Have you completed a HIPAA Risk Assessment in the last 12 months? *

Yes

No

Do you have a documented Risk Management Plan that addresses identified risks? *

Yes

No

Have all of your employees been trained on HIPAA within the past 12 months? *

Yes

No

Do you restrict ePHI access based on employee roles? *

Yes

No

Do you maintain audit logs for systems containing ePHI? *

Yes

No

Is there a documented contingency plan for emergency access, backup, and disaster recovery? *

Yes

No

Do you have signed Business Associate Agreements (BAAs) with all third-party vendors? *

Yes

No

Are devices that store or access ePHI encrypted and remotely wipeable? *

Yes

No

Do you securely destroy physical records and electronic media when no longer needed? *

Yes

No

Is access to physical systems (e.g., servers, paper records) restricted and monitored? *

Yes

No