Documented vs. Managed: The HIPAA SRA Question OCR Is Asking That Most Organizations Can’t Answer

A completed HIPAA Security Risk Analysis is not the same as a managed security program.

That distinction is becoming central to OCR enforcement. Organizations that can produce an old assessment but cannot show what happened afterward are facing a difficult question:

What did you do about the risks you identified?

A document stored on a shared drive may demonstrate that an assessment occurred. It does not prove that the organization reduced risk, assigned accountability, tracked remediation, or involved leadership in security decisions.

As OCR’s enforcement focus expands from risk analysis to risk management, the difference matters more than ever.

THE HIPAA REQUIREMENT HAS TWO PARTS

The HIPAA Security Rule separates the security management process into two required implementation specifications under 45 CFR § 164.308(a)(1)(ii):

A. RISK ANALYSIS

Under § 164.308(a)(1)(ii)(A), covered entities and business associates must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.

This is the assessment.

It should identify:

Where ePHI is created, received, maintained, and transmitted
The systems, applications, devices, cloud platforms, and vendors involved
Threats and vulnerabilities affecting ePHI
The likelihood and potential impact of exploitation
The resulting level of risk
The methodology and assumptions used to reach those conclusions

B. RISK MANAGEMENT

Under § 164.308(a)(1)(ii)(B), the organization must implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

This is the response.

Risk management means the organization uses the findings from its SRA to make decisions, fund corrective actions, assign owners, monitor progress, and verify that safeguards are working.

The SRA identifies the risks. Risk management proves the organization acted on them.

Ensuring privacy and security with icons for each security area

WHY OCR IS LOOKING BEYOND THE DOCUMENT

OCR’s enforcement pattern has made risk analysis one of the most consistent drivers of HIPAA Security Rule settlements.

Recent cases involving healthcare providers, benefits plans, treatment centers, imaging organizations, and business associates repeatedly include findings that the organization failed to conduct an accurate and thorough enterprise-wide risk analysis. In 2026, OCR’s attention has increasingly extended to what organizations did, or failed to do, after risks were identified.

The enforcement logic is straightforward:

The organization was required to identify risks.
The organization knew or should have known about significant vulnerabilities.
The organization did not implement reasonable measures to reduce those risks.
A breach, ransomware incident, or investigation exposed the gap.

A stale SRA can therefore become evidence of knowledge rather than evidence of compliance.

That does not mean every unresolved finding automatically constitutes willful neglect. But when an organization documents serious risks, repeatedly leaves them unaddressed, and cannot explain its decisions, the facts can support a willful-neglect characterization and higher penalty exposure.

OCR’s Risk Analysis Initiative has reinforced this enforcement direction. Following a ransomware event or breach, investigators want to see whether the organization maintained a current, enterprise-wide risk analysis, and whether it used that analysis to manage risk.

THE QUESTIONS AN AUDITOR OR OCR INVESTIGATOR WILL ASK

A mature organization should be able to answer these questions quickly and provide supporting evidence.

WHO OWNS THE SRA?

Is there a designated security official or executive accountable for the assessment?

HIPAA requires an assigned security responsibility. “IT handles it” is not an accountability model. The owner should coordinate the assessment, maintain the risk register, engage system and business owners, and report progress to leadership.

WHEN WAS IT LAST UPDATED?

A risk analysis cannot remain accurate while the organization changes around it.

Investigators may ask whether the SRA was updated after:

A major system or cloud migration
A merger, acquisition, or new location
A material change in ePHI workflows
A ransomware event or security incident
A new vendor or business associate relationship
Deployment of a new clinical or remote-access platform

Even where the current rule allows flexibility around frequency, risk analysis must remain current. The proposed HIPAA Security Rule update would make the expectation more explicit by requiring verification and updating at least every 12 months, as well as after material changes or significant incidents.

HOW DID YOU DECIDE WHICH RISKS TO REMEDIATE FIRST?

A list of findings is not a prioritization strategy.

Leadership should be able to explain why one risk received immediate funding while another was scheduled for a later date. The decision should account for likelihood, impact, ePHI exposure, system criticality, operational consequences, regulatory obligations, and available safeguards.

WHERE IS THE EVIDENCE OF REMEDIATION?

Policies alone are not enough.

Evidence may include:

Completed access-control changes
Multifactor authentication deployment records
Vulnerability remediation tickets
Patch reports
Encryption configuration evidence
Backup and recovery test results
Updated business associate reviews
Security awareness and training records
Incident response exercises
Management approval and closure documentation

The question is not simply, “Did you identify the problem?”

