Although the requirement to conduct risk assessments appears in the Security Rule and is widely assumed to apply exclusively to ePHI, there is no good reason why Covered Entities and Business Associates should not conduct risk assessments on the privacy of PHI in any format – for example, verbal and written PHI as well as electronic PHI.