Security Risk Assessment Checklist for Senior-Focused Primary Care Centers

A security risk assessment helps you identify what could harm patients, staff, the facility, or electronic protected health information (ePHI)—and decide what to address first. For a senior-focused primary care center, review both information security and day-to-day hazards that may affect patients with different mobility, sensory, or support needs.

Use this checklist to guide a documented review, not as proof of HIPAA compliance by itself. The HIPAA Security Rule applies to covered entities and business associates that handle ePHI; its required risk analysis focuses on the confidentiality, integrity, and availability of that information. See the current HIPAA administrative safeguards regulation and HHS guidance on risk analysis.

How to identify and prioritize security risks

Begin by defining the assessment’s scope: the clinic’s locations, services, workforce, systems, and the information it creates, receives, maintains, or transmits. Include paper-to-digital workflows, mobile devices, remote access, backups, and systems or services managed by outside vendors.

Gather evidence through a facility walkthrough, staff interviews, review of policies and system inventories, and examination of prior incidents, complaints, outages, and maintenance records. HHS guidance calls for identifying ePHI locations, reasonably anticipated threats and vulnerabilities, and the safeguards already in place.

• Identify threats: Consider unauthorized entry, theft, medication diversion, workplace violence, fire, severe weather, power loss, water damage, malware, accidental disclosure, and service outages.
• Identify vulnerabilities: Look for unescorted visitors in restricted areas, unattended workstations, unclear emergency procedures, shared accounts, exposed cables, blocked routes, or gaps in vendor oversight.
• Record existing safeguards: Note what is working, where it is applied, who is responsible, and how you know it is effective.
• Rate each risk: Use a consistent method to estimate likelihood and potential impact. Consider consequences for patient safety and care continuity as well as ePHI confidentiality, integrity, and availability.
• Assign follow-up: Record the risk, priority, planned control, responsible owner, target date, and any decision to accept or monitor the remaining risk.

A simple likelihood-and-impact matrix can help teams compare findings, but no single scoring method guarantees HIPAA compliance. HHS explains that risk analysis should reflect the organization’s environment and that the Security Rule does not prescribe one assessment method. Prioritize immediate threats to life safety or essential care, then address high-impact security risks and overdue safeguards.

What to include in a HIPAA security risk assessment

For a HIPAA-regulated clinic, assess how its HIPAA administrative safeguards, HIPAA physical safeguards, and HIPAA technical safeguards protect ePHI. The assessment should connect identified risks to current controls and document decisions about how risks will be managed. The administrative safeguards regulation requires risk analysis and risk management as part of the Security Rule’s security management process.

• Administrative safeguards: Review assigned security responsibilities, workforce access and termination procedures, security awareness, incident response, contingency planning, and business associate arrangements where applicable.
• Physical safeguards: Review facility access, visitor procedures, workstation placement and security, and how devices or media containing ePHI are handled, moved, reused, and disposed of.
• Technical safeguards: Review access controls, unique user identification, audit controls, authentication, data integrity protections, and transmission security.
• Risk documentation: Record the scope, information sources, threats and vulnerabilities considered, existing controls, likelihood and impact judgments, findings, and follow-up decisions.

Some HIPAA implementation specifications are labeled “addressable.” That does not mean you can ignore them: assess whether the specification is reasonable and appropriate for your circumstances, and document your decision and any appropriate alternative measure. See HHS’s summary of the HIPAA Security Rule.

Keep the assessment grounded in the clinic’s actual operations. A checklist can help structure the review, but it does not replace evaluating the risks to your own systems, facility, workforce, and patients.

How to assess facility access and physical safeguards

Walk the clinic from the parking area and entrance through reception, exam rooms, medication storage, staff areas, and any room containing network equipment or records. Consider both unauthorized access and whether staff can reach systems and equipment needed for care during an emergency.

HIPAA’s physical safeguards include facility access controls, workstation use and security, and device and media controls. The regulation also addresses facility security planning and access validation, including visitor control; see 45 CFR § 164.310.

• Check whether restricted rooms, records, supplies, and equipment are protected from unauthorized access, tampering, or theft.
• Review how staff identify visitors and contractors, determine where they may go, and supervise access to nonpublic areas.
• Confirm that keys, badges, alarm codes, and access lists are managed when roles change, credentials are lost, or a worker leaves.
• Inspect workstations for screens or paperwork visible to people who do not need access, and check that devices are secured when unattended.
• Review how the clinic tracks portable devices and media that contain ePHI, and how it handles secure disposal or reuse.
• Check doors, lighting, flooring, signage, and circulation routes for hazards that could impede access or create falls, especially for patients who use mobility aids.

For patient-facing areas, consider whether the check-in process, conversations, printed schedules, and waiting-room layout could expose private information to people who do not need it. These are practical review prompts; assess them in light of your clinic’s workflows and applicable privacy obligations.

How to evaluate patient and staff safety risks

Review safety conditions during normal operations, opening and closing, busy periods, and emergencies. Include staff, patients, visitors, contractors, and people who may need additional time or assistance to move through the facility or receive instructions.

• Inspect entrances, ramps, floors, restrooms, exam rooms, and walkways for spills, clutter, uneven surfaces, loose mats, poor lighting, and cords crossing paths.
• Check that emergency exits and routes remain clear and that staff know how to assist patients who may need help evacuating.
• Review processes for responding to a fall, medical emergency, threatening behavior, or a person who becomes separated from their support person.
• Assess whether staff can summon help, report hazards, and follow clear procedures for de-escalation and workplace violence concerns.
• Review how hazards are logged, escalated, corrected, and communicated to staff.