It is, “Can you show what changed?”

HOW DO YOU TRACK ACCEPTED RISKS?

Not every risk can be eliminated immediately. An organization may accept, transfer, mitigate, or avoid a risk.

But risk acceptance must be deliberate and documented. The record should identify:

The risk being accepted
The business rationale
The compensating controls
The expiration or review date
The executive who approved the decision
The conditions that would trigger reconsideration

An undocumented risk is not an accepted risk. It is an unmanaged risk.

HOW DOES LEADERSHIP REVIEW THE RISK REGISTER?

If the risk register never reaches leadership, security decisions remain isolated in the technical department.

A living program gives executives a clear view of material risks, remediation progress, overdue actions, accepted risks, and required investments. Leadership does not need to review every vulnerability. It does need visibility into the risks that could affect patient care, operations, legal exposure, revenue, and trust.

FROM A DOCUMENT ON A SHELF TO A LIVING PROGRAM

Use this maturity model to evaluate your current position.

LEVEL 1: DOCUMENT ON A SHELF

One-time SRA completed
Limited or unclear scope
No current asset inventory or ePHI data-flow map
Findings stored in a report
No assigned owners or deadlines
No evidence of leadership review

This is documentation without management.

LEVEL 2: FINDINGS LIST

Risks are identified and rated
Some remediation activities begin
Ownership exists but is inconsistent
Updates depend on individual staff members
Accepted risks are rarely documented

The organization recognizes the problem but lacks a repeatable operating process.

LEVEL 3: TRACKED REMEDIATION

A formal risk register exists
Each finding has an owner and target date
Remediation tickets and evidence are retained
Risk analysis is updated after major changes
Leadership receives periodic status reports

This is a functioning risk management process.

LEVEL 4: LIVING RISK MANAGEMENT PROGRAM

The SRA is reviewed at least annually and after significant changes
ePHI flows, assets, vendors, and dependencies are continuously evaluated
Risk decisions are tied to business priorities and system criticality
Remediation is verified, not merely marked complete
Accepted risks have executive approval and expiration dates
Leadership reviews material risks and investment requirements
Testing, monitoring, incident response, and recovery results feed back into the risk register

This is the standard organizations should pursue, especially as OCR enforcement and the proposed Security Rule update raise expectations.

THE PROPOSED HIPAA SECURITY RULE RAISES THE BAR

HHS’s proposed HIPAA Security Rule update would make several existing cybersecurity expectations more specific and measurable.

Among the proposed changes are requirements involving:

A written risk analysis
A technology asset inventory
A network map showing ePHI movement
Documented threat, vulnerability, likelihood, and impact assessments
At least annual review and updating of the risk analysis
A formal risk management plan
Analysis of system and asset criticality
Written procedures to restore certain systems and data within defined timeframes

The proposal is not the same as the current enforceable rule, and organizations should monitor its status. But it provides a clear signal about the direction of healthcare cybersecurity enforcement.

The future standard is not “produce a policy when requested.”

It is know your environment, understand your risks, act on your findings, and prove that leadership is managing the program.

HOW CENOVA CYBER HELPS CLOSE THE GAP

Cenova Cyber helps healthcare organizations and business associates move from a compliance document to a risk-driven security program.

Our HIPAA compliance services help organizations:

Conduct an enterprise-wide security risk assessment
Identify ePHI locations, systems, workflows, and third parties
Build a prioritized remediation plan
Establish risk ownership and tracking
Align safeguards with HIPAA and recognized security frameworks
Maintain audit-ready evidence
Support monitoring, incident response, continuity, and recovery

Our vCISO services provide executive-level security leadership for organizations that need accountability without hiring a full-time CISO. We help leadership teams review risk, set priorities, oversee remediation, prepare for audits, and connect cybersecurity decisions to business objectives.

A risk assessment should produce more than a report.

It should give your organization a defensible path from current-state exposure to measurable risk reduction.

TAKE THE NEXT STEP BEFORE OCR DOES

Pull out your latest SRA and ask six questions:

Who owns it?
When was it last updated?
Does it cover every location where ePHI exists?
Which risks remain open?
Where is the remediation evidence?
When did leadership last review the risk register?

If the answers are unclear, your organization may have documentation, but not a managed HIPAA security program.

Schedule a free HIPAA security risk assessment consultation with Cenova Cyber. We will help you evaluate the strength of your current SRA, identify gaps in risk management, and establish a practical path toward stronger protection and OCR readiness.