No. Any and every organization that creates, receives, maintains, or transmits PHI is required to conduct an accurate and thorough HIPAA Risk Assessment in order to comply with §164.308 of the HIPAA Security Rule. Even if your organization does not create, receive, maintain, or transmit PHI electronically (ePHI), a HIPAA Risk Assessment must still occur to comply with the requirements of the HIPAA Privacy Rule.