Hospitals should evaluate an electronic health record (EHR) by tracing electronic protected health information (ePHI) across the full environment, testing whether safeguards work in practice, checking that access fits users’ roles and purposes, and assigning documented follow-up to each risk. HIPAA requires a risk-based process—not a universal product checklist, scoring formula, or fixed assessment schedule.
What HIPAA requires hospitals to evaluate
The HIPAA Security Rule applies to ePHI that a covered entity or business associate creates, receives, uses, maintains, or transmits. It calls for appropriate administrative, physical, and technical safeguards. The rule is in 45 CFR Part 160 and Part 164, Subpart C.
That obligation is broader than checking whether the EHR application itself is secure. A hospital’s risk analysis needs to account for relevant ePHI wherever it resides or moves, including through connected systems, devices, workflows, storage, transmission paths, and vendors. The Privacy Rule adds a separate question: whether uses and disclosures are authorized and appropriately limited, including under the minimum-necessary standard where it applies.
HHS lists a proposed Security Rule update dated January 6, 2025. A proposal is not the same as an effective rule; hospitals should distinguish it from current obligations when assessing compliance.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
How can a hospital evaluate EHR security and privacy?
Use a documented sequence that connects the systems and workflows in scope to evidence, risk decisions, corrective actions, and follow-up. The appropriate depth depends on the hospital’s environment and risk profile.
1. Set the ePHI and system boundary
Map where ePHI is created, received, maintained, or transmitted. Include the EHR and relevant interfaces, portals, databases, backups, endpoints, mobile access, network paths, and third parties. Record the workflows that use those systems, who owns them, and whether each organization is acting as a covered entity or business associate.
A system inventory alone may miss how information moves in practice. Trace important workflows—for example, how a record reaches a connected service or is accessed remotely—and identify the systems and organizations involved at each point.
Rank #2
- Ideal for Gifting
- Ideal for a bookworm
- Compact for travelling
2. Analyze threats, vulnerabilities, likelihood, and impact
For each important asset and workflow, document relevant threats and vulnerabilities, how likely they are to cause harm, and the potential impact. Consider confidentiality, integrity, and availability. For a hospital, the impact analysis should also address clinical disruption and inaccurate or unavailable data, not only exposure of confidential information.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →HHS permits qualitative, quantitative, or combined approaches; it does not prescribe one universally best method. Whichever approach the hospital uses, record the rationale for its risk levels and connect each identified risk to an action and follow-up evidence.
3. Test safeguards using operational evidence
Organize the review across administrative, physical, and technical safeguards. Policies describe expected controls; they do not by themselves show that controls operate effectively. Request and examine evidence relevant to the hospital’s risks, such as:
- Policies, procedures, assigned security responsibilities, and role definitions.
- User lifecycle records and access-review evidence.
- Audit-log evidence and incident records.
- System configuration and patch-status information.
- Resilience documentation and records showing how remediation is tracked.
Compare what the hospital says it does with the records and configurations that show what happens in practice. HHS calls for periodic evaluation of whether security measures remain effective.
4. Compare privacy rules and access with actual workflows
Compare user roles and clinical or administrative workflows with actual EHR permissions and access records. Ask whether access is appropriate to the user’s role and purpose, how exceptional workflows are governed, and how the hospital limits unnecessary use or disclosure of PHI under the minimum-necessary standard.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The standard is applied in context; it should not be treated as a blanket rule preventing a care team from seeing a broader record when access is needed for treatment. The assessment should examine the purpose and circumstances of each relevant workflow rather than assume that the narrowest possible access is always appropriate.
Rank #4
5. Examine software, vendors, and integrations
Review patch processes, vendor advisories, supported-software status, vulnerability-scan results, and who is responsible for remediation across the EHR and connected systems. HHS’s January 2026 OCR newsletter specifically includes EHR software among software that may need patching. It points to vendor notices, vulnerability scanning, NIST’s National Vulnerability Database (NVD), and CISA’s Known Exploited Vulnerabilities (KEV) catalog as resources.
Vulnerability and patch information can change quickly. When documenting a particular vulnerability or patch, include the date and the affected software and version as established by the relevant advisory; do not treat an old status as current without checking for updates.
6. Prioritize findings and verify follow-up
For each finding, document the affected ePHI and workflow, the risk rationale, a remediation owner, a target date, any interim mitigation, and the evidence needed to close it. Follow-up should establish whether the corrective action was completed and whether it addressed the risk, rather than ending with a planned action alone.
Recommended Free Tools
Best Value
- It can be a gift option
- Comes with secure packaging
- Helpful in various ways
How should a hospital compare assessment tools or service proposals?
HIPAA does not supply an official vendor scorecard. Hospitals can compare proposals against the needs of their own environment, using the following dimensions as practical questions rather than as an HHS rating system.
| Comparison dimension | What to examine |
|---|---|
| Scope | Does the assessment follow ePHI across the EHR, connected systems, devices, workflows, storage, transmission, and third parties? |
| Control coverage | Does it address administrative, physical, and technical safeguards as well as relevant privacy and access practices? |
| Evidence and testing | Does it examine operational evidence and control effectiveness, or rely mainly on policy statements and completed questionnaires? |
| Dependencies | Can it account for vendors, integrations, and remediation responsibilities that cross organizational boundaries? |
| Remediation traceability | Can findings be tied to owners, deadlines, interim measures, closure evidence, and retesting? |
| Environmental fit | Does its scope and method fit the hospital’s size, systems, workflows, and risk profile? |
| Legal versus voluntary guidance | Does it distinguish binding HIPAA requirements from frameworks or other informational guidance? |
| Updates | How does the approach account for changes in software, vendors, and threats? |
HHS describes the ONC/OCR Security Risk Assessment Tool as useful for small and medium-sized practices and business associates; that description does not establish it as a complete hospital assessment product. NIST publications can inform implementation, but HHS characterizes the referenced NIST material as informational and not legally binding on covered entities. A framework mapping or completed questionnaire alone is not proof of compliance.
When should the hospital repeat the evaluation?
There is no single calendar interval prescribed for every hospital. HHS says the frequency depends on circumstances. Hospitals should evaluate safeguards periodically, review access records and incidents, and revisit risk when material changes affect technology, vendors, workflows, or the threat environment. The hospital should document the schedule it chooses and the events that trigger an earlier review.
A practical review cycle uses the risk record to direct attention: verify that safeguards remain effective, check whether new or changed systems introduce ePHI risks, and revisit open findings until there is evidence that the response is complete. The result is an ongoing process, not a one-time certification of an EHR product.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
