Security Risk Assessment Tool

The Security Risk Assessment Tool by the Office of the National Coordinator (ONC) for Health Information Technology is a free tool designed to help practices with one to 10 physicians identify their risks and vulnerabilities with electronic protected health information (ePHI) and then implement appropriate security measures. 

HIPAA requires practices to review and document their administrative, physical, and technical safeguards to regularly protect patients’ ePHI.

If you participate in the Medicare Merit-Based Incentive Payment System (MIPS), conducting or updating a risk assessment is a requirement in the Promoting Interoperability category. 

Last Updated On

September 08, 2026

Originally Published On

September 26, 2019