Home Services vCISO Advisory Leadership Baseline CMMC Readiness Tabletop Exercises Risk Assessment Cyber Insurance Readiness MSP Security Oversight Executive Reporting Incident Response Plan HIPAA Risk Assessment Security Roadmap Technology Leadership (vCTO) Healthcare Defense & CMMC Construction Financial Services Legal & Professional Manufacturing & Logistics Tacoma Service Areas Spokane Northern Idaho Bonney Lake Puyallup Gig Harbor Auburn Olympia About Blog Community Contact Free Discovery Call
Home › Services › HIPAA Security Risk Assessment

HIPAA Security Risk Assessment

The risk analysis the HIPAA Security Rule requires, with a safeguards review and audit-ready documentation for covered entities and business associates. Advisory-only, framed as assessment, not certification.

Schedule a Free Discovery Call →

What a HIPAA Security Risk Assessment Is

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis of the risks to electronic protected health information. It is one of the most commonly cited gaps in enforcement actions, and many organizations either have never completed one or cannot produce current documentation.

CyberCascadia performs that risk analysis: a structured review of your administrative, physical, and technical safeguards, with clear documentation you can rely on. We also flag where Washington's My Health My Data Act may apply. To be clear, there is no HIPAA certification and we do not claim to make you compliant. We provide the assessment and documentation that demonstrate due diligence and guide your improvements.

Who It Is For

Covered entities such as healthcare providers, clinics, and practices, and the business associates that serve them, including IT vendors, billing companies, and software providers that handle protected health information. If you create, receive, maintain, or transmit ePHI, the risk analysis requirement applies to you.

It is especially relevant for organizations in Washington and North Idaho that must consider both HIPAA and, where applicable, the Washington My Health My Data Act.

Business Problems It Solves

  • You have never completed the risk analysis the HIPAA Security Rule requires.
  • Your last assessment is outdated and no longer reflects your environment.
  • An auditor, partner, or payer is asking for current risk analysis documentation.
  • You are unsure whether the Washington My Health My Data Act applies to you.
  • You lack a clear, prioritized view of where your ePHI risk concentrates.
What Is Included

A thorough, documented risk analysis.

Aligned to the HIPAA Security Rule and tailored to your organization.

Risk Analysis

An accurate and thorough analysis of the risks to your electronic protected health information, as the Security Rule requires.

Safeguards Review

Evaluation of your administrative, physical, and technical safeguards against HIPAA Security Rule standards and implementation specifications.

Risk Register

A documented inventory of identified risks with likelihood, impact, and ownership that you can maintain over time.

My Health My Data Considerations

Notes on where Washington's My Health My Data Act may apply to your consumer health data handling, alongside HIPAA.

Remediation Plan

A prioritized, practical plan for addressing identified gaps, sequenced by risk and tailored to your resources.

Audit-Ready Documentation

Documentation written to demonstrate that you have met the risk analysis requirement and are managing risk responsibly.

What Is NOT Included (By Design)

CyberCascadia does not certify HIPAA compliance, because no such certification exists, and no assessment can guarantee compliance. We do not sell, install, or manage security products, and we do not operate a SOC or managed services. This is a risk assessment and documentation engagement, not a penetration test or a tool deployment.

This independence is intentional. Because we earn no product commissions, our findings stay objective. We document where you stand and work alongside your MSP or IT team on remediation. Ongoing compliance remains your organization's responsibility.

Typical Deliverables

  • Documented HIPAA Security Rule risk analysis
  • Administrative, physical, and technical safeguards review
  • Risk register with likelihood, impact, and ownership
  • Prioritized remediation plan
  • Notes on Washington My Health My Data Act applicability
  • Audit-ready documentation package
Engagement Model

How the assessment unfolds.

A typical engagement runs three to five weeks, scoped to your organization.

01

Scope & ePHI Mapping

We identify where protected health information lives and moves, and define the boundary of the risk analysis.

02

Analyze Safeguards

Through interviews and documentation review, we assess your administrative, physical, and technical safeguards and build the risk register.

03

Document & Remediate

You receive the documented risk analysis and remediation plan, with a review session to align on next steps and priorities.

Why CyberCascadia

CyberCascadia is advisory-only and founder-led by Tanner Harrison, CISSP. Your risk analysis is conducted directly by an experienced practitioner, not handed to a checklist tool. Because we sell no products and run no managed services, the findings are honest and the documentation reflects your true posture.

We are local to Washington and North Idaho, and we understand both HIPAA and the Washington My Health My Data Act as they affect regional healthcare organizations and their vendors. The result is a defensible risk analysis and a clear path forward.

Frequently Asked Questions

HIPAA risk assessment questions we hear most.

No. There is no official HIPAA certification, and no assessment can guarantee compliance. What we provide is the risk analysis the HIPAA Security Rule requires, a review of your safeguards, and documentation that demonstrates due diligence. Compliance is an ongoing responsibility that remains with your organization.

Covered entities and business associates that create, receive, maintain, or transmit electronic protected health information are required by the HIPAA Security Rule to conduct an accurate and thorough risk analysis. This includes many providers, clinics, and the vendors that serve them.

Washington's My Health My Data Act extends protections to consumer health data beyond the scope of HIPAA, with its own consent and handling requirements. If you operate in Washington or handle the health data of Washington residents, it may apply alongside HIPAA. Our assessment notes where it is relevant so you can address both.

No. CyberCascadia is advisory-only. We do not sell, install, or manage products. We assess your administrative, physical, and technical safeguards and document findings, then work alongside your MSP or IT team on remediation.

You receive a documented risk analysis, a safeguards review, a risk register, and a prioritized remediation plan, the kind of documentation that demonstrates you have met the risk analysis requirement and are managing risk responsibly.

Most assessments run three to five weeks depending on organizational size and documentation readiness. We scope the timeline during a free discovery call.

Related Services

This assessment connects naturally with:

Ready to talk?

No pitch, no proposal, no commitment. A 30-minute discovery call is just a conversation.

Schedule Your Free Discovery Call