Free HIPAA risk assessment tools compared

The main free HIPAA risk assessment tool is the HHS Security Risk Assessment (SRA) Tool — a Windows desktop app, with an Excel Workbook version for Mac and Linux. It is a legitimate starting point, but every free option (the HHS SRA Tool, state templates, vendor boilerplate) shares the same limits: static output, no remediation guidance, no methodology documentation, and no way to stay current. Running one is better than nothing; treating its output as a finished, defensible analysis is the mistake the Office for Civil Rights (OCR) cites.

Free HIPAA risk assessment tools are appealing. The requirement is mandatory; the budget may be tight. HHS offers a free tool. States offer resources. Vendors offer free templates. Before relying on free options, understand what they provide and — more importantly — what they cannot.

This article reviews the major free tools: what they do well, where they fall short, and why free tools often fail to produce the defensible analysis OCR expects. For the process itself — scoping, threat identification, and documentation — see how to do a HIPAA risk analysis.

The HHS Security Risk Assessment Tool

The primary free option is the HHS SRA Tool, developed within the U.S. Department of Health and Human Services (HHS) by the Office of the National Coordinator for Health Information Technology (now the Assistant Secretary for Technology Policy), with the Office for Civil Rights (OCR). It comes in two versions: an interactive Windows desktop application and an Excel Workbook that opens on a Mac — or any program that reads .xlsx files.

What it does well

Price: Free download from healthit.gov. No license, no subscription.

Structure: The tool walks through HIPAA Security Rule requirements in a question-based format. It covers administrative, physical, and technical safeguards.

Output: Generates a PDF report with your answers and some basic scoring.

Authority: Developed by the agency that enforces HIPAA. Using an official tool demonstrates intent to comply.

Significant limitations

Interactive app is Windows-only. The guided desktop application requires Windows, but Mac and Linux practices are not shut out: HHS also publishes an Excel Workbook version with the same content that opens in Microsoft Excel — including on a Mac — or any program that reads .xlsx files. Neither version runs on a phone.

Desktop-only. No cloud backup, no multi-device access, no collaboration features. Data lives on one machine.

Static output. The PDF export is a snapshot. It does not link to your Risk Management Plan, does not auto-update, and does not track changes over time.

No remediation guidance. The tool identifies gaps but does not tell you how to close them. You get a list of "needs" without the "how to address."

Not updated for the proposed rule. The current version reflects the 2013 rule. It does not address the proposed Security Rule update (MFA requirements, encryption changes, etc.).

Lighter methodology. The tool includes a threat-and-vulnerability rating step with a NIST-aligned risk scale, but it is a guided questionnaire rather than a fully documented NIST SP 800-30 risk register. Building out the detailed analysis and documentation the way OCR's guidance describes is still up to you.

No business associate agreement (BAA) assistance. The tool asks if you have BAAs but does not help you identify missing BAAs or provide template language.

No vendor specificity. The generic questions do not adapt to your specific electronic health record (EHR), your cloud backup vendor, or your telehealth platform.

State extension service tools

Some states offer HIPAA resources through cooperative extension services or state health departments.

What they provide

Free or low-cost templates: Some states offer Word or Excel templates for risk analysis documentation.

Local expertise: State resources may understand regional issues (natural disasters specific to your state, state laws that overlay on HIPAA).

Workshops: Some states offer in-person or virtual training on using their tools.

Limitations

Inconsistent quality: State resources vary dramatically. Some are excellent; others are outdated or incomplete.

Not methodology-driven: Many state templates are checklists, not structured risk analyses following NIST 800-30.

No ongoing support: States rarely provide help if you get stuck or if OCR investigates.

Limited scope: State tools may focus on their specific interests (workplace safety, Medicaid compliance) rather than comprehensive HIPAA risk analysis.

California example: California offers resources through the Center for Data Insights and Innovation (CDII), formerly CalOHII, and the Department of Public Health. These emphasize California-specific requirements (Confidentiality of Medical Information Act (CMIA), California Consumer Privacy Act (CCPA)) but may not provide full HIPAA risk analysis structure.

Vendor-provided free templates

HIPAA compliance vendors, EHR vendors, and IT consultants often offer "free HIPAA risk assessment templates" as lead generation.

What they provide

Word documents: Boilerplate templates with bracketed placeholders for your practice information.

Marketing content: Often designed to steer you toward the vendor's paid services.

Quick start: Pre-formatted documents that look professional.

Limitations

Boilerplate risk: The templates are generic. If you fill them in without deep customization, you produce the exact "boilerplate analysis" that OCR cites in settlements.

Sales focus: Free templates are marketing. The content may emphasize areas where the vendor sells services while minimizing areas they do not.

