HIPAA risk analysis is a component of the broader risk assessment process. HIPAA risk assessment includes scoping the elements of the IT environment and users involved in handling PHI, conducting security testing, reviewing policies, and generating reports. The specific task of risk analysis is evaluating the probability of threats considering the existing vulnerabilities, as well as assessing the potential impact of a security incident.