Pro tool · 3 free runs with a free account

HIPAA Security Rule risk self-check

Answer one plain question for each administrative, physical and technical safeguard. See where you have gaps, which ones are Required, what to fix first, and export a gap report.

Not legal advice and not an OCR audit. This self-check does not replace the risk analysis required by 164.308(a)(1)(ii)(A); for that, HHS publishes the Security Risk Assessment Tool.

Step 1

Answer for your organisation

46 questions, one per Security Rule standard or implementation specification. R = Required, A = Addressable. "Not sure" counts as a gap until you can show evidence.

Organisation name (for the report, optional)

Answered 0/46

Administrative safeguards (0/24)45 CFR 164.308 · Risk analysis, people, access decisions, training, incidents, contingency, vendors.

Risk analysisR · Required164.308(a)(1)(ii)(A)
Have you done a documented, organisation-wide risk analysis covering ALL ePHI (every system, device, vendor and location), and updated it in the last year or after a major change?
Risk managementR · Required164.308(a)(1)(ii)(B)
Is there a tracked plan that reduces each risk from the analysis to a reasonable level, with owners and dates?
Sanction policyR · Required164.308(a)(1)(ii)(C)
Is there a written sanction policy for workforce members who break security policies, and is it applied?
Information system activity reviewR · Required164.308(a)(1)(ii)(D)
Does someone regularly review audit logs, access reports and security incident tracking reports for systems holding ePHI?
Security official namedR · Required164.308(a)(2)
Is one named person formally designated as the security official responsible for the Security Rule?
Authorization and/or supervisionA · Addressable164.308(a)(3)(ii)(A)
Are staff who work with ePHI (or where it can be accessed) authorised or supervised?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Workforce clearance procedureA · Addressable164.308(a)(3)(ii)(B)
Is there a procedure to decide that a person's access to ePHI is appropriate before they get it (for example background or reference checks matched to the role)?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Termination proceduresA · Addressable164.308(a)(3)(ii)(C)
When someone leaves or changes role, is their access to ePHI removed promptly (same day for leavers) by a defined procedure?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Isolating health care clearinghouse functionsR · Required164.308(a)(4)(ii)(A)
If your organisation includes a health care clearinghouse, are its ePHI functions isolated from the rest of the organisation?
Not applicable means: we are not, and do not contain, a health care clearinghouse.
Access authorizationA · Addressable164.308(a)(4)(ii)(B)
Are there written policies for how access to ePHI is granted (who can approve it, for which roles, on what basis)?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Access establishment and modificationA · Addressable164.308(a)(4)(ii)(C)
Is access to ePHI reviewed and changed when roles change, with periodic access reviews?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Security awareness and training programR · Required164.308(a)(5)(i)
Does every workforce member, including management, get security awareness training, with a record of who completed it?
Security remindersA · Addressable164.308(a)(5)(ii)(A)
Do staff get periodic security reminders between formal trainings?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Protection from malicious softwareA · Addressable164.308(a)(5)(ii)(B)
Are there procedures for guarding against, detecting and reporting malware, and are staff trained on them?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Log-in monitoringA · Addressable164.308(a)(5)(ii)(C)
Are log-in attempts monitored and discrepancies (for example repeated failures or odd locations) reported and followed up?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Password managementA · Addressable164.308(a)(5)(ii)(D)
Are there procedures for creating, changing and protecting passwords, and are staff trained on them?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Response and reportingR · Required164.308(a)(6)(ii)
Can you identify and respond to suspected security incidents, reduce their harmful effects, and document the incidents and their outcomes?
Data backup planR · Required164.308(a)(7)(ii)(A)
Do you keep retrievable exact copies of ePHI, including a copy that ransomware on your network could not reach or alter?
Disaster recovery planR · Required164.308(a)(7)(ii)(B)
Is there a written plan to restore any loss of data after an emergency (for example ransomware, fire or a cloud outage)?
Emergency mode operation planR · Required164.308(a)(7)(ii)(C)
Is there a plan to keep critical business processes running, and ePHI protected, while operating in emergency mode?
Testing and revision proceduresA · Addressable164.308(a)(7)(ii)(D)
Are the contingency plans tested and revised periodically?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Applications and data criticality analysisA · Addressable164.308(a)(7)(ii)(E)
Have you ranked applications and data by how critical they are, to set the order of recovery?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Periodic technical and non-technical evaluationR · Required164.308(a)(8)
Do you periodically evaluate how well your security policies and procedures meet the Security Rule, and again after environmental or operational changes?
Written contract or other arrangementR · Required164.308(b)(1), (b)(3)
Does every vendor that creates, receives, maintains or transmits ePHI for you have a signed business associate agreement meeting 164.314?

