How often does your organization conduct a comprehensive HIPAA-mandated risk analysis?
A. At least once a year and whenever there is a significant change to our systems.
B. Only when required (e.g., by a new business associate agreement) or rarely.
C. Never, or not sure what this is.
Administrative & Security Safeguards
Do you have multi-factor authentication (MFA) enabled for all critical systems that access ePHI?
A. Yes, organization-wide for all ePHI access points.
B. On some systems only, or for some employees.
C. No, or not sure what that is.
Administrative & Security Safeguards
How confident are you in your organization's compliance with the HIPAA Privacy and Security Rules?
A. Fully confident—we audit regularly and have a designated Privacy and Security Officer.
B. Somewhat confident—we have some policies but are not formally audited.
C. Not confident—unsure of what applies or what we are doing.
Administrative & Security Safeguards
If you had a data breach involving ePHI today, do you have a tested incident response and Breach Notification plan in place?
A. Yes—we have a documented plan and have tested it.
B. We have a plan, but it’s outdated or untested.
C. No, or not sure how we would respond.
Administrative & Security Safeguards
How do you protect your organization's devices (laptops, mobile phones, etc.) that access or store ePHI?
A. All devices are encrypted, and access is managed via strong controls.
B. Only some devices have encryption, or we have basic access controls.
C. Devices are not encrypted, and there are no specific policies.
Physical & Technical Safeguards
How are your software and hardware systems that handle ePHI updated or patched?
A. Regularly and systematically to address new vulnerabilities.
B. Occasionally, when a known issue arises.
C. Rarely or never.
Physical & Technical Safeguards
Do you have a documented data backup and recovery plan for all ePHI?
A. Yes, with regular backups that are tested and documented.
B. We have some backups, but they are not formally tested or documented.
C. No, or not sure if we have one.
Physical & Technical Safeguards
Does your organization have a designated HIPAA Privacy Officer and Security Officer?
A. Yes, we have a clear chain of command for HIPAA compliance.
B. We have a person responsible for some aspects, but not officially designated.
C. No, the responsibility is not assigned to a specific individual.
Workforce Security & Business Associates
Do employees receive training on HIPAA policies and cybersecurity best practices?
A. Yes—as part of onboarding and through ongoing, documented education.
B. Occasionally, or training is not required for all staff.
C. No, employees do not receive formal training.
Workforce Security & Business Associates
Do you have Business Associate Agreements (BAAs) in place with all vendors who handle PHI on your behalf?
A. Yes, all vendors who access PHI have a signed and reviewed BAA.
B. We have some BAAs, but not for all of our vendors.
C. No, we don't use BAAs or are not sure what they are.
Workforce Security & Business Associates
What is your name and email (so we can send you your results)?
First Name
Email
*