HIPAA (Health Insurance Portability and Accountability Act) requires practice to have formal policies and practices to conduct an accurate assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information (ePHI).