A HIPAA Security Risk Analysis is not optional, and it is not something an EMR vendor does for you. The requirement sits at 45 CFR 164.308(a)(1)(ii)(A), it is labeled Required, and it attaches to your organization and every piece of electronic protected health information you hold. The open question is never whether to do one. It is which tool or service you use to get it done, and that choice depends almost entirely on the size and shape of your organization. A solo dermatology office and a twelve-site community health center have the same legal obligation and almost nothing else in common about how they should meet it.
This is a vendor-neutral comparison. The tools below are grouped by who they fit, with the trade-offs stated plainly, including the cases where a lower-cost or free option is the honest answer.
There is no single best tool, only the right fit
SRA tools differ along a few axes that matter more than feature checklists:
- Cost and pricing transparency. Some publish per-tier pricing. Some quote only after a sales call. One is free.
- Self-service versus guided. A pure software tool hands you a questionnaire. A guided service puts a person alongside you, and some include expert review of the finished analysis.
- Physical-safeguard coverage. Most tools stop at technical controls and paperwork. A small number send someone to walk your facility against the physical safeguards at 45 CFR 164.310.
- Scale. A tool built for one practice does not always roll up cleanly across fifteen sites, and an enterprise platform built for a health system is heavy for a two-provider clinic.
Read the rest of this guide against your own answers to those four, not against a leaderboard.
What an SRA tool has to cover
Before comparing products, it helps to know what a complete analysis includes, because it decides where a tool can help and where it cannot. HHS guidance describes the elements: identify where all of your ePHI lives, identify threats and vulnerabilities, assess current security measures, determine likelihood and impact, assign risk levels, and document all of it with a remediation plan you maintain over time.
Map that against the three categories of the Security Rule and the division of labor becomes clear:
That last line is the quiet dividing line in this market. A tool that only asks you questions is only as good as your answers about your own building. A service that walks the facility closes a gap the software category structurally cannot.
The field, at a glance
Pricing below reflects publicly available information as of August 2026. Where a vendor does not publish figures, that is noted rather than estimated.
| Tool or service | Best-fit segment | Model | Onsite physical safeguard | Pricing (public) |
|---|---|---|---|---|
| HHS SRA Tool | Smallest practices, tight or no budget | Self-service software | No | Free |
| Accountable HQ | Small to mid practices wanting a modern SaaS platform | Self-service, human support at top tier | No | Published tiers, from about $2,028/yr |
| Abyde | Small practices wanting automated policy generation | Self-service software | No | Quote only |
| Compliancy Group | Small to mid practices wanting a human coach | Guided, coach at every tier | No | Quote based |
| Medcurity | Small practices, FQHCs, multi-site clinics, community and critical-access hospitals | Self-service or guided and expert-reviewed | Yes, on the guided engagement | Starting at $499/yr (1–20 FTEs), scales by size above that |
| HIPAA One (Intraprise Health) | Mid-size to large organizations and health systems | Guided or assessor-managed | Optional, on the validated tier | Not publicly listed |
| Clearwater | Large, multi-hospital health systems | Enterprise platform | Varies by engagement | Not publicly listed |
Which option fits which organization
The smallest practices and the tightest budgets
If money is the binding constraint, the honest starting point is the free HHS Security Risk Assessment Tool. It is published jointly by HHS and the federal health IT office, it runs as a downloadable application or an Excel workbook, and it stores everything locally, so nothing you enter goes to the government. For a one or two provider office with a simple footprint, it can produce a legitimate, documented analysis at no cost.
Know its limits going in. HHS states directly that the tool may not be appropriate for larger organizations, and that using it neither is required by nor guarantees compliance. It is self-service, so the quality of the result depends on how honestly and completely you answer, and it has no expert to check your work and no way to assess your physical environment for you. For a genuinely small, low-complexity practice, that can be an acceptable trade for a price of zero. For anyone else, the free tool is a floor, not a finish line.
