HIPAA Readiness Screening

How ready is your organization?

Answer nine questions to get a quick snapshot of your organization's HIPAA security readiness, including areas of strength and areas that may require additional attention.

9 Questions About 3 Minutes Immediate Results

Before You Begin

Answer based on what you can demonstrate.

This screening is designed to provide a quick picture of your organization's HIPAA security readiness. As you answer each question, consider all systems and devices that store, process, transmit, or access electronic protected health information (ePHI) — including workstations and laptops used to access cloud-hosted EHRs and other systems.

Could you provide evidence for your answer?

Answer based on what your organization can demonstrate, not simply what you believe is being done.

Evidence might include policies and procedures, training records, access-control documentation, system configurations, security-monitoring reports, audit logs, risk-analysis documentation, backup and recovery test results, Business Associate Agreements, or other records showing that a safeguard is actually implemented.

Training

Saying employees receive annual training is different from being able to show who completed the training, what they received, and when they completed it.

Monitoring

Saying systems are monitored is different from being able to produce recent logs, alerts, reports, or review records showing that monitoring actually occurs.

When in doubt, score yourself based on what you could demonstrate today.

Important

This is a preliminary readiness screening. It is not a HIPAA Security Risk Analysis, compliance audit, legal opinion, or determination that your organization is or is not HIPAA compliant.

About You

Tell us about your organization.

Name

Organization

Business Email

Phone Optional

Approximate organization size

Security Risk Analysis

Has your organization completed a documented HIPAA Security Risk Analysis that evaluates risks and vulnerabilities to ePHI across your environment?

A HIPAA Security Risk Analysis evaluates potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI throughout the organization. A vulnerability scan or general IT security assessment alone is not a HIPAA Security Risk Analysis.

Yes — within the last 12 months A documented HIPAA Security Risk Analysis has been completed recently and can be produced as evidence. Yes — but more than 12 months ago A documented HIPAA Security Risk Analysis exists, but it has not been completed recently. Some security or compliance assessments have been performed But not a formal HIPAA Security Risk Analysis. No A documented HIPAA Security Risk Analysis has not been completed. Not sure I am not sure whether one has been completed or whether documentation could be produced.

Security Policies & Procedures

Does your organization maintain documented HIPAA security policies and procedures that reflect how your organization actually protects ePHI?

HIPAA security policies and procedures should document how your organization implements and maintains its administrative, physical, and technical safeguards—not simply restate HIPAA requirements. Consider whether current documentation could be produced to demonstrate how these safeguards are actually implemented.

Yes — documented, implemented, and reviewed regularly Current policies and procedures can be produced and reflect how safeguards are actually implemented. Yes — documented and generally followed, but they may need review or updating Some policies and procedures exist Documentation is incomplete or implementation is inconsistent. We primarily have generic or template policies They have not been fully adapted to how our organization operates. No / Not sure

Access & Authentication

Are systems and devices that store, process, transmit, or access ePHI protected by individual user accounts, appropriate access permissions, and strong authentication controls?

Include workstations, laptops, remote-access systems, cloud applications, EHR platforms, and other systems used to access ePHI—even when ePHI is not stored directly on the device. Consider whether account, permission, and authentication configurations could be demonstrated if requested.

Yes — individual accounts, appropriate permissions, and MFA are consistently implemented These controls can be demonstrated across relevant systems and users. Mostly — controls are in place for most systems and users, with some exceptions Partially — individual accounts are generally used, but permissions or MFA are inconsistent Limited — shared accounts, excessive permissions, or weak authentication remain No / Not sure

Audit Controls & Security Monitoring

Does your organization log and review activity on systems and devices that store, process, transmit, or access ePHI to identify suspicious activity, security events, and unauthorized access?

Consider servers, workstations, laptops, EHR systems, cloud services, firewalls, remote-access systems, and other technology used to access ePHI. A workstation used to access a cloud-hosted EHR can still be relevant even if patient records are not stored locally.

