Free HIPAA Risk Assessment Generator
Document ePHI assets, threats, safeguards, likelihood, impact and treatment actions. Export an evidence-based risk register in HTML, Word or PDF.
How to create your hipaa risk assessment
Inventory all ePHI creation, receipt, storage and transmission; gather actual threats, vulnerabilities, control evidence, ratings, limitations and action owners.
- 01
Gather accurate information
Identify the responsible organisation, scope and actual contact routes. USA is an editable example country. HIPAA tools address US obligations; a location field does not establish whether a law applies.
- 02
Tailor examples and findings
Open each section. Keep suitable model wording or edit it, and use Restore example when needed. Actual parties, clinical explanations, controls and findings are not invented. Closing a section brings the next into view while keeping answers.
- 03
Review and export
Read the complete document and verify required details. Download Word or HTML, or open Print / Save PDF for a fixed copy. The preview, formatted copy and exports include a link to this exact tool.
- 04
Assign actions and retain the review
Confirm evidence, record unresolved findings and follow up with named owners and dates. Keep the report securely with supporting records. A report does not verify controls or certify compliance.
What your document covers
Scope and data flows → evidence and rating criteria → risk register → transparent planning ratings → treatment and reassessment → review fields.
How planning ratings work
This local planning model assigns low = 1, medium = 2 and high = 3 to likelihood and impact. Their product gives a planning rating: 1–2 low, 3–4 moderate and 6–9 high. A not-assessed input leaves the risk unrated. This is not an HHS scoring standard, an automated vulnerability finding or a compliance score. Ratings describe current safeguards; planned actions do not reduce the current rating.
Conditional questions follow the selected purpose or activity. Sample procedures stay editable. Patient records, identifiable student cases and credentials should remain in the organisation’s approved systems.
Scope, privacy and review
This records your analysis; it does not scan systems or establish compliance. The built-in 3×3 planning matrix is not an HHS score. Missing likelihood or impact stays unrated. Review all ePHI and external service dependencies.
- Generation takes place in this browser. Form answers are not sent to a document-generation service or saved between visits. Download before leaving.
- Enter organisation-level details and relevant evidence summaries. Keep patient-identifying records and sensitive supporting evidence in approved organisational systems.
- Check applicable requirements, operational capacity and authority before use. Model wording does not verify facts, implement safeguards or confer legal compliance.
Substantive update: 9 October 2026. No certification or review by a named legal professional is claimed.
Frequently asked questions
Is this tool free, and do I need an account?
Creating, copying and exporting your document is free and requires no account. Form answers are processed in this browser and are not saved between visits.
Does this tool test systems or discover vulnerabilities?
No. You supply the assets, threats, controls and evidence. The tool organises the register and applies a disclosed planning matrix to your selected likelihood and impact. Unknown inputs remain unrated, and it does not certify that the analysis is complete.
Can I keep or edit the sample content?
Yes. Fields marked “Editable example” contain model wording with Restore example controls. USA is an editable sample country, not a determination of applicable law. Keep wording only when it matches the actual situation. Enter actual parties, contacts, clinical information supplied by a professional or assessment evidence as appropriate; do not enter patient records, student case details or credentials.
Which export formats are available?
Download HTML or an editable Word .docx document. For PDF, open Print / Save PDF and choose Save as PDF in the browser print dialog. Preview, formatted copy and exports contain a link to this exact tool. Publish policies where appropriate; share consent, contract and assessment documents privately with intended recipients.
Reference for your review
HHS: risk analysis requirements. Check the rules applicable to the organisation, records and activity; reference links do not establish applicability or certification.