Call Vector Medical Billing
+1 (929) 539-7737
SRASecurity Rule
50States
HIPAA Security Risk Analysis
A Security Rule risk analysis looks at how your practice creates, receives, maintains, and transmits electronic protected health information — then documents risks and vulnerabilities. Vector Medical Billing scopes that work as a separate engagement from Jamaica, NY, for practices in all 50 states. HHS does not certify billing companies.
Separate engagement
What a HIPAA security risk analysis is
An accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI your organization holds — required under the HIPAA Security Rule (45 CFR 164.308).
HHS OCR guidance treats risk analysis as the foundation for Security Rule compliance. The Rule does not prescribe one software tool; the methodology must fit the size and complexity of the practice and still cover all ePHI.
On Vector’s services list this is a separate engagement for your environment — not the same thing as signing a Business Associate Agreement for billing, and not a claim that anyone is “HIPAA certified.”
Risk analysis vs risk management vs a BAA
Three different obligations. Mixing them leaves gaps on paper and in the clinic.
Risk analysis
Identify where ePHI lives, what threatens it, how vulnerable systems are, and how severe a failure would be. Document the findings. That is this engagement’s core deliverable.
Risk management
Implement measures that reduce identified risks to a reasonable and appropriate level. Analysis finds the gaps; management closes them — often as a follow-on plan after the SRA.
Business Associate Agreement
A BAA covers how Vector Medical Billing handles PHI for billing. Every client gets one. It does not replace a risk analysis of the practice’s own EHR, network, devices, and vendors.
What the analysis has to cover
All ePHI the practice creates, receives, maintains, or transmits — not just the EHR logo on the home screen.
Confidentiality
Who can see ePHI — access controls, workforce roles, remote access, and vendor pathways that should not be wider than the job requires.
Integrity
Whether ePHI can be altered improperly — audit logs, change controls, and backup integrity so clinical and billing records stay trustworthy.
Availability
Whether ePHI is usable when needed — downtime, ransomware readiness, restore testing, and contingency planning for systems that hold patient data.
Safeguard areas the review walks through
The Security Rule groups controls as administrative, physical, and technical. Risk analysis informs all three.
Administrative
Policies, assigned security responsibility, workforce training, sanction policy, vendor / BA oversight, and contingency planning — documented, not just “we know the password.”
Physical
Facility access, workstation placement, device and media controls — including laptops, USB drives, and paper workflows that feed electronic systems.
Technical
Access control, audit controls, integrity controls, authentication, and transmission security for ePHI in motion and at rest.
What technical testing is — and is not — in scope
So the quote matches the work. Default SRA engagement is assessment and documentation, not offensive security.
Included by default
- Interviews with the security official and key workforce who handle ePHI
- ePHI asset and vendor inventory walkthrough
- Review of existing policies, BAAs, and access / backup practices you can document
- Configuration and control discussion (how systems are set up — not exploiting them)
- Written risk ratings and recommended risk-management next steps
Not included unless quoted separately
- Penetration testing or red-team exercises against your network or EHR
- Automated vulnerability scanning / continuous monitoring platforms
- Source-code review of custom software
- Forensic investigation after a breach or ransomware event
- Remediation build-out (new firewalls, MFA rollout, policy drafting retained as legal counsel work)
If you need pen testing or a full remediation project, say so when you inquire — that is a different scope and fee from the Security Rule risk analysis report.
How Vector Medical Billing runs an SRA engagement
Inventory first. Then threats and gaps. Then a written report the practice can act on.
1
Scope ePHI
Map systems, locations, and vendors that create, receive, maintain, or transmit ePHI.
2
Threats & gaps
Identify human, natural, and environmental threats and current safeguard weaknesses.
3
Rate risk
Document likelihood and impact so findings are prioritized, not a flat punch list.
4
Deliver report
Written analysis with findings and recommended next steps for risk management.
Sample report — table of contents
Illustrative outline of what you receive. Exact section titles may adjust to practice size; this is not a client report and not a certification.
