Do I need to do security risk analysis for only for Office-Based(hosted) EHRs?

No. Both office-based (locally-hosted) and Internet-hosted (remotely-hosted) EHRs have features that enable your practice to better control access to and use of protected health information than was available with paper medical records. On the other hand, both EHR types also introduce new risks to your patients’ information.
The mix of security risks relates, in part, to your EHR type.