Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your enterprise have a system to automate detections of identity risk - such as over permission accounts? HIPPA Standard 164.308(a)(1)

Yes

Security Management Process: Implement policies and procedures to prevent, detect, contain, and correct security violations. This includes risk analysis, risk management, sanction policy, and information system activity review.

Is there an assigned resource to implement the policies of risk assessment? HIPPA Standard 164.308(a)(2)

Yes

Assigned Security Responsibility: Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the entity.

Does your organization have a policies and practices around allocating appropriate access to ePHI. HIPPA Standard 164.308(a)(3)

Yes

Workforce Security: Implement policies and procedures to ensure that all members of its workforce have appropriate access to ePHI, and to prevent those workforce members who do not have access from obtaining access to ePHI. This includes authorization/supervision, workforce clearance, and termination procedures.

Does you organization have quantified access request/approval for ePHI resources? HIPPA Standard 164.308(a)(4)

Yes

YouAttest enables managers to run scheduled campaigns to certify, delegate, or revoke access to sensitive resources (e.g., ePHI databases). AI-driven scoring flags high-risk accounts for prioritized review.

Security Incident Procedures: Implement policies and procedures to address security incidents, including response and reporting. HIPPA Standard 164.308(a)(6)

Yes

YouAttest uses identity triggers to notify managers of changes in entitlements, allowing quick incident response (e.g., attestation or revocation). Audit logs provide evidence for reporting.

Does your enterprise have automated methods to review access in disaster recovery/ emergency mode operations? HIPPA Standard 164.308(a)(7)

Yes

Contingency Plan: Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI. This includes data backup, disaster recovery, emergency mode operation, testing/revision, and applications/data criticality analysis.

Does your enterprise does period evaluations of key resources for security controls around the ePHI resources - including who has access? HIPPA Standard 164.308(a)(8)

Yes

Evaluation: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of ePHI, that establishes the extent to which an entity's security policies and procedures meet the requirements of this subpart.

Does your enterprise have the ability to review access by by group/role to physical access to ePHI resource? HIPPA Standard 164.310(a)

Yes

Facility Access Controls: Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. This includes contingency operations, facility security plan, access control/validation, and maintenance records.

Does your organization ensure that individual access is granted to users of ePHI for both allocation, review and revocation. HIPPA Standard 164.312(a)

Yes

Access Control: Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs that have been granted access rights. This includes unique user identification, emergency access procedure, automatic logoff, and encryption/decryption.

Does your organization have an establish and repeated method to accertain access to ePHI and create the reprorts for compliance and security? HIPPA Standard 164.312(b)

Yes

Audit Controls: Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)