Free framework self-check
HIPAA Security Rule Self-Check
If your organization handles electronic protected health information (ePHI), a general security checklist may miss important responsibilities. This free self-check asks ten questions about risk analysis, safeguards and business associates. It helps covered entities and business associates organize possible gaps before a professional compliance assessment. Do not enter patient information or upload records to this tool.
- The risk
- The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
How the self-check works
- You give a first name, company and work email. Your session is stored and a resume link is sent by email.
- An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
- You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
- Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.
The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.
Who it is for
Covered entities and business associates that store, process or transmit ePHI. Security officers, privacy teams, practice managers and IT leads can use it to identify questions that need an owner. The Security Rule concerns electronic information; the Privacy and Breach Notification Rules have related but distinct requirements. This short conversation does not assess every HIPAA obligation.
Safeguards for electronic protected health information
The five themes covered
- Risk analysis and risk management
- Whether your organization understands where ePHI is held and the threats to it. Consider the breadth of the risk analysis, changes since it was completed and how identified risks are assigned, addressed and reviewed.
- Administrative safeguards and workforce training
- Who is responsible for security, what staff are taught and how policies are put into practice. Consider access responsibilities and incident reporting. Employees need to know what to do when an unfamiliar situation involves patient information.
- Technical safeguards, access and audit controls
- How systems limit access to ePHI and record relevant activity. Consider unique users, authentication, logging and protection during transmission. Ask whether those safeguards cover the applications and connections your organization actually uses.
- Physical safeguards and device management
- How facilities, workstations and devices are protected throughout their use. Think about remote access, lost equipment, storage media and disposal. A device inventory is more useful when it also identifies responsibility for safeguarding the information.
- Business associates and breach response
- Which suppliers handle ePHI and what arrangements govern that work. Consider required business associate agreements, incident escalation and breach-response responsibilities. Having a signed agreement does not replace the need to understand the supplier's access and services.
From self-check to assessment
A professional review can examine the risk analysis, safeguards and records supporting your security program. For example, a new scheduling application may handle ePHI but be absent from the risk analysis and supplier records. We help identify preparation needs and questions for your advisers. Before sharing any PHI for a separate engagement, confirm the required agreements and data-handling arrangements.
AuditPartners helps you prepare for a professional review. The self-check does not establish legal compliance or replace advice from your privacy, security or legal advisers.
The next step
Start the HIPAA self-check
Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.