HIPAA
Yes. The HIPAA Security Rule requires a risk analysis for every covered entity and business associate, regardless of size. A solo or small practice isn't exempt because it's small; the requirement is tied to handling protected health information, not headcount.
Why it usually gets ignored until it can't be
In practice, small practices often skip this until something forces the question: a cyber insurance renewal application that asks whether a risk analysis has been performed, a breach or near-miss that triggers scrutiny, or an audit. By then it's reactive instead of planned, and the findings carry more weight because there's already a specific incident or application attached to them.
The fixed-scope version exists for exactly this situation: a practice that needs a defensible, documented assessment without a months-long engagement. $6,500 fixed, delivered in 10 business days, built by someone who ran HIPAA programs inside behavioral health and community health organizations, not a generic checklist vendor.
Questions
Yes. The HIPAA Security Rule requires a risk analysis for every covered entity and business associate regardless of size. Practice size does not exempt you from the requirement.
Most often at a cyber insurance renewal, after a breach or near-miss, or ahead of an audit, rather than proactively.
Get started
Tell me what's going on and I'll send back a written scope before anything is committed.