HHS Releases Updated Security Risk Assessment Tool

The U.S. Department of Health and Human Services Office for Civil Rights (OCR) and the Assistant Secretary for Technology Policy (ASTP) have released version 3.6 of the Security Risk Assessment (SRA) Tool. According to HHS, live webinars are being hosted on 15 September 2025 at noon ET and 16 September 2025 at 3pm ET to demonstrate new features, walk through reports, and answer questions.

Version 3.6 includes a new reviewed-by confirmation button to record approvals and dates for audit tracking, a updated NIST-aligned risk scale that changes “medium” to “moderate”, enhanced reports with section-specific details and updated disclaimers, refreshed library files to mitigate vulnerabilities in outdated components, and improved content for questions, responses, and education. A download link for SRA Tool v3.6 is provided, along with a registration link for the webinar. Source: HHS.