Risk Assessment otherwise called Risk Analysis is a Required part of the HIPAA Security Rule 164.308(a)(1). To ensure compliance, health care providers, medical offices (Covered Entity), business associates, or any other entity that receives, transforms, or stores Electronic Protected Health Records (ePHI)  are required to perform a Risk Analysis at least once a year or