Compliancemanzill.com
HIPAA/HITECH

Compliance assessment

HIPAA/HITECH

73 controls in 7 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at 45 C.F.R. 164.308(a)(1)(i)

Administrative Safeguards31

45 C.F.R. 164.308(a)(1)(i)Standard: Security management processNot assessed45 C.F.R. 164.308(a)(1)(ii)(A)Risk analysis (Required)Not assessed45 C.F.R. 164.308(a)(1)(ii)(B)Risk management (Required)Not assessed45 C.F.R. 164.308(a)(1)(ii)(C)Sanction policy (Required)Not assessed45 C.F.R. 164.308(a)(1)(ii)(D)Information system activity review (Required)Not assessed45 C.F.R. 164.308(a)(2)Standard: Assigned security responsibilityNot assessed45 C.F.R. 164.308(a)(3)(i)Standard: Workforce securityNot assessed45 C.F.R. 164.308(a)(3)(ii)(A)Authorization and/or supervision (Addressable)Not assessed45 C.F.R. 164.308(a)(3)(ii)(B)Workforce clearance procedure (Addressable)Not assessed45 C.F.R. 164.308(a)(3)(ii)(C)Termination procedures (Addressable)Not assessed45 C.F.R. 164.308(a)(4)(i)Standard: Information access managementNot assessed45 C.F.R. 164.308(a)(4)(ii)(A)Isolating health care clearinghouse functions (Required)Not assessed45 C.F.R. 164.308(a)(4)(ii)(B)Access authorization (Addressable)Not assessed45 C.F.R. 164.308(a)(4)(ii)(C)Access establishment and modification (Addressable)Not assessed45 C.F.R. 164.308(a)(5)(i)Standard: Security awareness and trainingNot assessed45 C.F.R. 164.308(a)(5)(ii)(A)Security reminders (Addressable)Not assessed45 C.F.R. 164.308(a)(5)(ii)(B)Protection from malicious software (Addressable)Not assessed45 C.F.R. 164.308(a)(5)(ii)(C)Log-in monitoring (Addressable)Not assessed45 C.F.R. 164.308(a)(5)(ii)(D)Password management (Addressable)Not assessed45 C.F.R. 164.308(a)(6)(i)Standard: Security incident proceduresNot assessed45 C.F.R. 164.308(a)(6)(ii)Implementation specification: Response and reporting (Required)Not assessed45 C.F.R. 164.308(a)(7)(i)Standard: Contingency planNot assessed45 C.F.R. 164.308(a)(7)(ii)(A)Data backup plan (Required)Not assessed45 C.F.R. 164.308(a)(7)(ii)(B)Disaster recovery plan(Required).Not assessed45 C.F.R. 164.308(a)(7)(ii)(C)Emergency mode operation plan (Required)Not assessed45 C.F.R. 164.308(a)(7)(ii)(D)Testing and revision procedures (Addressable)Not assessed45 C.F.R. 164.308(a)(7)(ii)(E)Applications and data criticality analysis (Addressable)Not assessed45 C.F.R. 164.308(a)(8)Standard: EvaluationNot assessed45 C.F.R. 164.308(b)(1)Business associate contracts and other arrangementsNot assessed45 C.F.R. 164.308(b)(2)Business associate contracts and other arrangementsNot assessed45 C.F.R. 164.308(b)(3)Implementation specifications: Written contract or other arrangement (Required)Not assessed

Physical Safeguards12

45 C.F.R. 164.310(a)(1)Standard: Facility access controlsNot assessed45 C.F.R. 164.310(a)(2)(i)Contingency operations (Addressable)Not assessed45 C.F.R. 164.310(a)(2)(ii)Facility security plan (Addressable)Not assessed45 C.F.R. 164.310(a)(2)(iii)Access control and validation procedures (Addressable).Not assessed45 C.F.R. 164.310(a)(2)(iv)Maintenance records (Addressable)Not assessed45 C.F.R. 164.310(b)Standard: Workstation useNot assessed45 C.F.R. 164.310(c)Standard: Workstation securityNot assessed45 C.F.R. 164.310(d)(1)Standard: Device and media controlsNot assessed45 C.F.R. 164.310(d)(2)(i)Disposal (Required)Not assessed45 C.F.R. 164.310(d)(2)(ii)Media re-use (Required)Not assessed45 C.F.R. 164.310(d)(2)(iii)Accountability (Addressable)Not assessed45 C.F.R. 164.310(d)(2)(iv)Data backup and storage (Addressable)Not assessed

Technical Safeguards12

45 C.F.R. 164.312(a)(1)Standard: Access controlNot assessed45 C.F.R. 164.312(a)(2)(i)Unique user identification (Required)Not assessed45 C.F.R. 164.312(a)(2)(ii)Emergency access procedure (Required)Not assessed45 C.F.R. 164.312(a)(2)(iii)Automatic logoff (Addressable)Not assessed45 C.F.R. 164.312(a)(2)(iv)Encryption and decryption (Addressable)Not assessed45 C.F.R. 164.312(b)Standard: Audit controlsNot assessed45 C.F.R. 164.312(c)(1)Standard: IntegrityNot assessed46 C.F.R. 164.312(c)(2)Implementation specification: Mechanism to authenticate electronic protected health information (Addressable).Not assessed45 C.F.R. 164.312(d)Standard: Person or entity authenticationNot assessed45 C.F.R. 164.312(e)(1)Standard: Transmission securityNot assessed45 C.F.R. 164.312(e)(2)(i)Integrity controls (Addressable)Not assessed45 C.F.R. 164.312(e)(2)(ii)Encryption (Addressable)Not assessed

Organizational Requirements3

45 C.F.R. 164.314(a)(1)Standard: Business associate contracts or other arrangementsNot assessed45 C.F.R. 164.314(a)(2)(i)Business associate contractsNot assessed45 C.F.R. 164.314(a)(2)(ii)Other arrangementsNot assessed

Policies and Procedures and Documentation Requirements6

45 C.F.R. 164.316(a)Standard: Policies and ProceduresNot assessed45 C.F.R. 164.316(b)(1)(i)Standard: DocumentationNot assessed45 C.F.R. 164.316(b)(1)(ii)Standard: DocumentationNot assessed45 C.F.R. 164.316(b)(2)(i)Time Limit (Required)Not assessed45 C.F.R. 164.316(b)(2)(ii)Availability (Required)Not assessed45 C.F.R. 164.316(b)(2)(iii)Updates (Required)Not assessed

Uses and Disclosures of Protected Health Information: General rules6

45 C.F.R. 164.502(a)(3)Business associates: Permitted uses and disclosuresNot assessed45 C.F.R. 164.502(a)(4)Business associates: Required uses and disclosuresNot assessed45 C.F.R. 164.502(a)(5)Prohibited uses and disclosuresNot assessed45 C.F.R. 164.502(b)Standard: Minimum necessaryNot assessed45 C.F.R. 164.502(d)Standard: Uses and disclosures of de-identified protected health informationNot assessed45 C.F.R. 164.502(e)(1)Standard: Disclosures to business associatesNot assessed

Uses and Disclosures: Organizational Requirements3

45 C.F.R. 164.504(e)(1)(iii)Standard: Business associate contractsNot assessed45 C.F.R. 164.504(e)(2)(ii)Implementation specifications: Business associate contractsNot assessed45 C.F.R. 164.504(e)(5)Implementation specifications: Business associate contracts with subcontractorsNot assessed