Physical safeguards (0/10)45 CFR 164.310 · Facilities, workstations, devices and media.

Contingency operationsA · Addressable164.310(a)(2)(i)
During an emergency, can the right people get into the facility to restore data under the contingency plan?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Facility security planA · Addressable164.310(a)(2)(ii)
Is there a plan protecting the facility and equipment from unauthorised physical access, tampering and theft?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Access control and validation proceduresA · Addressable164.310(a)(2)(iii)
Is physical access controlled and validated by role, including visitors and access to software testing areas?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Maintenance recordsA · Addressable164.310(a)(2)(iv)
Do you record repairs and changes to the security-related physical parts of the facility (locks, doors, hardware)?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Workstation useR · Required164.310(b)
Are there written rules on how workstations that access ePHI are used, and their surroundings (screens facing away, home working)?
Workstation securityR · Required164.310(c)
Are workstations that access ePHI physically safeguarded so only authorised users can use them?
DisposalR · Required164.310(d)(2)(i)
When devices or media holding ePHI are disposed of, is the data destroyed (for example wiping to NIST SP 800-88 or certified destruction)?
Media re-useR · Required164.310(d)(2)(ii)
Is ePHI removed from devices and media before they are re-used?
AccountabilityA · Addressable164.310(d)(2)(iii)
Do you keep a record of hardware and media holding ePHI and who is responsible for each as it moves?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Data backup and storageA · Addressable164.310(d)(2)(iv)
Before equipment holding ePHI is moved, is a retrievable exact copy made when needed?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).

Technical safeguards (0/9)45 CFR 164.312 · Access control, audit logs, integrity, authentication, transmission.

Unique user identificationR · Required164.312(a)(2)(i)
Does every user have their own unique log-in for each ePHI system (no shared accounts)?
Emergency access procedureR · Required164.312(a)(2)(ii)
Is there a procedure to get necessary ePHI during an emergency (for example "break-glass" access)?
Automatic logoffA · Addressable164.312(a)(2)(iii)
Do sessions on ePHI systems end or lock automatically after inactivity?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Encryption and decryptionA · Addressable164.312(a)(2)(iv)
Is ePHI encrypted at rest, including on laptops, phones, removable media and servers?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Audit controlsR · Required164.312(b)
Do systems containing ePHI record activity (who accessed what, when) in logs you can examine?
Mechanism to authenticate ePHIA · Addressable164.312(c)(1), (c)(2)
Do you protect ePHI from improper alteration or destruction, with a way to confirm it has not been changed without authorisation?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
Person or entity authenticationR · Required164.312(d)
Do you verify that a person seeking access to ePHI is who they claim to be, with multi-factor authentication at least for remote access, email and admin accounts?
Integrity controlsA · Addressable164.312(e)(2)(i)
Are there controls to ensure ePHI sent over networks is not improperly modified without detection?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).
EncryptionA · Addressable164.312(e)(2)(ii)
Is ePHI encrypted whenever it is sent over a network (email, file transfer, interfaces, remote access)?
Documented alternative = you assessed it, recorded why it is not reasonable and appropriate as written, and put an equivalent measure in place (164.306(d)(3)).

Policies and documentation (0/3)45 CFR 164.316 · Written policies, records kept six years, decisions documented.

Written policies and proceduresR · Required164.316(a)
Do you have written policies and procedures covering each Security Rule standard?
Time limit, availability, updatesR · Required164.316(b)(2)(i)-(iii)
Is security documentation kept for six years from creation or last effective date, available to those who use it, and reviewed and updated periodically?
Documented addressable decisionsR · Required164.306(d)(3)
For each addressable specification you did not implement as written, have you documented why and what equivalent alternative (if any) you implemented?

