HIPAA Privacy Risk Assessment



With health records of high value to patients and the dark web alike, Protected Health Information (PHI) is at risk for everything from unintentional employee mishandling to cyberattacks. Our HIPAA Privacy Risk Assessment thoroughly assesses your privacy practices to help you comply with HIPAA privacy rules, while elevating your overall security posture.


Our HIPAA Privacy Risk Assessment is a comprehensive evaluation of your organization's policies and procedures in processing, storing, and transmitting Protected Health Information (PHI). Employing the HIPAA Privacy Rule, 45 CFR Part 160 and Subparts A and E of Part 164, we will conduct a thorough and accurate assessment of the potential risks and vulnerabilities to the confidentiality, availability, and integrity of both physical and electronic PHI across your healthcare organization.With our risk assessment results, our expert team will reveal potential problem areas with PHI and provide specific and actionable recommendations for quick remediation to help you improve privacy practices and elevate your overall security posture. To complement your HIPAA Privacy Risk Assessment, we recommend BAI's HIPAA Security Risk Assessment.


Our expert team will conduct a comprehensive risk assessment of your organization's HIPAA compliance with PHI safeguards, including:

    • Policies and practices for administrative and technical safeguards of all forms of PHI
    • Privacy practices & training documentation
    • Compliant handling policies, procedures, and log
    • Sanction and disciplinary policies and procedures
    • Gap assessment of over a dozen HIPAA Privacy standards (see Q & A below for details)


Conducting a HIPAA audit on every aspect of a healthcare organization’s operations can be complex. This is particularly true for smaller medical practices with limited resources, as well as larger healthcare networks with numerous locations and personnel.

This is where our deep experience working with hospitals, clinics, campus healthcare, satellite offices, and more, matters to be able to comprehensively audit your environment without creating a burden for your team.

BAI's Secure Portal makes assessment, compliance, and tracking easy for your team. Just log in, upload your relevant documents, and track progress — we’ll take care of the rest!



Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, healthcare organizations are required to implement appropriate safeguards to protect the privacy of Protected Health Information (PHI) and to set limits and conditions on the uses and disclosures that may be made of such information without an individual’s authorization. The Rule also gives individuals rights over their PHI, including rights to examine and obtain a copy of their health records, to direct a covered entity to transmit to a third party an electronic copy of their PHI in an electronic health record, and to request corrections.

BAI Security’s HIPAA Privacy Risk Assessment is conducted in accordance with 45 CFR Part 160 and Subparts A and E of Part 164 of the HIPAA Privacy Rule.

BAI Security’s HIPAA Privacy Assessment addresses:

  • Privacy Practices documentation
  • Privacy Practices training documentation
  • Policies and procedures in place over administrative, technical, and physical safeguards covering all forms of PHI
  • Complaint handling policies and procedures
  • Population of complaints over privacy practices made with the last year (complaint log)
  • Sanction and disciplinary policies and procedures






HIPAA Privacy Rule safeguards covered in BAI Security’s assessment include:

  • 164.502 Uses and disclosures of protected health information: General rules
  • 164.504 Uses and disclosures: Organizational requirements
  • 164.506 Uses and disclosures to carry out treatment, payment, or health care operations
  • 164.508 Uses and disclosures for which an authorization is required
  • 164.510 Uses and disclosures requiring an opportunity for the individual to agree or to object
  • 164.512 Uses and disclosures for which an authorization or opportunity to agree or object is not required
  • 164.514 Other requirements relating to uses and disclosures of protected health information
  • 164.520 Notice of privacy practices for protected health information
  • 164.522 Rights to request privacy protection for protected health information
  • 164.524 Access of individuals to protected health information
  • 164.526 Amendment of protected health information
  • 164.528 Accounting of disclosures of protected health information
  • 164.530 Administrative requirement