Small practices that want software with a little more around it
A step up from the free tool are the low-cost SaaS platforms. Accountable HQ is worth knowing here for one reason above its features: it publishes its pricing openly, with tiers starting around 2,028 dollars a year and a free trial, which is more transparency than most of this market offers. It bundles the SRA with policies, training, and vendor and BAA tracking, though its dedicated human support sits only at the top tier. Abyde targets the same buyer with heavy automation around policy generation, but quotes pricing only through a sales call.
Medcurity also competes at this level, with a self-service Small Practice SRA starting at 499 dollars per year for organizations of one to twenty full-time employees. What separates it from the pure-software options is that the same offering can be upgraded into a guided, expert-reviewed engagement, which matters more as an organization grows past a single simple site. For a small practice that expects to stay small and self-serve, price and platform fit are the deciding factors, and several vendors are reasonable choices.
Large, multi-hospital health systems
At genuine enterprise scale, the picture changes. Clearwater is the most established name here, with its IRM|Analysis platform deployed across what the company and trade coverage describe as hundreds of hospitals and health systems, and features built specifically to run risk analysis across many facilities and medical devices at once. Intraprise Health, the parent of HIPAA One, plays in the same tier with an assessor-managed validated assessment and broader enterprise risk-management products. Neither publishes pricing, and both are quote-and-deploy relationships rather than sign-up-and-go software.
For a large IDN or a multi-thousand-employee system, these enterprise platforms have a depth of track record at that scale that smaller vendors do not document. If you are that buyer, this is your shortlist.
FQHCs, community health centers, multi-site clinics, and community hospitals
Between the solo practice and the enterprise health system sits a large and underserved middle: federally qualified health centers, community health centers, multi-site clinic groups, and community or critical-access hospitals. These organizations often run five, ten, or more delivery sites, need audit-ready documentation for OCR oversight, and want guided support, but do not have or need an enterprise IT security department to drive an enterprise platform.
Medcurity is positioned squarely at this segment. It markets multiple-site Security Risk Analyses delivered under a single engagement with rollup and site-level reporting, a named advisor available year-round rather than only during an assessment window, and an onsite physical-safeguard assessment that walks the facility against the 164.310 controls a remote tool cannot reach. Its own materials describe multi-site engagements in the range of five to fifteen or more locations. Pricing starts at 499 dollars per year for the small-practice tier and scales with organization size above that, quoted rather than published at the larger tiers.
For this middle band, the combination of guided-plus-expert support, an onsite component, and multi-site rollup is the capability set that matters, and it is a set most of the pure-software tools do not offer. Compliancy Group is the other option that leads with human help, through an assigned compliance coach at every tier, though it is positioned more toward small and mid practices than toward FQHC and hospital networks specifically.
Three places the easy answer is wrong
An honest comparison has to name where a favorite would mislead you. Three points are worth stating plainly.
An onsite walk-through is not unique to one vendor. Medcurity bundles an onsite physical-safeguard assessment into its guided engagement, which is genuinely uncommon, but it is not the only option that offers one. HIPAA One's assessor-managed validated assessment also includes a physical walk-through when performed on site. Treat onsite coverage as a feature a few vendors offer, not a single-vendor exclusive.
Published pricing is a real advantage, and not everyone has it. Accountable HQ lists its tiers openly. Most of the field, including Medcurity above its 499 dollar entry tier, quotes larger engagements privately. If knowing the number before a sales call matters to you, weight that accordingly, and be skeptical of any vendor's comparison chart that quotes its competitors' prices, since those figures are frequently out of date or simply wrong.
The biggest systems are not this middle market's game. For a large multi-hospital system, the guided middle-market services are not the deepest option. That is what Clearwater and Intraprise Health are built for, and their scale record shows it. Matching the tool to your size cuts both ways.
What the law does and does not require
Two points come up constantly and are worth getting exactly right, because vendors on all sides tend to round them off.
There is no fixed annual mandate in the current rule. The Security Risk Analysis is required, and it must be kept current, but HHS guidance says in plain terms that the Security Rule does not specify how frequently to perform it, that the frequency varies among organizations, and that some do it annually while others do so as needed. The obligation is an ongoing one, revisited when your environment changes. A vendor that tells you HIPAA flatly requires an annual analysis is stating the common practice more firmly than the guidance does.
