HHS/OCR

HIPAA Security Risk Assessment (SRA)

Draft and validate the Security Risk Assessment required by the HIPAA Security Rule (45 CFR §164.308(a)(1)). Maps ePHI assets to threats, vulnerabilities, and safeguards across administrative, physical, and technical categories. Produces the SRA report and risk register aligned with HHS/OCR audit protocol.