// Free HIPAA checklist
Free HIPAA compliance checklist
Seventeen questions on the HIPAA Security Rule's administrative, physical, and technical safeguards. About five minutes, with a scored report and suggested fixes sent by email.
HIPAA’s Security Rule asks every practice and business associate to protect patient information with three kinds of safeguards: administrative, physical, and technical. This checklist walks through the ones that matter most for a small organization.
What the checklist covers
- Administrative safeguards. A named Security Officer and Privacy Officer, a risk analysis in the last 12 months, staff training at hire and every year with sign-off, and same-day removal of accounts, keys, and email when someone leaves.
- Physical safeguards. Servers and network gear in a locked room or cabinet, and front-desk and clinical screens that patients can’t see.
- Technical safeguards. Unique logins, MFA on email, remote access, and patient-data apps, full-disk encryption, encryption in transit, managed endpoint protection, supported operating systems only, and backups that are encrypted, off-site, and test-restored.
- Policies, vendors, and BAAs. A signed business associate agreement with every vendor that touches patient data, and only HIPAA-eligible services.
- Breach and incident readiness. A written incident response plan, and a breach notification process your team understands, including the 60-day rule.
Where to look first
The risk analysis is the single most commonly missing piece, and it’s the document everything else hangs from. Close behind: unsigned BAAs with cloud vendors, and backups that have never been test-restored.
After the checklist
Your report shows your score and a suggested fix for every gap. If you’d like help, our compliance programs cover the technical safeguards, the documentation, and the evidence. Handling card payments as well? Take the PCI DSS checklist too.
This is a self-assessment based only on your answers. Logos Tech Systems doesn’t conduct or verify it, and doesn’t endorse the report unless we’ve reviewed it with you in a consultation. It isn’t legal advice.
// Questions
Common questions
Who has to follow HIPAA?
Covered entities, such as healthcare providers, health plans, and clearinghouses, and their business associates: any vendor that creates, receives, stores, or sends patient information on their behalf. That includes billing companies and IT providers.
Do we need a signed BAA with every vendor?
With every vendor that touches protected health information, yes. That usually includes email, cloud storage, backup, and practice management providers, and it means using their business tier that comes with a BAA.
How fast do we have to report a breach?
Affected individuals must be notified without unreasonable delay, and no later than 60 days after the breach is discovered. Breaches also have to be reported to HHS, and one affecting more than 500 residents of a state requires notifying the media as well.
// Next step
Need help with HIPAA safeguards?
We set up the technical safeguards, document them, and keep the evidence, so your next risk analysis or audit starts from facts.