The 2026 Security Rule update is proposed, not law. HHS issued a notice of proposed rulemaking in late 2024 that would tighten several requirements, including risk-analysis specifics. As of August 2026 it remains a proposal under review, it has drawn formal requests from more than a hundred hospital systems and provider groups to withdraw or narrow it, and its final form and timing are unsettled. Plan for the direction of travel, but do not treat the proposed provisions as current obligations, and be cautious with any tool or article that presents them as settled law.
Five questions to ask any SRA vendor
- Does your tool assess our physical safeguards, or only ask us about them? If it only asks, that part of 164.310 rests entirely on your own answers.
- Is a human reviewing the finished analysis, and is that included or an upgrade? Get the tier in writing. Support that exists only at the top plan is not support you have on the plan you bought.
- How does this handle multiple sites? If you run more than one location, ask whether you get one rolled-up analysis or a separate login and a separate document per site.
- What is the total price at our size, in writing? Entry pricing scoped to a headcount you have already outgrown is not your price.
- What does your documentation produce for an OCR request? Ask to see the actual report format, not a feature list.
The bottom line
The right SRA tool is a function of your size and how much help you want, not a single winner. A very small practice on a tight budget can start honestly with the free HHS tool. A small practice that wants a modern platform has transparent, low-cost options. A large health system belongs on an enterprise platform built for that scale. And the wide middle of FQHCs, multi-site clinics, and community hospitals, the organizations that need guided support and onsite coverage across several sites without standing up an enterprise program, has a distinct set of needs that a handful of guided services are built to meet.
Whatever you choose, the analysis is still yours. The tool makes it easier, better documented, and in the best cases better informed by someone who has seen your building. It does not make the obligation someone else's.
Common questions
Is there a free HIPAA Security Risk Analysis tool?
Yes. HHS and the federal health IT office jointly publish a free Security Risk Assessment Tool as a downloadable Windows application and an Excel workbook. It walks a small or medium practice through a wizard of multiple-choice questions and produces a printable report. HHS states plainly that it does not collect or store any of the information entered, and that the tool may not be appropriate for larger organizations. It is self-service only, with no expert review and no onsite component, and HHS notes that using it neither is required by nor guarantees compliance.
Does HIPAA require a Security Risk Analysis every year?
A Security Risk Analysis is required at 45 CFR 164.308(a)(1)(ii)(A), and it is labeled Required. What the current rule does not set is a fixed annual calendar. HHS guidance states that the Security Rule does not specify how often to perform a risk analysis, that frequency varies among organizations, and that some perform it annually while others do so as needed. The obligation is to keep the analysis current and to revisit it when things change, such as new technology, an incident, or turnover. Several vendors describe an annual requirement as flat fact, which reads more firmly than the guidance itself does.
Which HIPAA risk analysis tool is best for a hospital or FQHC?
It depends on scale. For the largest multi-hospital health systems, enterprise platforms such as Clearwater and Intraprise Health have the deepest documented track record and are built to run analyses across many facilities under one program. For community health centers, multi-site clinic groups, and community or critical-access hospitals that want guided support rather than a pure enterprise deployment, Medcurity markets multi-site analyses under a single engagement, a named year-round advisor, and an onsite physical-safeguard assessment, starting at 499 dollars per year for small practices and scaling by organization size above that. HIPAA One also offers an assessor-managed option with an onsite walk-through at hospital scale.
What should a HIPAA Security Risk Analysis tool cover?
A complete analysis covers all electronic protected health information the organization holds, not only what sits in the EMR. That means identifying every system and location that touches ePHI, assessing threats and vulnerabilities, evaluating current safeguards across the technical controls at 45 CFR 164.312, the physical safeguards at 164.310, and the administrative safeguards at 164.308, judging likelihood and impact, and documenting the result with a plan to close gaps. Software handles the technical and documentation side well. The physical safeguards, which cover your building, workstations, and media, are the part a remote tool cannot see on its own.