Every HIPAA-covered practice eventually runs into the same fork in the road: use the free federal Security Risk Assessment (SRA) Tool, or pay a vendor to do a professional Security Risk Assessment. Both are marketed as ways to satisfy the HIPAA Security Rule's risk-assessment requirement, and both produce a document you can hand an auditor. But "satisfies the requirement on paper" and "actually protects the practice" are not the same test, and conflating them is one of the more expensive mistakes a small practice can make.
What the Free SRA Tool Actually Is
The Security Risk Assessment Tool is a free desktop application published jointly by the HHS Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC). It walks a practice through a structured set of multiple-choice questions covering administrative, physical, and technical safeguards for electronic protected health information (ePHI), and it produces a remediation report a practice can use to track open vulnerabilities. There is also an Excel-based version for practices that do not run Windows or want more flexibility in how they work through the questionnaire. It was built specifically with small and medium-sized providers in mind, and for a solo or small practice with a simple technology footprint, it is a legitimate, no-cost starting point.
Where the Free Tool Falls Short
The federal government is direct about the tool's limits: using it does not guarantee HIPAA compliance, and it does not guarantee compliance with other federal, state, or local regulations that may also apply to a practice. It is explicitly scoped for small and medium-sized organizations, meaning it may not adequately capture the environment of a multi-location practice, one running several integrated systems (EHR, billing platform, patient portal, remote monitoring devices), or one with a more complex vendor and business-associate footprint. The tool also works largely as a checklist: it is very good at prompting the right questions, but it does not interpret the practice's specific answers, weigh which gaps matter most given the practice's actual workflows, or design a remediation plan beyond the generic report it generates.
What a Professional Assessment Adds
A vendor-performed Security Risk Assessment starts from the same HIPAA Security Rule requirements but goes further in a few specific ways:
- Environment-specific scope. A professional reviews the practice's actual systems, network configuration, and workflows rather than answering generic questions in the abstract.
- Expert interpretation. Findings are prioritized and translated into a remediation plan tailored to the practice, not a generic checklist output.
- Audit defensibility. If OCR or a payer program ever asks for evidence of the assessment, a professionally documented SRA with a named assessor and methodology is generally easier to defend than a self-administered questionnaire.
- Ongoing risk management, not just a report. A vendor engagement more naturally extends into tracking remediation over time, which matters given recent changes described below.
Why "Who Needs One" Has Gotten More Specific
The HIPAA Security Rule requires covered entities and business associates to conduct a risk assessment periodically — the rule does not pin an exact interval, but annual assessments, or a fresh assessment after any material change to systems or workflows, is the generally recommended cadence. Beyond the baseline HIPAA requirement, specific federal programs make an SRA a hard prerequisite for payment: the Medicare Promoting Interoperability Program requires eligible hospitals and Critical Access Hospitals to attest that a Security Risk Analysis has been completed, and the Merit-based Incentive Payment System (MIPS) Promoting Interoperability performance category carries a parallel requirement for eligible clinicians. Recent Quality Payment Program rulemaking has also moved the bar from simply completing an SRA to attesting that the practice has taken specific action to manage the risks the assessment identified — which means a stale or generic questionnaire from a prior year is less likely to satisfy an attestation than it used to.
Free Tool or Vendor — A Practical Comparison
| Factor | Free HHS/ONC SRA Tool | Professional (Vendor) SRA |
|---|---|---|
| Cost | $0 | Varies by practice size and scope |
| Best fit | Solo/small practice, simple IT footprint | Multi-location, multiple integrated systems, or attestation-driven programs |
| Output | Generic remediation report | Tailored findings and remediation roadmap |
| Audit/attestation defensibility | Self-administered, generic methodology | Named assessor, documented methodology |
| Ongoing risk management | Not built in | Can be structured as a continuing engagement |
The Bottom Line
The free SRA Tool is a real, legitimate resource, not a corner-cutting shortcut — but it was designed as a starting point for the simplest practice environments, not a universal substitute for a tailored assessment. Once a practice is attesting for a Medicare or MIPS Promoting Interoperability measure, running more than one connected system, or simply wants a defensible answer if OCR ever asks, matching with a qualified Security Risk Assessment vendor who understands healthcare workflows is the more durable choice. Practices that are unsure which situation they're in are usually better served by getting matched with a vendor who can make that call after a short scoping conversation, rather than guessing and re-doing the work later.