Free HIPAA Risk Assessment Template (Excel)
What a HIPAA risk assessment covers
The HIPAA Security Rule organizes its safeguards into three categories: Administrative (policies, training, workforce access), Physical (facility access, workstation security, device disposal), and Technical (unique user IDs, encryption, audit logs, transmission security). A risk assessment walks through each safeguard and asks whether it's actually in place.
This template pre-fills all 28 of those safeguards — 14 Administrative, 6 Physical, and 8 Technical — so you're not starting from a blank page trying to remember which controls the Security Rule actually requires.
How the risk scoring works
For each safeguard, you mark whether it's In place, Partial, or No, then score Likelihood and Impact on a 1-5 scale for anything not fully in place. The risk score is Likelihood times Impact, and the risk level bucket calculates automatically: 15+ is High, 8-14 is Medium, and below 8 is Low.
That gives you a ranked list of gaps instead of a flat checklist — the safeguards scoring High are the ones to work on first, before Medium or Low items.
Remediation tracking and the compliance dashboard
Alongside the risk score, each row has a Remediation action, an Owner, and a Status you move from Open to In progress to Closed. Summary formulas at the top count High and Medium risks, tally safeguards marked fully in place, and calculate an overall compliance rate — how many of the 28 safeguards are Yes versus Partial or No.
It also counts open remediation items, so you have a live view of how many gaps still need action versus how many have been closed out.
Who needs this and what it doesn't replace
Small practices, clinics, and business associates who need to document a Security Rule risk analysis — required under HIPAA — but don't have budget for a $5,000+ compliance consultant are the core fit. It gives you a structured, scored starting point you can build on.
This is a planning tool for your internal risk analysis, not legal advice and not a certification. It supports a formal HIPAA compliance program; it doesn't replace one, and you should still involve counsel or a compliance specialist for anything that touches enforcement or a breach.
How to use it
- Work through the 28 pre-filled Security Rule safeguards and mark each In place, Partial, or No.
- Score Likelihood and Impact 1-5 for anything not fully in place — the risk score and level calculate automatically.
- Sort by risk level and tackle every High (15+) item first, then Medium (8-14).
- Assign a remediation action and an owner to each gap, and track it through to Closed.
Download the free Free HIPAA Risk Assessment Template (Excel)
No spam — template updates and new free templates only. Unsubscribe anytime.
Frequently asked questions
Can I use this HIPAA risk assessment template in Google Sheets?
Yes. Upload the downloaded file to Google Drive, then open it and choose File > Save as Google Sheets. The risk scores and compliance rate keep calculating.
Is this template really free?
Yes. You give an email address to download it, and then it's yours to use with no further cost.
Is this legal advice or a HIPAA certification?
No. It's a planning and documentation tool for your internal risk analysis, not legal advice and not a certification. There is no official HIPAA certification body — treat this as support for your compliance program, not a substitute for counsel.
How is the risk level calculated?
Risk score = Likelihood x Impact, both scored 1-5. A score of 15+ is High, 8-14 is Medium, and below 8 is Low.
Can I add my own safeguards or notes?
Yes. The 28 safeguards are pre-filled but editable rows — add more, rename them, or extend the remediation notes as your assessment grows.
What's the usage license?
Personal use or use within one organization. It's not meant to be resold or redistributed as a template product.