We meet a lot of practices that have a PDF titled "HIPAA Risk Analysis" in a shared drive, last updated three years ago, and treat it as evidence of compliance. When HHS or a cyber carrier actually looks, that document is one artifact out of roughly two dozen that should exist — and it's the easiest one to fake.
A real HIPAA program includes: an annual risk analysis with written remediation, a policy and procedure library tailored to your workflows, documented workforce training, a BAA inventory, access controls and audit logs, an incident response plan, and evidence that breach notification procedures have been tested.
When we run our first SRA at a new client, we don't just produce a new PDF. We build (or refresh) each of those program elements, assign owners, and set a cadence. Compliance becomes a set of recurring activities, not a one-time deliverable.
If your only HIPAA artifact is a three-year-old risk analysis, you don't have a compliance problem yet — you have a documentation problem that becomes a compliance problem the morning after an incident.