1–3 · Setup
Executive summary · Scope, methodology, and assumptions · Organization and ePHI environment overview
4–6 · Inventory
ePHI asset inventory · Information flows and vendors / business associates · Current administrative, physical, and technical safeguards noted
7–9 · Findings
Threat and vulnerability analysis · Risk register (likelihood × impact) · Prioritized findings with recommended risk-management actions
10 · Next steps
Remediation roadmap owned by the practice · Suggested review / update cadence when systems or locations change
Appendices
Interview / evidence log · Asset and vendor tables · References to HHS Security Rule guidance used in the method
Example finding line
Reception workstation without enforced auto-lock — rated in the register with a practice-owned fix (privacy screen + timeout policy acknowledgment).
We do not publish a Vector “pass rate” or OCR outcome percentage. The deliverable is this documented analysis for your environment.
Official HHS guidance and assessment tools
Regulatory claims on this page point to public OCR / ONC materials — not a Vector invention.
OCR risk analysis guidance
HHS Guidance on Risk Analysis — what “accurate and thorough” means for ePHI.
Security Rule summary
HHS Security Rule overview and the regulatory text at 45 CFR Part 164 Subpart C.
ONC / OCR SRA Tool
Free Security Risk Assessment Tool from ONC and OCR for small and medium practices. Using the tool does not equal compliance by itself — and Vector’s engagement is not limited to clicking through that wizard.
What this engagement is not
Clear boundaries so the quote matches the work.
Not “HIPAA certification”
HHS does not certify billing companies or practices. Anyone selling a “HIPAA certified” badge is using marketing language the Rule does not create.
Not monthly billing
Day-to-day RCM is medical billing. The SRA is a separate project for the practice’s Security Rule obligations.
Not MIPS reporting
Quality Payment Program measure submission is MIPS / QPP reporting. Security risk analysis is a different regulatory track.
How this engagement is scoped
Separate from the monthly billing percentage. Quote matches locations, systems, and vendors.
How it is priced
Quote depends on number of locations, EHR and ancillary systems, remote workforce, and how many business associates touch ePHI. We do not invent an OCR “pass guarantee” or a fixed compliance score on this page.
Email jack@vectormb.com with “HIPAA SRA proposal” plus your site count and EHR name for a written fee.
What we need to start
Organization chart for security responsibility, system / vendor list, existing policies if any, network diagram if available, and a practice contact who can walk through how ePHI actually moves day to day.
Ready for a HIPAA SRA proposal?
Send: (1) number of locations, (2) EHR and other systems that hold ePHI, (3) whether you need assessment-only or also want pen testing quoted separately. We reply with scope against the report outline above and a written fee — no OCR outcome guarantee.
SRA
Security Rule
ePHI
CIA Focus
Separate
Engagement
50
US States
HIPAA risk analysis questions
Straight answers tied to the sections above.
Is Vector Medical Billing HIPAA certified?
No organization is. HHS does not certify billing companies. Vector uses HIPAA-compliant billing workflows, signs a BAA with every client, and can separately scope a Security Rule risk analysis for your practice environment.
Does a BAA replace a risk analysis?
No. A BAA governs how a business associate handles PHI. The Security Rule still requires the covered entity (and BAs for their own ePHI) to conduct an accurate and thorough risk analysis of their systems.
Is the SRA included in monthly billing?
No by default. It is a separate engagement unless your written contract explicitly includes it.
How often should a risk analysis be updated?
HHS expects documentation to be maintained and updated as the environment changes — new systems, locations, vendors, or major incidents. Periodic review is part of Security Rule practice, not a one-time binder on a shelf.
Do you guarantee we will pass an OCR audit?
No. We deliver a documented risk analysis and recommended next steps. OCR outcomes depend on facts, remediation, and the investigation — not a marketing guarantee.
Is this legal advice?
No. Vector supports operational Security Rule risk analysis documentation. Counsel should review edge cases and formal compliance positions.