Page 1 of 4

HIPAA Compliance Self-Assessment Checklist🛡

Use this self-assessment guide to evaluate your HIPAA compliance readiness

Answer the questions below to gain insight into how well your current privacy and security practices align with HIPAA requirements, and to identify areas that may require additional effort or improvement. Each question includes examples and explanations to help you make an informed choice

⚠️ Note: This guide is designed to provide a general overview of your HIPAA preparedness and is not intended to replace a professional compliance audit ⚠️

✅ SECTION 0: ORGANIZATION OVERVIEW

What industry do you operate in?

E.g. Medical Biotech, Telemedicine & Digital Health, Consumer-Oriented Digital Health, Health Insurers & Patient Data Platforms, Healthcare IT & Infrastructure, Medical Devices & Digital Therapeutics

What is your company’s current size?

What are your primary geographic target markets?

💡 HIPAA compliance is legally required if your organization handles protected health information (PHI) of U.S. patients; for companies operating outside the U.S., compliance may still be critical for securing partnerships, contracts, and trust within the U.S. healthcare market.

What are your primary geographic target markets?

Does your product/service diagnose, treat, monitor, or influence clinical decision-making?

💡 If your product influences clinical decisions, it may be classified as a medical device under FDA or MDR regulations — triggering stricter HIPAA, security, and regulatory requirements.

✅ SECTION 1: HIPAA GENERAL APPLICABILITY

1. Does your organization create, receive, store, or transmit Protected Health Information (PHI or ePHI)?

E.g. you process patient data, lab results, appointment schedules, or health insurance information.

1. Does your organization create, receive, store, or transmit Protected Health Information (PHI or ePHI)?

✅ Yes - We store or process identifiable health info (e.g. test results, medical records)

⚠️ Possibly – We collect user health data (e.g. fitness metrics), but not sure if it’s “PHI”

❌ No – We don’t collect or interact with health-related personal data

2. What best describes your organization’s relationship to PHI?

You may be a medical provider, a software vendor for hospitals, or a cloud storage provider.

2. What best describes your organization’s relationship to PHI?

✅ Covered Entity “CE” (e.g. healthcare provider, insurer, pharmacy)

✅ Business Associate “BA” (e.g. SaaS vendor, IT support, analytics firm handling PHI)

⚠️ Not sure – Still determining classification

💡 Under HIPAA, if your organisation handles identifiable health information and operates as a Covered Entity or Business Associate, you are subject to the full scope of the Privacy, Security, and Breach Notification Rules. Compliance efforts must be fully established, documented, and maintained.

Not sure whether the data you collect qualifies as PHI? Contact Sekurno for expert guidance. Our team can help you assess your compliance obligations accurately and ensure you're aligned with current HIPAA standards.💡

🔐 SECTION 2: PRIVACY RULE COMPLIANCE

3. Do you have clear, written privacy policies that govern how you use and share PHI?

Your policies explain what data you collect from patients and how it's used internally or shared with third parties.

3. Do you have clear, written privacy policies that govern how you use and share PHI?

✅ Yes – Fully documented and accessible to staff

⚠️ Partially – We have internal practices but no formal documentation

❌ No – We haven’t defined any privacy rules yet

4. Have you officially designated a Privacy Officer?

Example: Someone responsible for managing privacy policies, staff training, and patient rights requests.

4. Have you officially designated a Privacy Officer?

✅ Yes – We have a named officer with assigned responsibilities

⚠️ Unofficial – A manager handles this, but it’s not their formal role

❌ No – No one is officially managing privacy

5. How does your organization address the requirement to inform individuals about privacy practices?

Example: A webpage or PDF outlining your data use, user rights, and how to contact you.

5. How does your organization address the requirement to inform individuals about privacy practices?

✅ We are a CE and provide a Notice of Privacy Practices (NPP) to patients/users

✅ We are a BA and follow privacy practices as outlined in our BAAs

⚠️ Not clearly addressed yet

❌ We do not have any privacy notice or documentation process

🧩 SECTION 3: SECURITY RULE COMPLIANCE

6. Have you conducted a formal Risk Assessment for systems handling ePHI?

Example: You’ve identified and documented risks to servers storing patient data, mobile devices, and third-party tools.

6. Have you conducted a formal Risk Assessment for systems handling ePHI?

✅ Yes – We’ve assessed and documented threats and responses

⚠️ Somewhat – Risks are known but not formally recorded

❌ No – We haven’t done this yet

7. Have you assigned a Security Officer to oversee technical safeguards?

Example: This person manages cybersecurity, access controls, and works with IT to mitigate threats.

7. Have you assigned a Security Officer to oversee technical safeguards?

✅ Yes – We’ve officially designated someone

⚠️ Sort of – IT or DevOps handles it, but informally

❌ No – Nobody is responsible for this

8. Are your systems protected with access control and authentication protocols?

Example: Logins require usernames and passwords, possibly with MFA, and access is limited by role.

8. Are your systems protected with access control and authentication protocols?

✅ Yes – Role-based access, strong password policy, and MFA

⚠️ Basic – Only password protection, some shared accounts

❌ No – Anyone with a device can access PHI

9. Do you monitor and log access to PHI systems?

Example: You can track who accessed what data, when, and from where—and investigate if needed.

