Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters

What is a HIPAA risk assessment?

The objective of a HIPAA risk assessment is to identify potential risks and vulnerabilities to the confidentiality, availability, and integrity of all protected health information (PHI) that an organization creates, receives, maintains, or transmits. 


The U.S. Department of Health & Human Services (HHS) does not specify a particular risk analysis methodology because covered entities and business associates vary in size, complexity, and capabilities. To meet the objective of a HIPAA risk assessment, HHS suggests an organization should: 


  • Identify where PHI is stored, received, maintained, or transmitted
  • Identify and document potential threats and vulnerabilities
  • Assess current security measures used to safeguard PHI
  • Assess the proper usage of existing security measures
  • Determine the likelihood of a reasonably anticipated threat
  • Determine the potential impact of a breach of PHI
  • Assign risk levels for vulnerability and impact combinations
  • Document the assessment and take action where necessary


HIPAA risk assessments are not a one-time event; they require periodic reviews when introducing new technology or implementing new work practices.

Additional resources you might like:

Compliance
Event
How to demonstrate secure AI practices with ISO 42001

Join Vanta and A-LIGN for a Coffee and Compliance session on ISO 42001 —what it is, what types of organizations need it, and how it works.

Product updates
Blog
New in Vanta | April 2024

Vanta recently rolled out new capabilities, including the ISO 42001 framework, table customization, and more.

Security
Guide
Growing pains: How to update and automate outdated security processes

Has your business outgrown its security processes? Learn how to update them in this guide.

Additional resources you might like:

Compliance
Event
How to demonstrate secure AI practices with ISO 42001

Join Vanta and A-LIGN for a Coffee and Compliance session on ISO 42001 —what it is, what types of organizations need it, and how it works.

Product updates
Blog
New in Vanta | April 2024

Vanta recently rolled out new capabilities, including the ISO 42001 framework, table customization, and more.

Security
Guide
Growing pains: How to update and automate outdated security processes

Has your business outgrown its security processes? Learn how to update them in this guide.

Company news
Blog
Celebrating 1,000 reviews on G2 and our first-ever Customer Week

With over 1,000 reviews, Vanta has been named the #1 Leader in G2’s Grid® Report for Security Compliance | Spring 2024.

NIST
Event
Simplifying the NIST AI Risk Management Framework

Curious about managing risk in an AI-driven world? Join our live Q&A with security and compliance experts at Vanta and the Cognisys Group to explore the latest NIST AI Risk Management Framework (RMF) and its role in embedding trustworthiness into your company's AI usage.

Compliance
Event
Automating your existing compliance program

With Vanta, you get enough flexibility to choose between a wealth of pre-built content and the ability to customize and configure the product to match your program’s needs. Curious to see this in action?

Compliance
Event
How to automate ISO 27001 & SOC 2 compliance

Join Vanta’s 45-minute live product demo on 25 April at 11 am BST. Two of our team members will walk you through the platform and answer questions throughout the session.

Compliance
Event
ISO 27001 & SOC 2 compliance automation

Join Vanta’s 45-minute live product demo on 10th April at 1pm AEST. Two of our team members will walk you through the platform and answer questions throughout the session.

Compliance
Event
Combating threats through a continuous compliance

In the world of cloud infrastructure, security teams frequently find themselves bouncing between tools to track alignment to compliance standards. What’s more, they must often contend with a lack of visibility into risk and potential threats.

Get compliant and
build trust, fast.

Two wind turbines on a white background.
Get compliant and build trust,
fast.
Get started