HIPAA Security Readiness Checklist
15 yes/no items a practice administrator can evaluate without technical help. Each item maps to a specific HIPAA Security Rule standard.
Free download. Enter your name and email below — the checklist is emailed to you immediately.
What the checklist covers
- 1Written Security Risk Analysis (SRA)
- 2SRA reviewed in the last 12 months or after a significant change
- 3Written security policies and procedures
- 4Annual HIPAA security training for all staff with access to patient records
- 5Written sanction policy for security violations
- 6Unique username and password for every person who accesses ePHI
- 7Access limited to the minimum necessary for each staff role
- 8Automatic logoff on workstations and EHR sessions
- 9Multi-factor authentication for remote access
- 10Encryption on laptops, mobile devices, and USB drives containing ePHI
- 11Business Associate Agreement with your EHR vendor
- 12Business Associate Agreement with your IT company or MSP
- 13Regular backups of ePHI, tested for restore capability
- 14Backups stored offsite or in a separate location from primary systems
- 15Written incident response procedure
Each item includes one sentence on what it means and which HIPAA Security Rule standard it maps to (45 CFR §164.xxx). Most practice administrators can complete the checklist in 20–30 minutes.
Not ready for the checklist yet?
Start with the free security review call — a 30-minute conversation about your practice's current setup, no checklist required.
Get the checklist
Free. No obligation. Emailed immediately.