No methodology guidance: Templates show you what to fill in but not how to assess likelihood, impact, or risk levels.

Quality variance: Some are good; many are outdated, incomplete, or written by marketers rather than compliance professionals.

What free tools cannot do

Free tools have inherent limitations that affect your ability to produce a defensible analysis:

Cannot assess your specific environment

Free tools use generic questions. They cannot know:

• Your specific EHR and its vulnerabilities
• Your actual vendor stack and which lack BAAs
• Your specific threat environment (regional risks, practice type risks)
• Your current control effectiveness

A defensible analysis must be accurate — specific to your environment. Generic tools produce generic output.

Cannot guide methodology

National Institute of Standards and Technology (NIST) 800-30 risk analysis requires:

• Threat identification paired with vulnerability assessment
• Likelihood rating with documented rationale
• Impact rating with documented rationale
• Risk determination and prioritization

Free tools provide checklists, not methodology. They ask "Do you have X?" not "What is the risk level of Y and why?"

Cannot provide remediation guidance

Knowing you have a gap is step one. Closing the gap requires:

• Specific remediation steps
• Vendor scripts for requesting security features
• Timeline and responsible party assignment
• Policy language

Free tools identify; they do not remediate.

Cannot produce the three linked artifacts

OCR settlements consistently cite the need for:

1. Annual Risk Analysis Report (the assessment)
2. Risk Management Plan (the response)
3. Documentation of implementation

Free tools typically produce #1, inadequately. They do not produce #2 or help with #3.

Cannot stay current

HIPAA enforcement evolves. The proposed Security Rule update would change requirements. Threats change (ransomware in 2026 is not what it was in 2019).

Free tools are rarely updated. The HHS SRA Tool has not been updated for the proposed rule. Vendor templates age out.

When free tools are appropriate

Free tools have a legitimate role in specific situations:

Education and learning

Use the HHS SRA Tool to learn what HIPAA requires. Walk through the questions to understand the scope. This builds knowledge; do not submit the output as your analysis.

Preparation for professional assessment

Use free tools to inventory your systems before engaging a consultant or starting a guided assessment. The preparation saves time and money.

Budget-constrained starting point

A free tool analysis is better than no analysis. If your choice is between the HHS SRA Tool and nothing, use the tool. But understand the output is a starting point, not a finished deliverable.

Annual self-assessment

If you have strong compliance knowledge and a simple environment, free tools can structure your annual review. This assumes you understand methodology and can customize the output appropriately.

The CoreFolio free assessment

CoreFolio offers a free HIPAA risk assessment distinct from the Digital Binder paid tier:

What it includes:

• Full assessment of all eight HIPAA sections
• Unlimited use
• Browser-based (no installation)
• Local storage (your answers stay in your browser)
• Gap scoring and section-level results

What it does not include:

• The two named PDF artifacts (Annual Risk Analysis Report and Risk Management Plan) — these require Digital Binder; NPRM forward-look items live in the Risk Management Plan
• Vendor-specific remediation scripts
• Template library access
• Cloud storage of results

The distinction: The free assessment shows you your gaps. The Digital Binder produces the dated, defensible documentation OCR expects. Many practices start with the free assessment to understand their position, then upgrade to produce the formal artifacts.

Making the choice

Use free tools if:

• You are learning HIPAA requirements
• You have strong compliance expertise and just need structure
• You are preparing for a professional assessment
• Budget constraints leave no alternative

Move beyond free tools if:

• You need defensible documentation for OCR
• You want methodology guidance, not just checklists
• You need remediation help, not just gap identification
• You want the linked artifacts (risk analysis report, risk management plan with NPRM forward-look)
• You need vendor-specific guidance for your actual systems

The hidden cost of free

Free tools have no direct cost but may have high indirect costs:

Time cost: Free tools require more user time. The HHS SRA Tool does not guide methodology; you must learn it yourself. A 10-hour DIY process costs $1,500 at a $150/hour owner rate.

Risk cost: An inadequate free-tool analysis that fails OCR review costs far more than professional help would have. Settlements start in the five figures.

Opportunity cost: Time spent wrestling with free tools is time not spent on patient care, practice growth, or other priorities.

The bottom line

Free HIPAA risk assessment tools are legitimate resources. The HHS SRA Tool, state resources, and vendor templates can educate, structure, and support your compliance efforts. But they cannot produce the accurate, thorough, current, methodology-driven risk analysis that OCR enforcement now demands.

Use free tools as starting points, learning aids, or budget-constrained stopgaps. Do not mistake them for the professional, defensible assessment that satisfies 45 CFR § 164.308(a)(1)(ii)(A). The gap between "ran a free tool" and "produced compliant documentation" is significant — and it is the gap that OCR investigates.

Sources