Yes — relevant systems and endpoints are centrally monitored and security events are actively reviewed We can produce recent logs, alerts, reports, or other evidence demonstrating that monitoring and review occur. Mostly — monitoring and logging cover most relevant systems, with some gaps Partially — logs or security tools exist, but review and monitoring are limited or inconsistent Limited — systems generate logs, but there is little or no regular security review No / Not sure

Encryption & Protection of ePHI

Is ePHI encrypted when stored and transmitted, including on systems and devices where ePHI may be stored locally?

Consider servers, databases, laptops, workstations, removable media, backups, email, file transfers, and network communications that may contain or transmit ePHI. Base your answer on encryption controls that can be verified rather than assumed.

Yes — ePHI is encrypted at rest and in transit throughout our environment Encryption coverage can be demonstrated for relevant systems and communications. Mostly — encryption is broadly implemented, with limited documented exceptions Partially — encryption is used in some areas, but significant gaps remain Limited — encryption is inconsistent or used only for certain systems No / Not sure

Backup, Recovery & Availability

Does your organization maintain reliable backups and recovery procedures for systems and data necessary to maintain access to ePHI, and are those recovery procedures tested?

Consider ePHI and the systems necessary to make it available following hardware failure, ransomware, data loss, or another disruption. This may include servers, databases, cloud services, configuration data, and other critical systems.

Yes — critical data and systems are backed up or otherwise recoverable, and recovery is tested regularly Backup and recovery records or test results can be produced as evidence. Mostly — backups and recovery procedures are in place, but testing is limited or infrequent Partially — backups exist, but coverage, documentation, or recovery procedures have gaps Limited — some data is backed up, but there is no comprehensive or tested recovery process No / Not sure

Workforce Security & Training

Does your organization provide recurring HIPAA and security awareness training and maintain processes for managing workforce access to ePHI?

Consider security and HIPAA awareness training as well as how user access is granted, changed when responsibilities change, and promptly removed when workforce members leave. Training completion and access-management activity should be demonstrable rather than informal.

Yes — training occurs at onboarding and regularly thereafter, with documented access-management processes We can demonstrate who completed training and when, as well as how workforce access is granted, changed, and removed. Mostly — recurring training and access-management processes are established, with some gaps Partially — training occurs, but it is infrequent, informal, or access processes are inconsistent Limited — training primarily occurs at onboarding or only when an issue occurs No / Not sure

Physical Safeguards

Does your organization have physical safeguards in place to prevent unauthorized access to systems and devices that store, process, transmit, or access ePHI?

Consider facility access, server and network equipment, employee workstations, laptops, mobile devices, screen visibility, device placement, and the physical disposal or reuse of equipment that may contain or provide access to ePHI.

Yes — physical access is controlled and safeguards are consistently implemented Controls covering relevant facilities, workstations, and devices can be demonstrated. Mostly — appropriate safeguards are generally in place, with a few identified gaps Partially — safeguards exist, but controls are inconsistent or incomplete Limited — physical security is largely informal or relies primarily on employee judgment No / Not sure

Business Associates & Third-Party Risk

Does your organization identify and appropriately manage vendors and other third parties that create, receive, maintain, transmit, or otherwise have access to ePHI?

Consider EHR providers, IT and cybersecurity providers, cloud and hosting services, backup providers, billing companies, consultants, support vendors, and other organizations that may handle or have access to ePHI. A vendor does not necessarily need to store patient information to potentially qualify as a Business Associate.

Yes — relevant third parties are identified, appropriate BAAs are maintained, and responsibilities are periodically reviewed Current agreements and vendor-management records can be produced as evidence. Mostly — BAAs and vendor oversight are in place for most relevant third parties, with some gaps Partially — BAAs exist for obvious vendors, but identification or ongoing oversight is inconsistent Limited — some BAAs exist, but there is no defined process for identifying or reviewing Business Associates No / Not sure

Get Your Results

See your HIPAA readiness score.

Your results will include an overall readiness score, individual scores for each area, identified strengths, and areas that may require additional attention.