Privacy operations · electronic information · reviewed 28 August 2026
Small-practice security risk review
A compact inventory of systems, threats, safeguards, owners, and unresolved security work.
Use the resource →Use for a periodic risk-analysis cycle and after a material system, vendor, location, or workforce change.
This is not a complete HIPAA risk analysis, penetration test, or certification of security.
Recheck the source links before relying on an older saved copy. Entries stay in this open page. Copy or print the working copy before leaving.
Working resource
Make the invisible facts visible.
Review point 01
Inventory electronic information
Map devices, applications, accounts, networks, backups, removable media, and vendor systems.
Review point 02
Identify foreseeable threats
Consider loss, theft, misdelivery, credential compromise, malware, outage, insider access, and physical exposure.
Review point 03
Record current safeguards
Document administrative, physical, and technical controls actually in use rather than planned.
Review point 04
Assess gaps consistently
Use one documented method for likelihood, impact, and priority across systems.
Review point 05
Assign corrective work
Give every accepted or remediated risk an owner, action, due date, and status.
Review point 06
Preserve the analysis
Keep the evidence, decisions, and follow-up so the review is reproducible later.
Private working copy
Carry the review into your own next action.
Your entries remain only in this open page. They are not saved, uploaded, transmitted, or placed in the URL. Use a non-identifying reference—not a client name.
Your working copy
Controlling material
Read the authority, not merely the worksheet.
Educational information only; not legal, clinical, tax, billing, or regulatory advice. A resource cannot resolve facts it was not given or authority that changed after the review date.
