An SRA will help you to understand your risk of phishing scams and ransomware, the dangers of lost mobile devices, the risk of insider threats and how prepared you are in the event of a disaster. Finally, it provides the documentation you need as evidence that you have considered all of the possible risks to patient information and have specific plans to lower them. You can't pass a HIPAA compliance audit or breach investigation without it.