HIPAA Readiness Quiz

Answer each question Yes, No, or Not sure. Scoring: Yes = 2, Not sure = 1, No = 0. Bands: 20-24 Documented, 12-19 Partial, 0-11 Exposed.

1. Does your practice have a named security official, one specific person responsible for HIPAA security? 2. Has your practice completed a documented security risk analysis in the last 12 months? 3. Do you have a current list of every system and device that stores or can access patient information? 4. Is multi-factor authentication turned on for remote access and for staff email? 5. Does every staff member have their own login, with no shared usernames or passwords? 6. Are the devices that hold patient information encrypted? 7. Have you tested restoring your backups in the last 12 months, not just confirmed they run? 8. Is HIPAA training for staff documented, with dates and signatures on file? 9. Do you hold a signed Business Associate Agreement from every vendor that can access patient information? 10. Does someone review system activity logs, and is that review written down anywhere? 11. Does your practice have a written plan for operating during an outage or a ransomware event? 12. When an employee leaves, is there a written checklist that removes their access the same day?