication.
It's still just a proposal. As of 2026, the final rule has been delayed, with the Office of Management and Budget's regulatory agenda showing a July 2027 target, and it's possible the final rule may not be issued. Until something is finalized, the current Security Rule is what applies.
Either way, a solid risk assessment today puts you in a better spot for whatever comes next.
HIPAA Risk Assessment Checklist
Use this as a template to make sure your assessment covers the basics:
- Scope defined: every device, app, location, and person with access to client info
- PHI mapped: where client info is stored, who can access it, and how it's sent
- Threats and vulnerabilities listed, including telehealth, mobile devices, and AI tools
- Psychotherapy notes addressed (if you keep them)
- Current safeguards documented
- Likelihood and impact rated for each risk
- Risk levels assigned
- BAAs confirmed for every vendor that handles client info
- Risk management plan written, with priorities and target dates
- Documentation dated and saved (and kept for at least six years)
- Next review scheduled
HIPAA Risk Assessment FAQ
Do solo therapists need a HIPAA risk assessment?
Yes. If you're a covered entity handling electronic client information, the Security Rule requires a risk analysis, regardless of practice size. HHS does allow that the right safeguards for a small practice may look different than for a large one.
What are the requirements for a HIPAA risk assessment?
HHS says a risk analysis should cover the scope of all your ePHI, where it's stored and sent, threats and vulnerabilities, current safeguards, likelihood and impact, risk levels, and documentation, along with ongoing review.
What's the difference between a risk assessment and a risk management plan?
The risk assessment identifies and rates your risks. The risk management plan lays out what you'll do about them and when. You need both.
What is the SRA Tool?
The Security Risk Assessment Tool is a free tool from ONC and OCR that walks small and medium-sized practices through a HIPAA risk assessment and helps document the results.
Can I use ChatGPT for therapy notes?
Consumer AI chatbots generally don't come with a BAA, so entering client information into them can create HIPAA risk. Removing a name usually isn't enough to fully de-identify information. Healthcare-specific tools that sign a BAA are the safer choice.
Do I need to hire a consultant?
Not necessarily. Many solo therapists with simple setups complete their own using the SRA Tool. Group practices, complex setups, or practices dealing with a breach may benefit from professional help.
