Short answer: yes, in practice. HIPAA requires every dental practice that is a covered entity to complete an accurate and thorough security risk analysis and to keep it current. The rule does not set a fixed calendar, but reviewing it at least once a year, and after any major change, is the standard OCR expects to see.
01
The HIPAA Security Rule requires a risk analysis of all electronic protected health information you create, receive, maintain or transmit, plus ongoing risk management to reduce the risks you find. It also requires periodic review of your security measures.
"Periodic" is not defined, which is why most practices and auditors treat a yearly review as the baseline.
02
After a breach, the first document OCR usually asks for is your risk analysis. An outdated one is treated much like having none.
FAQ
People use the terms interchangeably. The Security Rule calls it a risk analysis: identifying where patient data lives, the threats to it, how likely and serious they are, and what you will do about them.
You can, and HHS offers a free Security Risk Assessment Tool. Many practices use an outside analyst because the result has to be accurate and thorough enough to stand up in an investigation.
Missing risk analyses are among the most common findings in OCR settlements. Start now, document it and follow it with a remediation plan.
Sources: HHS: Guidance on Risk Analysis · HHS Security Risk Assessment Tool. This page is general information as of November 2026, not legal advice.
Take the free HIPAA risk assessment, or have our analysts do a full one for you.
