← HIPAA · Administrative safeguards

164.308(a)(1)(ii)(A) — Risk analysis (R)

critical risk-assessment

Requirement

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information held by the entity.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of

risk analysisrisk assessment

Required element 2 — any one of

ephiphiprotected health informationhealth data

Supporting terms — specificity signals

annualdocumentedthreatvulnerabilitylikelihoodimpactinventory of ephinist 800-30

Contradiction markers

Finding any of these outranks coverage — a policy that admits the gap is worse than silence.

no risk assessment risk analysis has never been performed

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

Framework	Control	Title	Shared topics
SOC 2	CC3.1	Objectives and risk identification	risk-assessment
SOC 2	CC3.2	Risk analysis and response	risk-assessment
SOC 2	CC3.3	Fraud risk	risk-assessment
PCI DSS 4.0.1	12.3.1	Targeted risk analyses	risk-assessment
GLBA	314.4(b)	Written risk assessment	risk-assessment
NIST CSF 2.0	ID.RA-05	Risks are prioritised to inform response	risk-assessment
GDPR	Art.35	Data protection impact assessment	risk-assessment
GDPR	Art.36	Prior consultation with the supervisory authority	risk-assessment