The Required Annual Risk Assessment A HIPAA Security Risk Assessment is not optional, despite the fact that an estimated 8 of 10 practices haven’t conducted one for their HIPAA program, or haven’t kept up with the annual updates. Find out what to do about that here.