HIPAA Security Risk Analysis for NYC Medical Practices
The HIPAA Security Rule requires covered entities and their business associates to assess the risks to electronic protected health information (ePHI) and act on what they find. P-Bon Consulting is a founder-led practice in Queens Village. Wlad Pierre-Francois, Ph.D., who researches HIPAA Security Rule compliance in small practices, leads each analysis.
What the Security Rule Requires of a Practice
Three connected requirements in 45 CFR 164.308 do most of the work. They apply to every covered entity and business associate, whatever its size.
Risk analysis
An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI you hold (164.308(a)(1)(ii)(A)).
Risk management
Security measures sufficient to reduce those risks to a reasonable and appropriate level, chosen from what the analysis found (164.308(a)(1)(ii)(B)).
Periodic evaluation
A periodic technical and nontechnical evaluation, repeated when your environment or operations change in ways that affect ePHI (164.308(a)(8)). The rule sets no fixed interval.
HHS does not prescribe one methodology for the risk analysis. The approach can vary with the size, complexity, and capabilities of the organization, but it has to be thorough and documented. HHS and OCR guidance treats it as the foundation for the rest of Security Rule compliance. See the sources below.
What a Risk Analysis With P-Bon Covers
The exact scope and deliverables are set out in your written proposal after the free Risk Review. This service is technical assessment and guidance, not legal advice.
Why Small Practices Struggle, and a Rule in Transition
Most small practices have one overstretched IT person, or a physician managing IT on the side. Wlad’s research looks at why small practices struggle with Security Rule compliance and proposes a risk-based framework that takes limited staff and budget into account. Read the summary, HIPAA Security Rule Compliance in Small Medical Practices, or browse the full list on our Research & Publications page.
In January 2025 HHS proposed the most substantive revisions to the Security Rule since 2003. Among other changes, the proposal would make most addressable specifications required. As of October 22, 2026 it remains a proposal, not a final rule, so the current rule governs. A thorough, documented risk analysis is the right foundation either way.
Serving Practices Across New York City and Nassau County
We work with medical, dental, behavioral-health, and therapy practices, and with billing companies and other business associates, in Manhattan, Brooklyn, Queens, the Bronx, Staten Island, and Nassau County. Assessments are largely remote, and on-site work is available by arrangement from our Queens Village office.
New York’s SHIELD Act (General Business Law §899-bb) separately requires reasonable safeguards for private information, and the controls overlap heavily with the Security Rule. Our research on compliance convergence explains how one program can cover several regimes. We sign a Business Associate Agreement with every healthcare client before we access any system that may contain protected health information. Read how we protect your data on our trust page, or see our wider IT services for medical practices.
Wlad Pierre-Francois, Ph.D.
Founder of P-Bon Consulting, with a Ph.D. in Business Administration and an MBA in IT Management. He has published research on HIPAA Security Rule compliance in small medical practices, is an adjunct IT instructor at SUNY Rockland, and is an instructor for CompTIA Security+, Network+, and A+ courses.
Read more about Wlad → · Research & Publications → · ORCID · Google Scholar
HIPAA Security Risk Analysis: FAQ
What is a HIPAA Security Rule risk analysis?
It is a documented assessment of where electronic protected health information (ePHI) lives in your practice, the threats and vulnerabilities that could affect its confidentiality, integrity, and availability, and how likely and how serious each risk is. 45 CFR 164.308(a)(1)(ii)(A) requires covered entities and business associates to conduct one.
Does a small practice really need one?
Yes. The Security Rule applies to covered entities and business associates regardless of size, and the risk analysis is the first step HHS points to for meeting the rest of the rule.
How often should we update it?
The rule calls for periodic evaluation and for updates in response to environmental or operational changes that affect ePHI, but it sets no fixed interval. We recommend reviewing it at least once a year and whenever you change your EHR, add a location, adopt a new tool such as an AI assistant, or have a security incident.
Can we use the free HHS security risk assessment tool instead?
You can. The HIPAA Security Risk Assessment (SRA) Tool from ONC and OCR is free and aimed at small and mid-size practices. Many practices find the questions hard to answer without technical help, which is where we come in, whether you use that tool or a written report from us.
Will a risk analysis make us HIPAA compliant?
No single document does. A risk analysis is one required element of the Security Rule, and compliance also depends on your policies, training, vendor agreements, and how you act on the findings. We provide technical assessment and guidance, not legal advice or a certification, so confirm your obligations with qualified counsel.
Do you sign a Business Associate Agreement?
Yes. We sign a Business Associate Agreement with every healthcare client before we access any system that may contain protected health information.
What does it cost and how long does it take?
Scope and fee depend on the size of your practice, the number of locations and systems, and how much documentation already exists. After a free 30-minute Risk Review with Wlad, you receive a written proposal with the scope and fee so you can read it before deciding.
Do you work with practices outside Queens?
Yes. We work with practices across all five boroughs and Nassau County. Assessments are largely remote, and on-site work is available by arrangement from our Queens Village office.
Sources and Rule Text
- 45 CFR 164.308, Administrative safeguards (eCFR)
- Guidance on Risk Analysis Requirements under the HIPAA Security Rule (HHS Office for Civil Rights)
- The HIPAA Security Rule (HHS)
- HIPAA Security Risk Assessment Tool (HealthIT.gov)
- HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (Federal Register, proposed rule, January 6, 2025)
- New York General Business Law §899-bb, Data security protections (NY State Senate)
Last reviewed October 22, 2026. This page is general information about the HIPAA Security Rule, not legal advice, and completing a risk analysis does not by itself make a practice compliant.
Know Where Your Practice Stands
Book a free 30-minute Risk Review with Wlad. You will leave with a written summary of your top risks, whether or not you work with us.
Get My Free Risk Review →