The Health Insurance Portability and Accountability Act (HIPAA) Security Rule sets the safeguards that covered entities and business associates must apply to electronic protected health information (ePHI): the patient records, images, schedules, and billing data on your computers, phones, and cloud services. For a small medical or dental practice without security staff, the hard part is knowing where to start. Our free HIPAA Security Risk Quick Check asks 21 questions drawn from the Security Rule and returns a readiness level and a list of gaps.
Start with the risk analysis
The quick check puts the risk analysis first for a reason. The Security Rule at Title 45 of the Code of Federal Regulations (CFR), section 164.308(a)(1)(ii)(A), requires covered entities and business associates to "Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate." Every other safeguard decision builds on that analysis: which risks matter, which controls are reasonable for a practice your size, and what to fix first.
Step by step
Step 1. Pick the right people to answer. In a small practice that is often the office manager together with whoever handles your computers, whether on staff or an outside provider. Answer for the whole practice, including laptops and phones that leave the building.
Step 2. Answer each question Yes, No, or Not sure. Each question names its source in the regulation, such as 45 CFR 164.312(d), so you can read the requirement itself. Not sure counts as a gap, and that is deliberate. If no one can confirm a safeguard is in place, treat it as open until someone checks. Your answers stay in your browser unless you choose the optional follow-up.
Step 3. Work through the four groups.
- Administrative safeguards, questions 1 to 11: the risk analysis and a written plan to reduce the risks it found, a sanction policy, review of system activity records, a named security official, access approval and prompt removal, training that covers phishing, incident procedures, tested backups, an emergency plan for events such as ransomware, and periodic evaluation.
- Business associates, question 12: a signed business associate agreement with every vendor that handles ePHI for you, such as your electronic health record, billing, information technology, and email providers.
- Physical safeguards, questions 13 to 15: limited access to areas with systems that store ePHI, workstations that unauthorized people cannot view or use, and tracking and wiping of devices and media.
- Technical safeguards, questions 16 to 21: a unique user identification (ID) for every person, automatic logoff or lock, encryption on portable devices, records of who accessed or changed ePHI, strong passwords with multifactor authentication for email and remote access, and encryption in transit. These map to 45 CFR 164.312.
What your readiness level means
The result counts your Yes answers out of 21. Eighteen or more is Strong foundation. Eleven to seventeen is Developing. Ten or fewer is At risk. One rule overrides the count: if question 1, the risk analysis, is not a Yes, the result cannot rise above Developing, because the Security Rule requires a current risk analysis.
The Gaps to address list shows every No and every Not sure, with the Not sure items marked. That list is your working list. A Strong foundation result is not a certificate of compliance. It means the basic safeguards are in place based on your answers. An At risk result means several basic safeguards are missing or unconfirmed.
What the quick check is not
It is a quick check, not a risk analysis. A risk analysis inventories where ePHI lives, identifies the threats and vulnerabilities for each location, rates likelihood and impact, and documents the result. The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-66 Revision 2 is a practical guide to doing that work under the Security Rule.
Next steps
If question 1 was not a Yes, start there and complete or update the risk analysis. Then turn the gap list into a risk management plan with an owner and a date for each item, which is what question 2 asks about. Close the quick fixes early, such as automatic screen locks, unique logins, and multifactor authentication on email. Confirm a signed business associate agreement with every vendor that touches ePHI.
Keep a Portable Document Format (PDF) copy of your result with the Print or Save as PDF button, and run the HIPAA Security Risk Quick Check again after each round of fixes so you can show progress over time.
Related reading: Your HIPAA Risk Analysis Was Never the Finish Line, The Business Associate Agreement You Signed and Never Read, and A Practical HIPAA Security Guide for Small Medical and Dental Offices. For a full risk analysis, see our HIPAA assessment page.
Sources
- 45 CFR 164.308, Administrative safeguards - Electronic Code of Federal Regulations
- 45 CFR 164.312, Technical safeguards - Electronic Code of Federal Regulations
- NIST SP 800-66 Revision 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide - National Institute of Standards and Technology
Need a risk analysis for your practice?
Adams Cloud & Cybersecurity performs HIPAA Security Rule risk analyses for small medical and dental practices and turns the findings into a prioritized plan your staff can follow.
Contact Adams Cloud