Closing Security Gaps Before Year-End
Three Priorities for Your Practice’s 2026 SRA
If your security risk analysis is still on the to-do list, November is the time to give it an owner and a date.
You may have asked about it months ago. Someone thought IT was handling it. IT thought the compliance consultant had it. Meanwhile, your practice added a clinician, replaced several computers, and started using another patient communication platform.
Now year-end is approaching, and nobody can locate a completed assessment.
If that sounds familiar, start by finding out what actually happened. Your practice may need a new analysis, a documented review of an existing one, or help finishing work already underway.
I would approach this in three steps: confirm the status, establish the scope, and assign responsibility for the assessment and follow-through. That gives your team a workable plan before December becomes a scheduling exercise nobody enjoys.
First, Understand the 2026 MIPS SRA Timing
For practices reporting the MIPS Promoting Interoperability category, CMS’s published 2026 specification requires conducting or reviewing a security risk analysis during the performance-year calendar year. The scope must cover the full selected performance period, although the analysis or review can occur outside that period. CMS also requires security risk management activities (cms.gov).
That makes November a useful time to act. It does not, by itself, make a November appointment sufficient.
Your team needs time to provide information, answer questions, review findings, and address identified risks. A signed agreement with an assessor shows you scheduled the work. It does not establish that the work occurred.
Also, keep the obligations straight: the MIPS calendar-year requirement is separate from HIPAA’s ongoing security responsibilities. HIPAA requires organizations to review and modify safeguards as needed and update their documentation. A reporting deadline should not become the practice’s only reason to examine security. HHS.gov
Step 1: Confirm Whether a Documented 2026 Analysis or Review Exists
Before commissioning another assessment, ask for the current evidence.
Send one specific request to your security lead, IT provider, compliance contact, and reporting coordinator:
“Please identify our most recent security risk analysis, any review completed during 2026, and the person responsible for follow-up.”
Ask them to provide the documents through an appropriate secure channel. A verbal “yes, we did that” leaves too much unexplained.
Look for the assessment date, organization and locations covered, systems examined, findings, and associated risk management work. Establish whether the document reflects the practice you operate today.
An older analysis may provide a useful foundation for a current review. It does not establish that someone performed that review this year.
Check What the Document Actually Covers
Practice managers receive plenty of documents bearing the words “HIPAA,” “security,” or “assessment.” Those labels do not make the documents interchangeable.
An IT service report, staff training certificate, vulnerability scan, or EHR vendor questionnaire may contribute evidence. Ask the reviewer how each supports the broader analysis.
For example, a technical scan may identify a software weakness. It may tell you little about whether former employees retain access or whether staff follow downtime procedures.
Your first deliverable should be a clear status statement:
Completed: Evidence is available for review.
In progress: Remaining work and responsible people are identified.
Not completed: Scope and scheduling need immediate attention.
Treat these as internal tracking categories, not compliance conclusions.
Ask What Changed Since the Last Review
Even if someone produces a current report, compare its scope with recent changes.
Did your practice open another location? Change its EHR? Introduce remote access? Move billing to a different company? Start using a new application that handles patient information?
Give that change list to the person evaluating your analysis. They can determine what needs further examination.
The question is whether the assessment remains accurate, not whether the folder contains a PDF.
Step 2: Identify the Systems, Locations, and Patient Information in Scope
A security risk analysis, often called an SRA, examines risks to electronic protected health information, or ePHI. That includes protected patient information your organization creates, receives, maintains, or transmits electronically.
HHS guidance makes clear that the analysis must account for the organization’s ePHI across its environment. It is not limited to the EHR. HHS.gov
Start with a practical question:
“Where does electronic patient information go during an ordinary workday?”
Walk through scheduling, registration, clinical care, billing, referrals, patient messages, and reporting. Ask the people doing the work. The official system list may miss a spreadsheet someone downloads every Friday.
