Medcurity vs ONC SRA Tool: Which HIPAA Risk Assessment Is Right for Your FQHC?

If you're the IT lead or compliance coordinator at a federally qualified health center, you've probably already Googled "free HIPAA risk assessment tool" and found the ONC SRA Tool. It's published by HHS, it's free, and it's the starting point for most safety-net orgs trying to figure out HIPAA.

But is it actually the right choice for your FQHC? Let's break it down.

What Is the ONC SRA Tool?

The ONC Security Risk Assessment Tool is a free Windows desktop app published jointly by the Office of the National Coordinator for Health IT and HHS/OCR. It walks users through the HIPAA Security Rule's requirements — technical, administrative, and physical safeguards — and generates a PDF report at the end.

It was first released in 2014 and has been updated periodically. For a single-provider practice doing their first risk analysis, it's a reasonable starting point.

Where It Falls Apart for Multi-Site FQHCs

Here's the problem: the ONC SRA Tool was designed for solo practices. FQHCs are a completely different operational context.

It's desktop-only with no cloud storage

Your assessment data lives in a file on one Windows machine. No team access, no version history, no backup. When the machine that holds your HIPAA assessment file dies, your compliance documentation goes with it.

For an FQHC where the compliance lead, IT coordinator, and CMO all need to contribute — this is a non-starter.

One assessment per site

The OCR expects your SRA to cover all locations where ePHI is created, maintained, received, or transmitted. For a 10-site FQHC, the ONC tool requires 10 completely separate assessment runs, 10 PDF reports, and then you're on your own to manually aggregate findings into something coherent.

That's not how OCR audits work. They want to see one comprehensive organizational risk picture — not 10 disconnected PDFs.

It identifies risks but doesn't manage them

An SRA has two phases:

1. Identify and rate risks
2. Implement a risk management plan to address them

The ONC SRA Tool does phase one. Phase two — tracking remediation, documenting what you fixed and when, maintaining an ongoing risk register — you're entirely on your own.

OCR's audit protocol specifically looks for risk management documentation. If you complete the ONC tool's assessment but have no record of how you addressed the identified gaps, you've only done half the compliance job.

The 2025 HIPAA updates aren't fully reflected

The 2024-2025 HIPAA Security Rule updates introduced:

• Mandatory encryption (no longer "addressable")
• Required MFA for all workforce members accessing ePHI
• Biannual vulnerability scanning
• Annual penetration testing
• 72-hour breach notification for workforce access incidents

The ONC SRA Tool's last major update was 2023. These new requirements aren't fully incorporated into its assessment workflow. Using it alone leaves documented gaps in your 2026 compliance program.

Medcurity vs ONC SRA Tool: Quick Comparison

The Real Cost Math

The ONC SRA Tool is free in dollars but expensive in staff time. A multi-site FQHC using it might spend 20-40 hours per site. At $30/hr loaded cost for a compliance coordinator, that's $600-$1,200 per site — or $6,000-$12,000 for a 10-site FQHC — before you even start manually aggregating findings and building a risk management plan.

Medcurity at $499/year handles multi-site coordination natively and can cut compliance staff time by 60-80%. The math overwhelmingly favors purpose-built software for any organization with more than 2-3 sites.

When to Use the ONC SRA Tool

The ONC tool is still worth using if:

• You're a single-provider practice with one location and zero compliance budget
• You want to understand the HIPAA Security Rule framework before selecting software
• You have a consultant supplementing the output with their own documentation

When to Use Medcurity

Choose Medcurity if:

• You operate more than one FQHC delivery site
• You need team collaboration on the SRA
• You want risk analysis + risk management plan in one integrated system
• You need to demonstrate compliance improvement to OCR, your board, or HRSA
• You want documentation that reflects the 2025 HIPAA Security Rule updates

Community Health Centers That Have Made This Switch

Medcurity is used by CHCs including Snohomish County Community Health Center, NATIVE HEALTH, Valley Wide Health Systems, and Clinicas de Salud del Pueblo — all organizations that needed a compliance program robust enough for OCR scrutiny and practical enough for limited IT staff.

Further Reading

• Full Medcurity vs ONC SRA Tool comparison
• HIPAA compliance cost for FQHCs: complete budget guide
• Best HIPAA software for community health centers
• HIPAA compliance for FQHCs: 2026 guide
• HIPAA compliance for critical access hospitals

Have you used the ONC SRA Tool at your organization? What challenges did you run into with multi-site compliance? Drop a comment below.