Free Tool

HIPAA Security Risk Quick Check
For Medical and Dental Practices

Answer 21 questions drawn from the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and see where your practice stands on administrative, physical, and technical safeguards.

Start the Tool All Free Tools

What This Quick Check Covers

The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) with administrative, physical, and technical safeguards. These questions follow the safeguards in Title 45 of the Code of Federal Regulations (CFR), sections 164.308, 164.310, and 164.312, plus the business associate agreement requirements in 164.314.

The most important item is the first one. The Security Rule requires an accurate and thorough risk analysis, and the U.S. Department of Health and Human Services (HHS) treats it as the foundation for every other safeguard decision. Without a current risk analysis, this check will not rate your practice higher than Developing.

This is a quick check, not a risk analysis. Your answers stay in your browser unless you choose the optional follow-up.

Administrative safeguards
1 Have you completed an accurate and thorough risk analysis of the risks to the electronic protected health information (ePHI) your practice creates, receives, maintains, or transmits, and is it current? 45 CFR 164.308(a)(1)(ii)(A)
2 Do you have a written plan that puts security measures in place to reduce the risks your risk analysis found? 45 CFR 164.308(a)(1)(ii)(B)
3 Do you have a written sanction policy for workforce members who do not follow your security policies? 45 CFR 164.308(a)(1)(ii)(C)
4 Does someone regularly review records of system activity, such as audit logs, access reports, and security incident reports? 45 CFR 164.308(a)(1)(ii)(D)
5 Have you named one person as the security official responsible for your security policies and procedures? 45 CFR 164.308(a)(2)
6 Do you grant access to ePHI only after approval, and remove access promptly when a workforce member leaves or changes roles? 45 CFR 164.308(a)(3) and (a)(4)
7 Does every workforce member receive security awareness training, including how to spot phishing, with records kept? 45 CFR 164.308(a)(5)
8 Do you have written procedures to identify, respond to, and document security incidents? 45 CFR 164.308(a)(6)
9 Do you back up ePHI on a schedule and test that you can restore it? 45 CFR 164.308(a)(7)(ii)(A)
10 Do you have a written plan to restore data and keep critical operations running during an emergency, such as ransomware or a system outage? 45 CFR 164.308(a)(7)(ii)(B) and (C)
11 Do you periodically evaluate your security policies and procedures, especially after changes to your systems or operations? 45 CFR 164.308(a)(8)
Business associates
12 Do you have a signed business associate agreement with every vendor that creates, receives, maintains, or transmits ePHI for you, such as your electronic health record, billing, information technology, and email providers? 45 CFR 164.308(b) and 164.314(a)
Physical safeguards
13 Is physical access to areas with systems that store ePHI limited to authorized people? 45 CFR 164.310(a)
14 Are workstations positioned and secured so that unauthorized people cannot view or use them, and are they locked when unattended? 45 CFR 164.310(b) and (c)
15 Do you keep track of devices and media that hold ePHI, and wipe or destroy them before disposal or reuse? 45 CFR 164.310(d)
Technical safeguards
16 Does every person who uses your systems have a unique user identification (ID), with no shared logins? 45 CFR 164.312(a)(2)(i)
17 Do systems with ePHI log users off or lock automatically after a period of inactivity? 45 CFR 164.312(a)(2)(iii)
18 Is ePHI encrypted on laptops, phones, and other portable devices? 45 CFR 164.312(a)(2)(iv)
19 Do your systems record who accessed or changed ePHI? 45 CFR 164.312(b)
20 Do you verify that people are who they say they are before they access ePHI, using strong passwords and multifactor authentication for email and remote access? 45 CFR 164.312(d)
21 Is ePHI encrypted when it is sent over the internet or by email? 45 CFR 164.312(e)
Optional

Want a Detailed Follow-Up?

Your results above are yours to keep with no sign-up. If you would like Thabiti to review them and send recommended next steps, add your contact details. Your results are included automatically.

Your contact

Submitting sends your contact details and results to thabiti@adamscloudcyber.com over an encrypted connection. We never sell or share your information.

Sources

More Free Tools

Want a Second Set of Eyes?

We perform full HIPAA Security Rule risk analyses for small practices and turn the findings into a prioritized plan your staff can follow. See our HIPAA assessment page.

Book a Free Consultation Call (619) 289-8064