HIPAA Security Assessment

These questions are about your practice's safeguards — never about your patients. Answer what you know. Anything left as Not sure is excluded from the score rather than counted against you, and the report says which areas that applies to.

Risk analysis and management
Does your practice have a written security risk analysis?

A document that lists where patient information lives, what could go wrong, and how likely each risk is. HIPAA requires one in writing; a conversation that was never written down does not count. Answer Partly if one was started but not finished.

Vendors and agreements
Do you hold a signed business associate agreement with each outside company that handles patient information?

A BAA is the contract HIPAA requires before a vendor may handle patient information on your behalf. Signed and findable — a vendor who "definitely has one somewhere" is a Partly.

People and training
Does everyone who works with patient information get security training?

Everyone — front desk, clinical, billing, part-time. Partly if some roles are covered and others are not.

Systems and access
Do the systems holding patient records ask for a second step at sign-in?

A code, an app prompt or a key — anything beyond a password, especially for anything reachable from home. Partly if some systems have it and others do not.

Backup and incident response
When did somebody last restore something from your backup to prove it worked?

A backup nobody has ever restored from is a plan rather than a capability — and HIPAA expects the capability.

About your practice

Everyone who uses a computer there — an approximate number is fine.

How we handle your data.