HIPAA Readiness Self-Check
Ten questions for practice managers and owners. You get an immediate risk indicator and a plain-English explanation of the gaps most likely to cause trouble in an OCR investigation or a ransomware incident.
What the self-check covers
The questions follow the HIPAA Security Rule safeguards that small and mid-size practices in Atascocita, Humble, Kingwood and the rest of Northeast Houston most often get wrong. Higher-weight items count for more in the score, and a gap in the risk analysis, vendor agreements or device encryption always keeps the result above Low.
- 1.
Security risk analysis
A written review of where ePHI lives, the threats to it, and what you are doing about them — not just a checklist.
- 2.
Business Associate Agreements
Think EHR, cloud backup, email, billing, IT support, telehealth and answering services.
- 3.
Device encryption
For example BitLocker on Windows or FileVault on Mac — including the front desk and any laptop that leaves the building.
- 4.
Unique logins and MFA
Shared front-desk or "office" accounts count as a no.
- 5.
Audit logging
HIPAA expects activity in systems holding ePHI to be logged and reviewed, not just collected.
- 6.
Staff training cadence
Including phishing awareness, with completion records you could produce.
- 7.
Backups and recovery
A backup that ransomware can reach, or that nobody has restored from, may not be there when you need it.
- 8.
Patching
Including imaging PCs, servers and any older machine that "has to" stay on an old version.
- 9.
Incident response plan
Who to call, what to shut off, and how the notification deadlines are met.
- 10.
Access removal
EHR, email, remote access, shared drives and any vendor portals.