HIPAA Security Rule Assessment

Evaluates compliance with the HIPAA Security Rule across Administrative, Physical, Technical, Organizational, and Breach Notification safeguards.

Your Information

Full Name *

Company *

Email *

Phone *

Your information is kept private and used only to send your results.

0 of 43 answered 0%

Administrative Safeguards - Security Management

Has a written risk analysis been completed in the last 12 months?

High impact

Yes No

Is there a documented risk management plan addressing identified risks?

High impact

Yes No

Are sanctions defined and applied for workforce violations of security policies?

High impact

Yes No

Are audit logs and system activity reviewed on a regular schedule?

High impact

Yes No

Administrative Safeguards - Workforce Security

Is there a formal process for authorizing and supervising workforce member access to ePHI?

High impact

Yes No

Is termination access revocation performed same-day for departing staff?

High impact

Yes No

Are background checks conducted on workforce members with ePHI access?

Yes No

Administrative Safeguards - Information Access

Are access privileges granted based on role and need-to-know?

High impact

Yes No

Is ePHI access periodically reviewed and recertified?

High impact

Yes No

Administrative Safeguards - Security Awareness

Is security awareness training provided at hire and at least annually?

High impact

Yes No

Are staff trained on phishing and social engineering recognition?

High impact

Yes No

Are password management practices covered in training?

Yes No

Administrative Safeguards - Incident Response

Is there a documented incident response procedure?

High impact

Yes No

Are security incidents logged and reviewed?

High impact

Yes No

Administrative Safeguards - Contingency Plan

Is there a documented data backup plan?

High impact

Yes No

Is there a documented disaster recovery plan?

High impact

Yes No

Is there an emergency mode operation plan (operating during an emergency)?

High impact

Yes No

Are recovery procedures tested at least annually?

High impact

Yes No

Administrative Safeguards - Business Associates

Are signed Business Associate Agreements on file for every vendor that handles ePHI?

High impact

Yes No

Are subcontractor BAAs required and tracked for your BAs?

High impact

Yes No

Physical Safeguards - Facility Access

Are physical access controls in place at facilities housing ePHI systems?

High impact

Yes No

Are visitors logged and escorted in areas containing ePHI?

Yes No

Physical Safeguards - Workstation Use

Are workstation use policies in place (screen locking

Yes No

Physical Safeguards - Workstation Security

Are workstations physically secured (cable locks or restricted areas)?

Yes No

Physical Safeguards - Device and Media

Is there a documented procedure for device disposal and media destruction?

High impact

Yes No

Is media reuse sanitized (wiped) before reassignment?

High impact

Yes No

Are inventory records maintained of hardware and media that contain ePHI?

High impact

Yes No

Technical Safeguards - Access Control

Does every user have a unique user ID (no shared accounts)?

High impact

Yes No

Is there an automatic logoff mechanism after a period of inactivity?

High impact

Yes No

Is ePHI encrypted at rest on servers and endpoints?

High impact

Yes No

Is there an emergency access procedure for ePHI during an outage?

Yes No

Technical Safeguards - Audit Controls

Are audit logs enabled on systems that store or process ePHI?

High impact

Yes No

Are audit logs retained for at least six years?

High impact

Yes No

Technical Safeguards - Integrity

Are mechanisms in place to detect unauthorized alteration of ePHI?

High impact

Yes No

Technical Safeguards - Authentication

Is multi-factor authentication required for all remote and admin access?

High impact

Yes No

Is MFA required for email (Google Workspace or Microsoft 365)?

High impact

Yes No

Technical Safeguards - Transmission

Is ePHI encrypted in transit (TLS 1.2 or higher)?

High impact

Yes No

Is email containing ePHI encrypted or sent via secure messaging?

High impact

Yes No

Organizational Requirements

Are HIPAA policies and procedures maintained in writing and reviewed annually?

High impact

Yes No

Is documentation retained for at least six years from creation or last effective date?

High impact

Yes No

Breach Notification

Is there a documented breach notification procedure?

High impact

Yes No

Are individuals notified within 60 days of breach discovery?

High impact

Yes No

Is HHS notified for breaches affecting 500 or more individuals?

High impact

Yes No

Please answer all questions. remaining.

Results will be emailed to you immediately after submission.