Build a Working Inventory
Your inventory should help the assessor understand the environment. It does not need to contain actual patient records.
| Area to examine | Questions for your team |
| EHR and connected applications | Which systems hold clinical information, and how do they exchange it? |
| Billing and reporting | Where are claims files, registry exports, and patient-level reports stored? |
| Devices and access | Which computers, mobile devices, and remote connections access ePHI? |
| Communication | Which email, messaging, fax, and patient communication tools handle it? |
| Backup and recovery | Where are copies maintained, and who verifies recovery capabilities? |
| Locations and vendors | Which offices, remote work arrangements, and outside organizations are involved? |
Examine Locations and Shared Arrangements
Don't assume reviewing the main office automatically covers every location.
Describe how your sites connect, which systems they share, and where their workflows differ. A satellite office might use a separate scanner, a different network, or a local process for storing documents.
Likewise, clarify the organization being assessed. A shared vendor or common EHR does not, by itself, explain which entities, systems, and workflows the assessment covers.
Have the assessor document those boundaries and explain how they support a thorough analysis.
Include People and Processes
Technology settings are only part of the picture.
Ask how the practice approves access, removes access after departures, handles suspicious messages, and responds when systems become unavailable.
HHS identifies both technical and nontechnical vulnerabilities in its risk analysis guidance. Weak or missing procedures can matter as much as system configuration problems. HHS.gov
You do not need to turn every interview into an interrogation. Ask staff to describe what they actually do, then compare that with the intended process.
Step 3: Schedule the Assessment and Assign the Follow-Through
Once you understand the status and scope, arrange the remaining work.
Ask the assessor what information they need, who must participate, and when the practice can expect findings. Confirm whether follow-up support is included.
I would agree on four milestones:
Information gathering: System inventory, existing documentation, and staff interviews.
Assessment review: Findings and supporting evidence.
Management discussion: Risk priorities, decisions, and necessary resources.
Follow-through: Corrective actions, verification, and ongoing review.
Leave room for questions between milestones. An assessment based on rushed or incomplete answers can leave important gaps unexplored.
Give Every Finding a Responsible Person
A report becomes useful when someone decides what happens next.
Create a corrective action tracker with the finding, planned response, responsible person, target date, and evidence needed to verify completion.
Use a description someone can investigate. For example:
“Review access for departed employees, resolve any remaining accounts, and document the verification.”
That is more actionable than “Improve access controls.”
Your IT provider may implement a change. The practice still needs someone to confirm the work and retain the evidence. Assign that responsibility explicitly.
Prioritize Risk Rather Than Promising a Clean Slate
Not every finding will require the same response or timetable. Work with qualified reviewers to evaluate urgency, available safeguards, and the appropriate action.
However, an action plan alone is not a substitute for required security measures. HHS requires risk management that reduces risks and vulnerabilities to a reasonable and appropriate level. HHS.gov
If a correction requires additional time, document the reason, any interim protection, responsible person, and review date. Do not use a future target date to postpone an urgent issue without examination.
The goal is to manage risk responsibly, not to make every tracker cell green before a meeting.
Keep the Evidence and Reporting Decisions Together
When the assessment is complete, organize the supporting documentation in a restricted location accessible to authorized reviewers.
I recommend keeping the assessment or review, scope, findings, management decisions, corrective actions, and verification evidence together. Record who reviewed the work and when.
Before making a MIPS attestation, confirm that the applicable actions occurred. CMS’s 2026 measure distinguishes conducting or reviewing the analysis from performing risk management activities. Both require attention (qpp.cms.gov).
Also, keep your SAFER Guide assessment separate. CMS identifies the High Priority Practices SAFER Guide as a distinct 2026 PI requirement. Completing that assessment does not replace the SRA.
If your practice has PI reweighting, confirm its reporting implications with your specialist. Do not assume a MIPS reporting exception removes separate HIPAA responsibilities.
Give the Work a Date Before the Calendar Fills
If your 2026 SRA remains unfinished, begin with the facts. Find the existing documentation, identify the environment it needs to cover, and arrange the remaining assessment work.
Then reserve time for the part practices often underestimate: reviewing findings and managing corrective actions. That is where the report starts informing how your organization protects patient information.
You do not need every answer before asking for help. You do need someone to bring the right people and records together.
Contact Chirpy Bird to discuss your SRA scope and available assessment dates. Call (888) 647-7247, or explore our SRA and SAFER Guide support.
Give the work an owner and a date now, while your team still has room to respond thoughtfully.
