10/16/2026
Is your Security Risk Analysis current?
HIPAA requires an accurate and thorough risk analysis of electronic protected health information. It doesn't set a frequency, but HHS guidance says the process should be ongoing and revisited when things change, like new technology or a security incident.
For practices in MIPS, a security risk analysis conducted or reviewed within the performance year (Jan 1 to Dec 31) is required to earn a 2026 Promoting Interoperability score.
Need help reviewing yours? Call (775) 710-3584.
Sources: HHS; CMS Quality Payment Program (qpp.cms.gov)