9. Do you monitor and log access to PHI systems?

✅ Yes – We log, store, and review activity

⚠️ Some logging is enabled, but we don’t review it

❌ No – We don’t track access

10. Have you implemented secure software development practices (SSDLC)?

Example: Code is reviewed for vulnerabilities, and apps are tested before deployment.

10. Have you implemented secure software development practices (SSDLC)?

✅ Yes – DevSecOps is built into our CI/CD pipeline

⚠️ Basic – We perform manual checks only

❌ No – No formal security in development

🛠 SECTION 4: TECHNICAL & PHYSICAL SAFEGUARDS

11. Do you encrypt PHI data both at rest and in transit?

Example: Stored data is encrypted using AES-256, and TLS is used for data transmission.

11. Do you encrypt PHI data both at rest and in transit?

✅ Yes – End-to-end encryption in place

⚠️ Some data is encrypted, some is not

❌ No – Data is stored/transmitted in plaintext

12. Are your endpoints protected (e.g., antivirus, firewalls, remote wipe)?

Example: Workstations and mobile devices used to access ePHI are secured.

12. Are your endpoints protected (e.g., antivirus, firewalls, remote wipe)?

✅ Yes – Up-to-date antivirus, firewalls, and policies for lost/stolen devices

⚠️ Some coverage, but not consistently applied

❌ No – Devices are not protecte

13. Do you have backups and disaster recovery plans for ePHI?

Example: Nightly backups of cloud systems and an off-site recovery plan

13. Do you have backups and disaster recovery plans for ePHI?

✅ Yes – Automated, tested, and documented

⚠️ Backups exist, but recovery plan is unclear

❌ No – No backups or recovery plans

14. Have you conducted penetration testing or security scans?

Example: An external vendor tested your systems for vulnerabilities

14. Have you conducted penetration testing or security scans?

✅ Yes – At least annually

⚠️ Occasionally or only internally

❌ No – Never tested

👩‍💼 SECTION 5: WORKFORCE TRAINING & MANAGEMENT

15. Do you train all employees on HIPAA privacy and security policies?

Example: New hires go through privacy training, and current staff are updated annually.

15. Do you train all employees on HIPAA privacy and security policies?

✅ Yes – Training is mandatory and tracked

⚠️ Some training exists, but not consistent

❌ No – Employees are not trained on HIPAA

16. Do you have any measures or policies in place for handling employee violations of HIPAA?

Example: Violations like sharing credentials or accessing patient data without reason are disciplined.

16. Do you have any measures or policies in place for handling employee violations of HIPAA?

✅ Yes – Measures are clearly defined (in policy, NDA, or other internal documents) and enforced

⚠️ We handle incidents case-by-case, informally

❌ No – There is no disciplinary process

⚠️ SECTION 6: BREACH NOTIFICATION

17. How does your organization handle breach notification?

Example: A written procedure for what to do if PHI is leaked or stolen

17. How does your organization handle breach notification?

✅ We are a CE and notify affected individuals, HHS, and others as required

✅ We are a BA and notify Covered Entities as defined in our BAAs

⚠️ Informal awareness only, process not fully documented

❌ No defined breach response process

18. Do you track and document all security incidents and breaches?

Example: You log and store all suspected and confirmed security events

18. Do you track and document all security incidents and breaches?

✅ Yes – All incidents are recorded

⚠️ We’ve tracked major incidents only

❌ No – We do not maintain incident record

📄 SECTION 7: BUSINESS ASSOCIATES & VENDORS

19. What agreements do you have with vendors or partners who handle PHI?

Example: You use a cloud platform or analytics tool that accesses PHI

19. What agreements do you have with vendors or partners who handle PHI?

✅ As a CE, we have signed BAAs with all relevant vendors

✅ As a BA, we have signed BAAs with all subcontractors handling PHI

⚠️ Some agreements in place, but not complete

❌ No BAAs currently in place

20. Do you review vendor security policies and compliance status?

Example: You review their data handling, encryption, and incident response processes

20. Do you review vendor security policies and compliance status?

✅ Yes – Part of our vendor onboarding checklist

⚠️ Occasionally – no standard procedure

❌ No – We haven’t assessed vendor risk

📁 SECTION 8: DOCUMENTATION & AUDITS

21. Do you maintain HIPAA-related documentation for at least 6 years?

Example: Policy changes, risk assessments, training logs, incident reports

21. Do you maintain HIPAA-related documentation for at least 6 years?

✅ Yes – Securely stored and easily retrievable

⚠️ Partial documentation exists

❌ No – Records not maintained

22. Have you ever undergone a third-party HIPAA audit or readiness assessment?

Example: A certified firm reviewed your HIPAA posture and provided a gap analysis

22. Have you ever undergone a third-party HIPAA audit or readiness assessment?

✅ Yes – Recently completed

⚠️ Long ago – may be outdated

❌ No – Never audited

📋 SECTION 9: POLICIES & DOCUMENTATION INVENTORY

Which of the following HIPAA-required or best-practice policies does your organization already have?

Please check all that apply. This helps identify your current documentation maturity and the effort needed to become fully compliant.

23. Notice of Privacy Practices (NPP)

User-facing document informing individuals about their rights and your data use practices (required for Covered Entities).

Results from penetration tests, vulnerability scans, or SAST/DAST audits

45. Security Testing Reports

✅ Yes

❌ No