This service is used in the documentation proving meaningful use is essential to passing the audits and keeping EHR incentive program funds. Many providers who have failed audits as of late 2016 have done so because of inadequate or nonexistent HIPAA risk assessments, which are required under meaningful use.