OSHA identifies wet floors, spills, clutter, obstructed aisles, and inadequate lighting among healthcare slip, trip, and fall hazards. Its guidance also highlights the importance of considering workplace violence risks. Consult OSHA’s healthcare guidance on slips, trips, and falls and OSHA’s workplace violence overview when developing your facility review.

How to review medication and equipment security

Inventory medications, clinical equipment, portable devices, and supplies that could be lost, misused, tampered with, or unavailable when needed. For each item or category, document who can access it, where it is stored, how problems are reported, and who is responsible for follow-up.

• Check that medications are stored according to applicable requirements and clinic policy, with access limited to authorized personnel.
• Review inventory, handling, reconciliation, expiration checks, and discrepancy reporting procedures.
• Inspect storage and monitoring arrangements for medicines that have specific environmental requirements, following applicable product instructions and clinic protocols.
• Track equipment assigned to staff or rooms, and review how loss, damage, maintenance needs, and secure disposal are reported.
• Identify connected medical or office devices that store or transmit ePHI, and include them in the information-system inventory.

If the clinic is a DEA registrant handling controlled substances, verify the storage controls that apply to its registration and setting. For example, 21 CFR § 1301.75 specifies physical security controls for practitioners, including locked, substantially constructed cabinets for certain controlled substances.

What to assess in cybersecurity and vendor access

Map the systems and connections that support clinical and administrative work, including the electronic health record, scheduling, billing, email, imaging, laboratory services, cloud storage, Wi-Fi, backup services, and remote support. Identify where ePHI travels and which people, devices, software, and vendors can access it.

• Identity and access management: Review how accounts are created, approved, changed, and removed. Check whether users have access appropriate to their roles and whether shared accounts or inactive accounts create avoidable exposure.
• Authentication and review: Confirm that user activity can be attributed to individual accounts and that system activity records are reviewed for unusual access. HIPAA requires unique user identification and audit controls for systems containing or using ePHI; see 45 CFR § 164.312.
• Network segmentation: Consider whether separating guest Wi-Fi, office systems, and clinical or device networks would reduce the impact of a compromised account or device. Treat segmentation as a risk-management option to evaluate for your environment, not as a standalone HIPAA requirement.
• Devices and data: Review safeguards for laptops, tablets, phones, removable media, email, and remote connections that may store or transmit ePHI. Check the clinic’s processes for updates, backups, loss reporting, and secure disposal.
• Vendor access: List vendors with access to clinic systems or ePHI, confirm that access is approved and limited to what is needed, and review how temporary access is removed after work is complete.
• Business associate arrangements: Determine whether a vendor is a business associate and, when the HIPAA rules require it, ensure the appropriate written agreement is in place. HHS explains the business associate agreement requirement and related expectations in its guidance on cloud service providers and business associates.

Test the practical response as well as the technical controls: can staff report a suspected phishing message, reach support during an outage, and follow downtime procedures without creating unnecessary access to ePHI? Include the results and any corrective actions in the assessment record.

When to reassess during emergencies or construction

HIPAA requires periodic evaluation, but it does not set one universal interval for every clinic’s risk analysis. HHS says the appropriate frequency depends on the organization and its environment; it also recommends reviewing risks as operations or technology change and after security incidents. See HHS guidance on ongoing risk analysis and updates.

Reassess when a significant event or change could affect safety, care continuity, facility access, or ePHI—for example, a security incident, new system, vendor change, relocation, major staffing change, extended outage, or severe weather event. HIPAA contingency planning includes procedures for data backup, disaster recovery, and emergency-mode operations; see the administrative safeguards regulation.

Before construction, renovation, demolition, or repair, conduct a preconstruction risk assessment appropriate to the project. Review temporary entry routes, barriers, contractor badges and escorts, relocated workstations or records, equipment access, and how staff and patients will avoid the work area.

Construction can also create dust and moisture concerns in healthcare settings. CDC guidance recommends an infection-control risk assessment before construction, renovation, repair, or demolition to identify possible exposures and determine containment needs. See the CDC guidance on construction and infection-control risk assessment.

Keep the assessment useful by documenting the scope, key findings, owners, priorities, and follow-up dates. A consistent review of facility safety, access, medications, systems, vendors, and emergency readiness helps you focus resources on the risks most likely to disrupt care or cause harm.

FAQs

How often should a senior-focused primary care center complete a security risk assessment?

HIPAA requires periodic evaluation but does not prescribe one universal schedule for every clinic’s risk analysis. Set a review cadence that reflects your environment, and revisit the assessment when significant operational, technology, or security changes occur or after an incident. HHS discusses this flexible, ongoing approach in its risk analysis guidance.

What should a HIPAA security risk assessment cover at a primary care center?

For a HIPAA-regulated clinic, assess risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI. Review relevant administrative, physical, and technical safeguards, including workforce access, facility controls, devices, systems, vendors, incident response, and contingency planning. Document the assessment and how identified risks will be managed.

When is a preconstruction risk assessment needed?

Plan a project-specific assessment before construction, renovation, demolition, or repair that could affect patient areas, access routes, facility security, or healthcare operations. CDC recommends an infection-control risk assessment before healthcare construction and related activities to identify potential exposures and containment needs. The scope should reflect the work and the patients and services that could be affected.

How should a clinic prioritize risks identified in its assessment?

Compare each risk using a consistent method that considers both likelihood and potential impact. Address immediate threats to life safety and care continuity first, then prioritize significant ePHI risks and weaknesses in existing safeguards. Assign an owner and target date to each action, and document decisions about remediation, monitoring, or accepting remaining risk.