HIPAA and HITECHReadiness check

Have you completed an accurate and thorough security risk analysis of all systems that hold electronic protected health information (ePHI) in the last 12 months?

Do you have a documented risk management plan with owners and dates for fixing the risks you found?

Have you named a security official responsible for HIPAA security?

Do you have written HIPAA security policies and procedures that staff can follow?

Do you control workforce access to ePHI, including onboarding, role changes and termination?

Do all staff receive security awareness and HIPAA training, with records?

Do you have a sanctions policy for staff who violate security policies?

Do you review system activity, such as audit logs and access reports, regularly?

Do you have a security incident response procedure that staff know how to use?

Do you have a contingency plan covering data backup, disaster recovery and emergency mode operations, and have you tested it?

Do you re-evaluate your safeguards when your environment or operations change?

Do you have signed business associate agreements with every vendor that handles ePHI?

Do you limit physical access to facilities and equipment that hold ePHI, and keep records of repairs and changes?

Are workstations that access ePHI secured, with policies on their use and location?

Do you control the receipt, movement, reuse and disposal of devices and media that hold ePHI?

Does every user have a unique ID, and do you have emergency access procedures?

Do you use automatic logoff and strong authentication, including multi-factor where possible?

Do you record and examine activity in systems that hold ePHI?

Do you protect ePHI from improper alteration or destruction?

Is ePHI encrypted in transit and at rest?

Do you have a breach notification procedure covering affected individuals, HHS and, where required, the media, within the required deadlines?

Do you assess and document each security incident to decide whether it is a reportable breach?

Do you keep required HIPAA documentation for six years?