Hackers are attacking a practice and now the practice decides to do a Risk Assessment.
Once hackers are already attacking your practice, it’s too late to do your Risk Assessment. You need to do this beforehand to prevent the hacker attack in the first place!