Checklist · HIPAA · Security Rule

HIPAA Security Rule Readiness Self-Assessment

Check an item only if you could show the evidence tomorrow. Measured against the current rule, with what the proposal would add.

By Lincoln Square Law · 7-minute read

🖨 Print this checklist

This self-assessment measures a practice or business associate against the HIPAA Security Rule as it stands today, at 45 C.F.R. 164.302 through 164.318. The proposed overhaul published in January 2025 has not been finalized, and the current rule governs every investigation. Mark an item complete only if you could hand an investigator the evidence tomorrow. A control that exists but cannot be shown is, for enforcement purposes, a control that does not exist. Business associates can use the same assessment, because the Security Rule applies to them directly.

Governance and documentation

• Security official named in writing.
• Written, dated, reviewed policies that describe actual practice.
• Documentation retained for six years.
• Workforce sanctions policy.

Risk analysis and management

• Inventory of systems, devices, apps, and vendors with ePHI.
• Current risk analysis covering all ePHI.
• Risk management plan with owners and dates.
• Written decision for each addressable specification.

Access and technical safeguards

• Unique user IDs, with access matched to each role.
• Access removed on departure, and checked.
• MFA for remote access, email, and admin accounts.
• Encryption of laptops, mobiles, media, and transmissions.
• Audit logs enabled and reviewed.

Vendors

• List of every business associate with ePHI.
• Signed business associate agreement for each.
• Each vendor’s security information on file.

Incidents and continuity

• Incident procedure with a named owner.
• Breach assessment and notification process.
• Backup restored and tested against a time target.

Workforce and physical safeguards

• Training for the whole workforce, with records.
• Retired devices and media wiped or destroyed, with a record.

How to use this assessment

Work through each item with the person who actually runs the system in question, not only the person responsible for compliance. For each item, record one of three answers: in place with evidence, partly in place, or not in place. Write down where the evidence lives, such as a file path, a vendor portal, or a binder, and who owns it. The result is a gap list you can turn into the risk management plan the rule requires.

Governance and documentation

The rule requires a designated security official (45 C.F.R. 164.308(a)(2)). Name that person in writing, with the authority to act. Policies and procedures must be written, available to the people who carry them out, reviewed periodically, and updated when changes affect the security of ePHI. Documentation must be kept for six years from the date it was created or last in effect (45 C.F.R. 164.316). A sanctions policy for workforce members who violate security policies is required (45 C.F.R. 164.308(a)(1)(ii)(C)). Check that each policy describes what the practice actually does, not what a template assumed.

Risk analysis and risk management

The risk analysis must be accurate and thorough and cover all ePHI the organization creates, receives, maintains, or transmits (45 C.F.R. 164.308(a)(1)(ii)(A)). That requires an inventory of systems, devices, applications, and vendors, and an understanding of how ePHI moves among them. The risk management plan must show the security measures chosen to reduce each identified risk to a reasonable and appropriate level, with owners and dates (45 C.F.R. 164.308(a)(1)(ii)(B)). For every addressable specification not implemented, confirm there is a written explanation and an equivalent alternative (45 C.F.R. 164.306(d)(3)). OCR’s current enforcement initiative centers on this item more than any other.

Access and technical safeguards

Each user needs a unique identifier, and access should match each role (45 C.F.R. 164.312(a), 164.308(a)(4)). Confirm that access is removed promptly when someone leaves, and that someone checks. Multi-factor authentication for remote access, email, and administrator accounts supports the authentication standard (45 C.F.R. 164.312(d)). Encryption of laptops, mobile devices, and portable media, and of ePHI sent by email or file transfer, is addressable under the current rule, but ePHI encrypted in line with HHS guidance is not unsecured PHI for breach notification (45 C.F.R. 164.402). Audit logs must exist and someone must review them (45 C.F.R. 164.312(b), 164.308(a)(1)(ii)(D)).

Vendors and business associate agreements

List every vendor that creates, receives, maintains, or transmits ePHI, and confirm a signed business associate agreement for each (45 C.F.R. 164.308(b), 164.314(a)). Business associates are directly subject to the Security Rule and must obtain assurances from their own subcontractors. Record what each vendor does with ePHI and what it has told you about its safeguards.

Incidents, backups, and contingency planning

Written incident procedures must cover how incidents are identified, reported, contained, and documented (45 C.F.R. 164.308(a)(6)). Tie them to the breach notification rule, so that the four-factor risk assessment and the sixty-day notification clock are handled by a named person (45 C.F.R. 164.402, 164.404). The contingency plan must include data backup, disaster recovery, and emergency mode operations, and procedures for testing and revising them (45 C.F.R. 164.308(a)(7)). A backup that has never been restored is an assumption, not a control.

Workforce and physical safeguards

Security awareness training must reach the whole workforce, including management, with records of who completed it and when (45 C.F.R. 164.308(a)(5)). Facility access, workstation security, and device and media disposal are physical safeguards (45 C.F.R. 164.310). Confirm that retired computers, copiers, and drives were wiped or destroyed, with a record.

Evidence to keep on file

For each item marked in place, keep something that proves it:

• Access and authentication. Screenshots or exports of multi-factor settings, and the list of active accounts compared with the staff roster.
• Encryption. A device management report showing encryption status for each laptop and phone.
• Vendors. The business associate list with signed agreements attached.
• Training. Completion logs with names and dates.
• Backups. A restore test log with the date, the system restored, and how long it took.
• Disposal. Certificates of destruction or wiping logs for retired equipment.

Ranking the gaps

Not every gap is equally urgent. Rank each one by how likely it is to be exploited and how much ePHI it exposes. An administrator account without multi-factor authentication, or an unencrypted laptop that travels, belongs at the top. A policy that needs rewording belongs lower. Record the ranking in the risk management plan, because the rule asks for measures sufficient to reduce risks to a reasonable and appropriate level, and the ranking shows how those judgments were made.

What the proposed rule would add

If the January 2025 proposal is finalized as written, several items above would become mandatory with limited exceptions, including encryption and multi-factor authentication. It would also add a written asset inventory and network map reviewed at least annually, vulnerability scanning every six months, annual penetration testing, a 72-hour restoration capability for certain systems, an annual compliance audit, and annual written verification from business associates. None of these is required by the current rule in that form, but each builds on work this checklist already asks for.

Repeat on a schedule

Run this assessment again whenever the environment changes, such as a new electronic health record, a new location, a move to cloud services, or the adoption of AI tools that process patient information, and at least once a year otherwise. The rule requires periodic evaluation in response to environmental or operational changes (45 C.F.R. 164.308(a)(8)). Comparing each year’s results with the last shows whether the program is improving, and gives an investigator a record of continuing attention.

After the assessment

Turn every gap into a line in the risk management plan, with an owner and a date. Address the largest risks first, which for most small practices means access removal, multi-factor authentication, device encryption, and a tested backup. Keep the completed assessment with the risk analysis, because together they show an investigator that the organization identified its risks and acted on them.