What is an SRA?
Think of it like a fire inspection - but for patient data. A licensed inspector (or in this case, a structured questionnaire) walks through every corner of how your practice handles protected health information (PHI): your computers, your software, your phones, your paperwork, even the lock on your supply closet. It asks: where could patient data leak, and what are we doing to stop it?
Required by law
The HIPAA Security Rule mandates a Security Risk Assessment for every covered entity - including solo therapists and small practices.
Done annually
It's not a one-and-done form. Every year (or when your practice significantly changes) the assessment must be repeated and documented.
You don't need a consultant
With the right tool, a solo practitioner can complete a fully defensible SRA over a weekend - and know exactly what to fix next.
The Reality
You became a clinician to care for people-not to decode federal security standards alone at midnight. Yet the responsibility sits squarely on your shoulders.
The SRA is not optional
An annual Security Risk Assessment is a required HIPAA safeguard. A missing or outdated SRA is the single most common deficiency cited in OCR enforcement actions.
Penalties are real
HIPAA violations carry civil penalties that climb tier by tier-reaching into the tens of thousands per violation. For a solo practice, one finding can be devastating.
Consultants are expensive
Traditional compliance firms charge thousands and weeks of your time. You didn’t open a practice to become a project manager for someone else’s audit.
The Logic of Remediation
Map every risk, clearly.
Our guided questionnaire walks you through every HIPAA Security Rule standard administrative, physical, and technical safeguards. No jargon. No guesswork. You answer plain-language questions about your practice; we translate them into a structured, defensible risk analysis.
What is a Security Rule Evaluation?
The HIPAA Security Rule (§164.308(a)(8)) requires covered entities to periodically evaluate how well their security policies and procedures are actually working in practice - not just whether they exist on paper. This is called the Security Rule Evaluation.
If the SRA asks "where are our risks?" - the Security Rule Evaluation asks "are the safeguards we put in place still doing their job?" It's the difference between writing a fire evacuation plan and actually checking that every staff member knows it and the exits are still clear.
It should be performed at least annually - or whenever your practice makes a significant operational or technology change, like switching EHR systems, hiring new staff, or moving to a new location. Your SRA Compliance Kit includes a structured evaluation template so this step never gets skipped.
Remediate, step by step.
Every identified risk comes with a concrete, prioritized remediation action. Follow the checklist at your own pace-each step explains what to do, why it matters, and how to document it. You’re never left wondering what ‘good enough’ looks like.
Stay audit-ready, always.
Compliance isn't a single event. We give you the policies, procedures, and annual review rhythm that keep your practice protected year after year. Update your assessment, log your reviews, and walk into any audit with confidence.
What are policies & procedures?
Think of policies as your practice's official rules - written statements that say "this is how we handle patient data." For example: "All staff must use a password manager" or "Devices storing patient records must be encrypted."
Procedures are the step-by-step instructions that back each policy up - the "here's exactly how we do it" document. If a policy says "encrypt all devices," the procedure explains which encryption tool to use and how to turn it on.
HIPAA requires you to have both in writing. If you're ever audited or investigated after a breach, these documents are the first thing a federal investigator asks for. Without them, even a well-run practice looks non-compliant. With them - and a signature proving you reviewed them - you're protected.
Whether you are an independent therapist, doctor, dentist, chiropractor, or run a small clinic, HIPAA compliance is a federal requirement. Our SRA Compliance Kit provides a structured, stress-free path to align your practice, backed by real human support when you need it.
Start by filling out our simple 15-minute intake questionnaire. Within 48 hours, a compliance officer personally reviews your practice details and delivers your customized Security Risk Assessment (SRA).
Get customized policies and procedures tailored to your practice. Simply review and adopt. No complex drafting or compliance jargon required.
Most importantly, we don't just highlight gaps; we provide prioritized, plain-English instructions showing you exactly how to resolve each security issue.
If you get stuck while remediating, your kit includes 1 hour of live screen-share support. Need more time? Easily add extra hours using our 1-on-1 package.
Cyber Insurance + Your SRA
Every year, your cyber insurance carrier sends a questionnaire full of technical security questions. Most practice managers cannot answer them confidently. Our SRA package gives you documented, verified answers to the exact questions carriers are asking.
Insurance Application Asks
"When was your last Security Risk Assessment completed?"
Your SRA Delivers
A completed, dated SRA with full Administrative, Physical, and Technical Safeguards analysis, Threat and Vulnerability matrix, and Risk Determination report.
Insurance Application Asks
"Do you have written security policies and procedures?"
Your SRA Delivers
Customized policies and procedures manual covering administrative, physical, and technical safeguards, ready to adopt and sign.
Insurance Application Asks
"Is multi-factor authentication enforced on all systems?"
Your SRA Delivers
Your remediation plan identifies where MFA is missing and walks you through enabling it on every system, with documentation that it was completed.
Insurance Application Asks
"Are all devices encrypted at rest?"
Your SRA Delivers
Step-by-step instructions for enabling BitLocker or FileVault on every device, plus verification and documentation that encryption is active.
Insurance Application Asks
"Have all employees completed security awareness training?"
Your SRA Delivers
Interactive training modules with tracked completion, quiz scores, and downloadable certificates of completion for every staff member.
Insurance Application Asks
"Do you have a documented incident response plan?"
Your SRA Delivers
Your policies package includes a complete incident response plan customized to your practice type, ready to present to your carrier.
Stop guessing on your insurance application. Complete your SRA and you will have a documented, honest answer to every question your carrier asks.
Choose Your Path
Both include the complete toolkit, remediation, policies, and email support. The difference is how much hands-on guidance you want at the finish line.
Based in Monroe County, Bloomington HIPAA Systems proudly provides dedicated HIPAA compliance auditing, Security Risk Assessments (SRA), and custom hardware/software remediation solutions to medical clinics, dental offices, and behavioral health providers throughout Bloomington, Ellettsville, Bedford, Martinsville, and Greater South-Central Indiana.