HIPAA requires a risk assessment, and the practical standard is at least once a year, plus any time something significant changes, such as a new EHR, a cloud migration, a merger, or a security incident. A current assessment shows where patient data lives, what could go wrong, and what to fix first. Many practices fall out of compliance simply because their last assessment is outdated.