HIPAA Risk Register: How to Build and Score One
A HIPAA risk register is the living list of risks to electronic protected health information (ePHI) that your risk analysis uncovers, with each risk's likelihood, impact, owner, mitigation plan and due date. It's how you show that HIPAA risk analysis and risk management are ongoing work, not a binder you update once a year.
In my years building healthcare reports, I've seen the same pattern: the risk analysis gets done, a spreadsheet gets saved to a shared drive, and nobody opens it again until something goes wrong. This guide shows you how to build a risk register that stays current, scores risks consistently and holds up when a regulator asks for it.
Why does a HIPAA risk register matter?
The HIPAA Security Rule requires every covered entity and business associate to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability" of the ePHI it holds (45 CFR 164.308(a)(1)(ii)(A)). HHS calls risk analysis a direct input to the risk management process, and the Rule requires the work to be documented (HHS guidance on risk analysis).
Regulators are checking. Under its Risk Analysis Initiative, the HHS Office for Civil Rights (OCR) announced its 14th enforcement action in June 2026: a $450,000 settlement with an employer-sponsored health plan over potential failures to conduct an accurate risk analysis before a ransomware attack (Nixon Peabody summary).
A risk register turns a one-time analysis into a working tool. It answers the questions an auditor will ask: what risks did you find, how serious are they, who owns each one, and what have you done about them?
Risk analysis vs. risk register vs. risk management
These three terms are often used interchangeably, but they do different jobs.
| Term | What it is | Output |
|---|---|---|
| Risk analysis | The required assessment of threats and vulnerabilities to your ePHI | A documented set of risks with likelihood, impact and risk level |
| Risk register | The ongoing record of those risks and what you're doing about each one | A living list with owners, plans, dates and status |
| Risk management | The process of reducing risks to a reasonable and appropriate level | Implemented safeguards, completed actions and evidence |
Think of the risk analysis as the diagnosis, the register as the treatment plan, and risk management as the treatment itself.
What should a HIPAA risk register include?
HHS says the Security Rule "does not require a specific format" for documentation. These fields cover what OCR's guidance describes and what you'll need to manage each risk day to day:
| Field | What to record |
|---|---|
| Risk ID and title | A short, unique name, such as "Unencrypted laptops with ePHI" |
| Asset or system | Where the ePHI lives or flows: EHR, billing system, data warehouse, laptop, vendor |
| Threat | What could happen: ransomware, lost device, insider misuse, outage |
| Vulnerability | The weakness that makes it possible: no encryption, shared logins, no backups |
| Current controls | Safeguards already in place, and whether they're configured and used properly |
| Likelihood (1–5) | How probable the threat is, given current controls |
| Impact (1–5) | How bad it would be: records affected, downtime, cost, patient harm |
| Risk score and level | Likelihood × impact, mapped to Low, Medium, High or Critical |
| Owner | One named person accountable for the risk |
| Mitigation plan | The specific actions that will reduce the risk |
| Target date and status | When the plan is due and where it stands |
| Evidence and review date | Proof the actions were done, and when the risk will be reviewed next |
If you haven't documented where your ePHI is stored, received, maintained and transmitted, start there. HHS lists that data collection as an early step, and without it your register will miss risks. Our guide to healthcare data governance explains how to build that inventory.
How do you score risks on a 5×5 heat map?
The Security Rule doesn't prescribe a scoring method; HHS says there is "no single method or 'best practice' that guarantees compliance." What matters is that you assess both the probability and the magnitude of each risk, assign a risk level, and apply the method consistently. HHS points to NIST SP 800-30 for example steps.
A 5×5 matrix is a common, easy-to-explain approach. Rate likelihood and impact from 1 to 5, then multiply them for a score from 1 to 25.
| Rating | Likelihood | Impact |
|---|---|---|
| 1 | Rare: hard to imagine happening | Minimal: no ePHI exposed, little disruption |
| 2 | Unlikely: could happen, but not expected | Minor: a few records, quickly contained |
| 3 | Possible: has happened to peers | Moderate: reportable breach or hours of downtime |
| 4 | Likely: expected within a year | Major: many records, days of disruption |
| 5 | Almost certain: already happening or imminent | Severe: large breach, extended outage, patient safety affected |
One example of score bands: 1–4 Low, 5–9 Medium, 10–16 High, 20–25 Critical. Set your own bands, write them down, and decide in advance how fast each level must be addressed. For instance, Critical risks might need an owner and a plan within 30 days.
