A HIPAA Security Risk Assessment should reveal any areas of an organization’s security that need attention. Organizations then need to compile a risk management plan that addresses the weaknesses and vulnerabilities uncovered by such an assessment, as well as the implementation of new procedures and policies where necessary to close the vulnerabilities most likely to result in a breach of PHI.