security-rule

Security risk analysis: implementation guidance

Nonbinding HHS guidance to help teams organize a documented security risk analysis.

Nonbinding guidance Identifier HHS-SECURITY-RISK-ANALYSIS Version 1.0

HHS publishes guidance to help organizations understand and implement the Security Rule. This material is nonbinding implementation guidance; it is not the regulation and does not replace an organization-specific analysis.

Use guidance as a planning aid, record the systems and risks reviewed, document decisions, and revisit the analysis when material changes occur.

Authority and source

Authority: Primary source
Citation: HIPAA Security Rule guidance
Publisher: U.S. Department of Health and Human Services
Source identifier: HHS-SECURITY-GUIDANCE
Source status: verified

Open primary source

Change and publication history

Initial reviewed publication — Sep 5, 2026