For healthcare organizations, annual risk assessment is a compulsion. HIPAA risk assessment reviews existing technical, administrative, and security parameters currently being assessed by the organization. So for a healthcare organization, all three areas must be assessed effectively.