What OCR Looks For in a Hospital HIPAA Security Risk Analysis
Ask ten hospital compliance officers what a HIPAA Security Risk Analysis is and you will get ten confident answers. Ask them what the Office for Civil Rights (OCR) examines when it requests one after a breach, and the confidence evaporates. That gap, between what hospitals think an SRA is and what OCR expects to see, is the single most common reason risk analysis failures show up in OCR enforcement actions year after year.
For a small clinic, the gap is survivable. For a hospital, it compounds across every department, facility, and vendor relationship. Here is what OCR's expectations look like at hospital scale, based on the pattern visible in published resolution agreements and OCR's own audit protocol.
1. Enterprise-wide scope, not "the EHR plus the data center"
The most frequent scoping mistake hospitals make is treating the SRA as an IT exercise centered on the electronic health record. OCR's position, stated repeatedly in resolution agreements, is that the analysis must cover all electronic protected health information the organization creates, receives, maintains, or transmits, wherever it lives.
At a hospital, that means:
- Biomedical and imaging devices with embedded storage (infusion pumps, ultrasound carts, PACS)
- Laboratory information systems and pathology workstations
- Research databases and departmental "shadow" spreadsheets
- Voicemail, fax servers, and transcription platforms
- Cloud services adopted by individual departments without central IT review
- Backup media, decommissioned equipment awaiting disposal, and offsite storage
An SRA that cannot produce an ePHI asset inventory spanning departments is, in OCR's framing, not an enterprise risk analysis at all. It is a partial one, and partial is the word that appears in enforcement findings.
2. A defensible methodology, documented
OCR does not mandate a specific framework, but it expects the analysis to reflect a recognizable methodology. Most organizations anchor to NIST SP 800-30's core elements: identify threats and vulnerabilities, assess current controls, determine likelihood and impact, and derive risk levels. What OCR looks for in practice is whether you can show how you got from "here are our systems" to "here are our ranked risks."
A hospital SRA that consists of a completed checklist with yes/no answers and no reasoning is the classic failure mode. The document has to demonstrate analysis, not attestation.
3. The vendor layer: hundreds of business associates
A mid-sized hospital commonly holds hundreds of business associate relationships: billing companies, transcription services, cloud hosts, collection agencies, release-of-information vendors, device manufacturers with remote access. OCR expects the risk analysis to account for ePHI flowing to and through those third parties, and expects business associate agreements to exist for each of them.
This is where hospital SRAs most often fall apart under scrutiny, because BAA inventories tend to live in a spreadsheet owned by whoever negotiated the last contract. When OCR asks "show me the agreement covering the vendor involved in this breach," the answer needs to take minutes, not weeks.
4. Physical safeguards across every facility
Section 164.310 of the Security Rule, facility access controls, workstation security, device and media controls, gets skipped in a surprising number of hospital SRAs because it cannot be assessed from a desk. Multi-campus systems are especially exposed: the main hospital may have badge-controlled server rooms while the outpatient clinic three towns over has a wiring closet that doubles as a supply room.
OCR's audit protocol treats physical safeguards as first-class requirements, not an appendix. If your risk analysis has never involved someone physically walking your facilities, that is a finding waiting to happen. This is one reason some assessment vendors, Medcurity is one that builds onsite §164.310 physical safeguard assessments into its hospital engagements, send people to the buildings rather than assessing physical security by questionnaire.
5. A risk management plan that follows the analysis
The Security Rule pairs risk analysis (§164.308(a)(1)(ii)(A)) with risk management (§164.308(a)(1)(ii)(B)), and OCR reads them together. Identifying a high risk in 2023 and presenting the same open item, untouched, in your 2026 documentation is arguably worse than never finding it: it demonstrates knowledge without remediation.
What OCR wants to see is a living remediation record: risks ranked, owners assigned, target dates set, progress documented, and reasonable explanations where timelines slipped. Hospitals with functioning programs treat the SRA output as a work queue, not a shelf document.
6. Regular refresh, and after every significant change
HIPAA requires the risk analysis to be reviewed and updated periodically and whenever the environment changes materially: a new EHR module, an acquisition, a telehealth rollout, a ransomware event at a peer institution that changes your threat model. A hospital that merged two facilities and added a remote-work program since its last SRA is operating on an analysis of an organization that no longer exists.
What "defensible" looks like in practice
Pulling this together, a hospital SRA that survives OCR review has five properties: enterprise-wide ePHI scope with an asset inventory, a documented methodology, vendor and BAA coverage, physically verified facility safeguards, and a remediation trail that shows movement over time.
Getting there is genuinely hard with internal resources alone, which is why many hospitals pair internal teams with a purpose-built platform or assessment partner. If you evaluate that route, look for healthcare-specific depth rather than generic risk tooling: guided analysis mapped to the Security Rule's actual implementation specifications, expert review of the finished product rather than software-only output, and the ability to cover multiple facilities under one engagement. Medcurity's hospital security risk analysis is one example of that model, every guided SRA gets reviewed by a named advisor who stays with the organization year-round, and it is worth comparing against consultant-led engagements to see which fits your scale.
However you resource it, the standard is the same. OCR does not grade hospitals on whether they bought software or hired consultants. It grades them on whether the analysis was accurate, thorough, enterprise-wide, and acted upon. Build toward that, and the next records request becomes paperwork instead of a crisis.
