A well-done security risk assessment (SRA) will identify security vulnerabilities across the breadth of a healthcare organization's health information systems. Factors will include policy, organizational and technical related requirements to privacy and security measures. ONC, in recognizing the complexity of this task for small to medium healthcare providers developed a toolkit to assist in conducting SRAs.