Question: are hipaa risk assessment mandatory?
Answer: No, we are not HIPAA. ... And yes, HIPAA (Health Insurance Portability and Accountability Act) does require every practice that handles protected health information to take a risk assessment. Section 164.308(a)(1)(ii)(A) states: RISK ANALYSIS (Required).