Greetings,
The Risk Assessment for Meaningful Use does have to be updated every year. This is one of the main points CMS will audit you on. You do not have to have a 3rd party agency update it, however. You can update the form they gave you with the current years information (most offices, its the same from year to year)
