HIPAA Risk Readiness Kit
For small healthcare practices: dental, medical, PT/OT, and behavioral health. The federal government's own assessment tool, the worksheet to complete before you open it, and a sample tracker that turns answers into finished work.
- 3 partsFederal tool, worksheet, tracker
- FreeThe federal tool costs nothing
- Stays localYour answers never leave your computer
Why this matters, and what this kit is not
HIPAA requires every practice that handles electronic patient information to complete a security risk analysis. The requirement sits at 45 CFR 164.308(a)(1). It is not optional, and it is one of the first things federal reviewers ask for after an incident. Educational self-assessment only. This kit is not legal advice and not a finding that your practice complies with HIPAA. Completing the assessment does not make a practice compliant, and the tool's publisher says the same in its own disclaimer. Do not enter patient information into anything you send to us. Keep the finished file at home. Do not email your completed assessment to anyone, including us. A completed assessment is a written map of your practice's weak points. It belongs on your own systems.
Four parts, in the order to use them
Part 1: The federal assessment tool
The Security Risk Assessment Tool is published by the U.S. Department of Health and Human Services (the Office of the National Coordinator for Health IT, working with the Office for Civil Rights). It is free, and the current version is 3.7. Everything you enter stays on your own computer: the government does not collect, view, or store any of it. The questions cover the administrative, physical, and technical safeguards in the HIPAA Security Rule, along with threats, vulnerabilities, and the vendors and devices that touch patient information. Check the download page for the formats offered and any newer version before you start.
Part 2: Complete this worksheet first
The tool cannot check your answers. If your list of where patient information lives is incomplete, the report will be wrong and will look confident doing it. Allow 30 minutes with your office manager and write down: (1) your practice management or EHR system, cloud or office server; (2) every location, including home offices and remote workstations; (3) every device type, including phones with email or app access; (4) your email host and who can read patient-related mail; (5) clinical systems that keep their own records, such as imaging, therapy documentation, and outcome tools; (6) your backup system and when a restore was last tested; (7) who can connect from outside the office, and how; (8) patient communications: texting, portal, telehealth, online forms, online scheduling; (9) paper that gets scanned, and who scans it; (10) how access is removed when someone leaves, and who owns that task.
Part 2, continued: your vendor list
List every company that can touch patient information: EHR or practice management vendor, IT provider, billing service, answering service, telehealth platform, cloud backup, email host, shredding company. For each one, note whether a signed Business Associate Agreement (BAA) is on file. Missing BAAs are one of the most common gaps in small practices, and one of the easiest to close.
Part 3: The remediation tracker
The assessment tells you what is weak. It does not assign a risk level, pick a fix, set a date, or check that the work happened. Give every finding a row: the risk (low, medium, or high), a decision (fix it, accept it in writing, or transfer it), one named owner, one due date, and the evidence that will prove it closed. Example: "Two former employees still have active logins. High. Fix. Office manager. 7 days. User list screenshot."
Part 4: Keep it moving
Most practices complete the tool and then stall. Four habits prevent that. Name one owner for the tracker and review it monthly until every high-risk row is closed. Put a date on every row. Put next year's assessment on the calendar now, and redo it sooner after new software, a new location, a new vendor, staff changes, or any security incident. Keep the assessment and tracker on your own systems, with the risks you accept signed by the owner.
Readiness Self-Quiz
Use the included self-assessment to benchmark where you stand today and prioritize the steps that matter most right now.
Before you open the tool
Who is this kit for?+
Small dental, medical, PT/OT, and behavioral health practices that need to complete or update their security risk analysis.
Does completing this make my practice HIPAA compliant?+
No. The assessment is one required step. Compliance also depends on fixing what it finds, your policies, training, and agreements with vendors. This kit is educational and is not legal advice.
Should I send my completed assessment to David from Accounting?+
No. Keep it on your own systems. We do not need it, and a completed assessment should not travel by email.
What does David from Accounting do for healthcare practices?+
We handle the accounting side: monthly bookkeeping, payroll, and advisory for healthcare practices nationwide, with staff trained on handling data near patient information. We do not certify HIPAA compliance, and no honest firm will.
Is there a quick way to see where my gaps are?+
Yes. The HIPAA Readiness Quiz takes a few minutes and is a self-scored educational check. It is not a finding that your practice complies with HIPAA.
A second look at the financial side
If you want a second look at your practice's finances, start with the Practice Financial Checkup: overhead graded against ranges for your specialty, a collections and AR review, and your top 3 fixes. $1,250, delivered in 10 business days. Questions about this kit? Reply to the email that delivered it, or write to david@davidfromaccounting.com.