Quick answer: HIPAA risk assessment tools help MSPs find where protected health information (PHI) lives in a client environment and evaluate the threats and vulnerabilities around it. The most effective approach in 2026 pairs PHI discovery, which locates and classifies health data, with agentless risk assessments, which check the security posture of the systems holding it without installing software on every device.
For MSPs serving healthcare clients, HIPAA is no longer a niche concern. Clinics, dental offices, billing companies, and health tech vendors all handle PHI, and most rely on an outside provider to secure it. That makes the MSP a business associate with its own HIPAA obligations.
This guide explains what PHI discovery is, why it is the foundation of every HIPAA risk analysis, what to look for in HIPAA compliance software, and how to run a faster, repeatable assessment across multiple clients.
What is PHI, and where does it hide in client environments?
Protected health information is any individually identifiable health information created, received, stored, or transmitted by a covered entity or business associate. HIPAA lists 18 identifiers that make health data identifiable, including names, addresses, dates tied to an individual, phone numbers, email addresses, Social Security numbers, medical record numbers, health plan beneficiary numbers, and full-face photos.
Electronic PHI (ePHI) rarely stays inside the electronic health record system. During assessments, MSPs commonly find it in:
- File shares and local drives: exported reports, scanned intake forms, referral letters
- Spreadsheets: billing reconciliations and patient lists built outside the EHR
- Email and attachments: lab results and insurance forms sent between staff or partners
- Cloud storage: OneDrive, SharePoint, Google Drive, and Dropbox folders synced to personal devices
- Backups and legacy systems: retired practice management databases that were never decommissioned
- Endpoints: downloads folders and desktops on front-desk and clinician workstations
Every one of these locations is in scope for HIPAA, whether or not the client knows it exists. That is the core reason protected health information scanning matters.
Why is PHI discovery the foundation of a HIPAA risk assessment?
The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of all ePHI they hold. The key word is all. You cannot assess risks to data you have not found.
Incomplete risk analysis is one of the most frequently cited problems in HHS Office for Civil Rights (OCR) investigations and settlements. A risk analysis that covers only the EHR, while PHI sits unprotected in a shared drive or an old backup, will not hold up.
Where the HIPAA Security Rule stands in 2026
HHS proposed a major overhaul of the Security Rule in January 2025, including requirements for a written technology asset inventory, a network map showing how ePHI moves, and annual compliance audits. As of July 2026, HHS moved its target date for final amendments from May 2026 to July 2027 and reclassified the rulemaking as a long-term action (Davis Wright Tremaine). Timelines can change again, and the current Security Rule remains fully in force.
For MSPs, the practical message is the same either way: knowing where ePHI lives, and documenting it, is required today and will likely become more explicit in the future.
What should HIPAA risk assessment tools do?
The best HIPAA risk assessment tools combine data visibility with security posture, so MSPs can see both what is at stake and how exposed it is. When evaluating HIPAA compliance software, look for these capabilities:
- PHI discovery and classification: finds ePHI across endpoints, servers, and cloud storage, including the 18 HIPAA identifiers.
- Asset inventory: shows every system that creates, stores, or transmits ePHI.
- Vulnerability and configuration checks: identifies missing patches, weak settings, and unencrypted storage on systems that hold PHI.
- Access visibility: reveals who can open files containing PHI, which supports minimum necessary access.
- Risk scoring: ranks findings by combining data sensitivity with the likelihood of exploit.
- Audit-ready reporting: produces documentation for the client's risk analysis and for OCR inquiries.
- Multi-tenant management: lets MSPs run and compare assessments across many clients from one console.
What are agentless risk assessments?
An agentless risk assessment collects security and data information without installing a persistent software agent on each device. It typically uses existing protocols, credentials, or cloud APIs to inspect systems remotely.
For MSPs, agentless approaches offer real advantages in healthcare settings:
- Faster onboarding: assessments can start in hours instead of waiting on agent rollouts
- Less friction with clinical systems: fewer changes to medical workstations and vendor-managed devices
- Better coverage for prospects: a pre-sales assessment can be run before a full contract is signed
- Lower maintenance: no agent versions to update across dozens of client environments
Agentless tools do have trade-offs, such as needing network reachability and appropriate credentials, so many MSPs use them for broad, fast discovery and pair them with deeper scanning where needed.
How to pair PHI discovery with agentless risk assessments
This six-step process gives MSPs a repeatable, HIPAA-aligned security review that can be run at onboarding and on a recurring schedule.
- Confirm roles and scope. Sign a business associate agreement (BAA) and agree on which locations, tenants, and devices are in scope.
- Run an agentless asset discovery. Inventory endpoints, servers, cloud tenants, and storage locations, including ones the client has forgotten.
- Scan for PHI. Search file contents for the HIPAA identifiers and health data patterns, then classify findings by type and volume.
- Assess the systems holding PHI. Check patch levels, encryption, configuration, and access permissions on every asset where PHI was found.
- Score and prioritize risk. Rank issues where high PHI volume overlaps with high exposure, and decide whether to remediate, delete or consolidate data, or restrict access.
- Document and repeat. Record findings, decisions, and remediation in a format the client can use for its HIPAA risk analysis, then rescan regularly to catch new PHI and drift.
This approach turns healthcare data security from an annual checkbox into an ongoing service, which is also a clear value story for MSPs offering compliance packages.
Frequently asked questions
Do MSPs have to comply with HIPAA?
Yes, when they create, receive, maintain, or transmit ePHI on behalf of a healthcare client. In that case the MSP is a business associate and is directly subject to the HIPAA Security Rule and the terms of its BAA.
What is the difference between a HIPAA risk assessment and a risk analysis?
The terms are often used interchangeably. "Risk analysis" is the term in the Security Rule, referring to the required assessment of risks to ePHI. "Risk assessment" is commonly used for the broader process, including the tools and scans that support it.
How often should a HIPAA risk assessment be done?
The current rule requires risk analysis to be accurate and kept up to date, without fixing a specific frequency. Most organizations perform a full review at least annually and after significant changes, such as new systems, migrations, or a security incident.
Can PHI discovery be fully automated?
Automated scanning can find most structured identifiers and common document types quickly. Human review is still useful to confirm edge cases, such as scanned images or free-text notes, and to make remediation decisions.
Are agentless risk assessments accurate enough for HIPAA?
Agentless assessments can provide strong coverage for asset discovery, configuration checks, and PHI scanning. Their accuracy depends on credentialed access and network reach, so they work best as part of a documented, repeatable process.
Key takeaway
A HIPAA risk assessment is only as strong as its PHI inventory. MSPs that pair PHI discovery with agentless risk assessments can find health data wherever it lives, measure the risk around it, and deliver faster, better-documented HIPAA-aligned reviews for every healthcare client.