Plotting every risk on the grid gives leadership a one-glance view: the top-right corner is where budget and attention go first.
How to build a HIPAA risk register in six steps
- Define the scope. Include all ePHI your organization creates, receives, maintains or transmits, across every system, device and vendor.
- Inventory where ePHI lives and flows. List systems, data stores and the flows between them, including reports and extracts that copy ePHI somewhere new.
- Identify threats and vulnerabilities for each asset. Consider human, natural and environmental threats, as HHS describes.
- Document current controls and score each risk. Record what's already in place, then rate likelihood and impact with your written scale.
- Assign an owner, a plan and a date. A risk without an owner doesn't get fixed. Make the plan specific enough to verify.
- Review and update it continually. HHS says the process "should be ongoing" and recommends revisiting it after security incidents, ownership changes, staff turnover or new technology.
Not sure where your program stands overall? Our free 25-point data governance checklist scores ownership, data quality, access and compliance in about 10 minutes.
Common HIPAA risk register mistakes
- Treating it as a one-time project. A register last updated before your new EHR, acquisition or ransomware scare isn't accurate.
- No owners. "IT" isn't an owner. Name one person per risk.
- No evidence. Marking a risk "mitigated" without proof won't help you in an investigation.
- Scoring without an inventory. If you don't know where ePHI flows, you can't know what's at risk.
- Disconnected from policies and controls. Each mitigation should tie back to a policy, a control and its evidence.
What's changing in the HIPAA Security Rule?
In January 2025, HHS proposed updates to the Security Rule that would add more specific requirements, including a written technology asset inventory and network map, and a review of the risk analysis at least every 12 months (Federal Register proposal). As of this writing the proposal hasn't been finalized, so the current rule still applies. Building an asset inventory and a regularly reviewed register now is sound practice either way.
Spreadsheet or dedicated tool?
A spreadsheet can work for a very small practice, and HHS offers a free Security Risk Assessment Tool for small and medium-sized providers. Spreadsheets start to break down when several people update them, when you need an approval trail, or when you have to show evidence quickly.
That's why we built the risk register in Tracewell. You score each risk on likelihood and impact, assign owners, mitigation plans and target dates, and see everything on a 5×5 heat map. Because Tracewell also holds your data lineage, policies and HIPAA control scorecard, each risk sits next to the systems and controls it affects, with an append-only activity log behind it. If you'd rather have help running the analysis itself, our Readiness Assessment includes a PHI risk review.
Frequently asked questions
Is a risk register required by HIPAA?
Not by name. HIPAA requires an accurate and thorough risk analysis, risk management and documentation. A risk register is the most common way to document risks and show how you're managing them.
How often should a HIPAA risk register be updated?
The current Security Rule doesn't set a fixed frequency; HHS says the process should be ongoing. Update it after incidents, new systems, ownership changes or staff turnover, and review the whole register at least once a year.
What's the difference between a risk assessment and a risk analysis?
The Security Rule uses the term "risk analysis." Many people use "risk assessment" for the same work. What matters is that it covers all ePHI, scores likelihood and impact, and is documented.
Who should own the HIPAA risk register?
Usually your designated security official, with each individual risk owned by the leader closest to it, such as the IT director, practice administrator or a vendor manager.
Can a small practice use a spreadsheet?
Yes, if it's complete, current and documented. Many small practices start with a spreadsheet or the HHS SRA Tool and move to a dedicated system as they add locations, systems or staff.
Sources
- HHS: Guidance on Risk Analysis Requirements under the HIPAA Security Rule
- Nixon Peabody: OCR's 14th Risk Analysis Initiative enforcement action (July 2026)
- NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments
- Federal Register: Proposed HIPAA Security Rule update (January 2025)
- HealthIT.gov: Security Risk Assessment Tool
This article is general information, not legal advice. Work with your compliance officer and legal counsel on your organization's specific obligations.