Every practice that handles electronic patient information must assess its security risks and act on what it finds. Start with our free guided assessment, add a formal report generated from your answers, or let NBT Systems run the whole engagement for you.
Built on the structure of the HHS Security Risk Assessment Tool. Your answers stay in your browser.The risk analysis is not paperwork for its own sake. It’s the foundation the rest of the HIPAA Security Rule is built on, and regulators check for it first.
The Security Rule requires an accurate and thorough assessment of risks to ePHI, with security measures to reduce them, under 45 CFR §164.308(a)(1). It applies to practices of every size.
A missing or incomplete risk analysis is one of the most common findings in HHS Office for Civil Rights investigations and settlements.
Clinicians reporting the Promoting Interoperability category must attest to conducting or reviewing a Security Risk Analysis during the performance year.
All three options use the same assessment, so you can start free and step up at any point without redoing your answers.
For practices that want to see where they stand and handle it themselves.
No account or payment required
For practices that do the legwork and want a formal, professionally formatted report.
Everything in the free assessment, plus:
Your report is generated from your answers as submitted. This option does not include a review or validation by NBT Systems; you are responsible for the accuracy of your answers. Reports and documents are drafted with AI assistance from your answers, using NBT Systems templates.
Order an NBT Systems reportFor practices that want it handled by professionals from start to finish.
Introductory price for practices up to 20 staff. Larger practices quoted.
Download a complete Security Risk Analysis report for a fictitious practice, built from answers to the same guided assessment you’ll use.
Option 2 turns your self-assessment into a complete Security Risk Analysis report without a full engagement.
Work through the guided questions at your own pace. Most small practices finish in one or two sittings.
One click saves your answers as a small file. It contains your security answers, not patient records.
Place your order and send us the file. We confirm receipt; your report is generated from the answers in your file exactly as submitted.
Within five business days, NBT Systems delivers your full Security Risk Analysis report with conceptual diagrams, then walks you through it on a 20-minute call.
Questions follow the seven areas of the HHS Security Risk Assessment Tool, each tied to the Security Rule provision it tests, plus readiness checks for HHS’s proposed Security Rule update.
| What you get | Self-assessment | + NBT Systems report | NBT Systems-guided |
|---|---|---|---|
| Price | Free | $399 | From $2,500 (introductory) |
| Who completes the assessment | You | You | NBT Systems, with your team |
| Self-generated reports | Included | Included | Included |
| Expert review of answers | Not included | Not included | Included |
| Full Security Risk Analysis report | Not included | Generated from your answers, within five business days | Included, validated |
| Architecture and data-flow diagrams | Not included | Conceptual | Validated with your team |
| Time with an NBT Systems expert | Not included | 20-minute results call | Throughout the engagement |
| Evidence review and technical validation | Not included | Not included | Included |
| Safeguards verified and rated Met | Not included | Not included | Included |
| Best for | Checking where you stand | A formal report on a budget | A defensible, professionally documented SRA |
No. Our assessment follows the structure of the HHS/ONC SRA Tool and cites the Security Rule throughout, but it is built and supported by NBT Systems and is not endorsed by HHS.
The Security Rule treats risk analysis as an ongoing process: review it regularly and update it when your systems, locations or operations change. Clinicians reporting MIPS Promoting Interoperability must conduct or review one during each performance year. Most practices assess annually.
For the free assessment, no. Your answers are stored only in your browser until you save a progress file. With Option 2, you choose to send that file to us. Please don’t include patient names or other patient information in your notes.
Yes. Download our sample Security Risk Analysis report for a fictitious practice. It shows the findings, risk register, remediation plan and figures you can expect.
Option 2 reports are drafted with AI assistance from the answers in your progress file, using NBT Systems templates, and are not reviewed or validated, so their accuracy depends on your answers. Diagrams are conceptual, based on what you describe. In the NBT Systems-guided engagement, a security professional reviews your answers, validates your safeguards and diagrams, and finalizes the report.
Option 2 turns what you report into a formal Security Risk Analysis report, generated from your answers without review. Option 3 is a full professional engagement: we interview your team, review evidence, validate technical controls and produce a formal Security Risk Analysis report. If you need documentation that holds up to an audit or investigation, Option 3 is the stronger choice.
Yes. If you move to the NBT Systems-guided engagement within 60 days of ordering your report, the full $399 is credited toward it. Your answers carry over, so nothing is wasted.
Yes. Option 3 pricing scales with practice size and complexity. Book a consultation and we’ll provide a quote.
Option 3 is delivered remotely through video interviews, screen sharing and secure document exchange, which keeps it efficient and affordable.
It can help, though no assessment guarantees a lower premium. Cyber insurers now ask detailed questions about many of the same controls the assessment covers, including multi-factor authentication, endpoint protection, tested backups, patching, email security and an incident response plan. Gaps in those controls can lead to higher premiums, coverage exclusions or a declined application. The assessment shows where you stand before you apply or renew, and an NBT Systems report or engagement gives you a prioritized plan for closing the gaps underwriters care about most. Always answer insurance applications accurately: a claim can be disputed if a control you reported wasn’t actually in place.
No assessment alone guarantees compliance. The risk analysis identifies what needs attention; compliance comes from acting on the findings and maintaining your security program over time.
Free, private, and built on the HHS framework.