Security Rule self-check score

0/ 100 · Critical

Administrative safeguards0/100 · 24 gaps (13 R)
Physical safeguards0/100 · 10 gaps (4 R)
Technical safeguards0/100 · 9 gaps (4 R)
Policies and documentation0/100 · 3 gaps (3 R)

PlayCISO's weighting (Required items count 1.5x; Not sure counts as no). Not an OCR score: OCR publishes none.

Start with the risk analysis

164.308(a)(1)(ii)(A) is Required, and every addressable decision depends on it. OCR runs a Risk Analysis Initiative focused on entities that never did an accurate and thorough one. This self-check is not that analysis; the HHS Security Risk Assessment Tool is the official HHS option, built for small and medium-sized practices.

Prioritised remediation

Top 10 of 46 gaps. Required items and core controls first.

1
Risk analysis
P1 · Fix first164.308(a)(1)(ii)(A) · RequiredYou said: Not sure
Do this: Inventory every place ePHI is created, received, stored or sent; for each, list threats, vulnerabilities, current controls, likelihood and impact; assign a risk level; write it down and set a review date. The HHS SRA Tool or NIST SP 800-66r2 gives a structure.
2
Risk management
P1 · Fix first164.308(a)(1)(ii)(B) · RequiredYou said: Not sure
Do this: Turn each medium or high risk into a remediation item with an owner, a due date and the control that will reduce it; review progress at least quarterly.
3
Data backup plan
P1 · Fix first164.308(a)(7)(ii)(A) · RequiredYou said: Not sure
Do this: Back up every ePHI system, keep at least one copy offline or immutable, and test restores.
4
Person or entity authentication
P1 · Fix first164.312(d) · RequiredYou said: Not sure
Do this: Require multi-factor authentication for remote access, email, cloud apps holding ePHI and every admin account. (The current rule says "verify identity"; it does not name MFA, but the 2025 proposed rule would require it.)
5
Information system activity review
P1 · Fix first164.308(a)(1)(ii)(D) · RequiredYou said: Not sure
Do this: Pick the systems holding ePHI, define which logs and reports are reviewed, how often and by whom, and keep a record of each review and what was followed up.
6
Response and reporting
P1 · Fix first164.308(a)(6)(ii) · RequiredYou said: Not sure
Do this: Write an incident response procedure (who to call, first steps, evidence, breach-assessment hand-off), practise it once a year and log every incident.
7
Disaster recovery plan
P1 · Fix first164.308(a)(7)(ii)(B) · RequiredYou said: Not sure
Do this: Write restore procedures per critical system with order, owner and target time, and store a copy outside your network.
8
Written contract or other arrangement
P1 · Fix first164.308(b)(1), (b)(3) · RequiredYou said: Not sure
Do this: List every vendor touching ePHI (IT support, cloud, billing, shredding, email), confirm a current BAA for each, and add a BAA check to procurement.
9
Unique user identification
P1 · Fix first164.312(a)(2)(i) · RequiredYou said: Not sure
Do this: Replace shared log-ins with named accounts; where a shared account is unavoidable, record who uses it and when.
10
Audit controls
P1 · Fix first164.312(b) · RequiredYou said: Not sure
Do this: Enable audit logging on every ePHI system, keep logs where users cannot alter them, and set a retention period.

Gap report

Scores, every gap with its action, and all answers with citations. Plain text.

Preview the report

HIPAA SECURITY RULE SELF-CHECK: GAP REPORT
Organisation · generated 2026-10-31 with PlayCISO (playciso.com/tools/hipaa-risk-self-check)

IMPORTANT: This is a self-assessment against 45 CFR 164.308, 164.310, 164.312 and 164.316. It is not legal
advice, not an OCR audit, and not by itself the risk analysis required by 164.308(a)(1)(ii)(A).

Overall weighted score: 0/100 (Critical). Answered 0 of 46 (Not sure counts as a gap).
Risk analysis is not complete and current: fix this first. Every other decision depends on it.

SCORE BY SAFEGUARD
- Administrative safeguards: 0/100, 24 gap(s) of 24, 13 on Required specifications
- Physical safeguards: 0/100, 10 gap(s) of 10, 4 on Required specifications
- Technical safeguards: 0/100, 9 gap(s) of 9, 4 on Required specifications
- Policies and documentation: 0/100, 3 gap(s) of 3, 3 on Required specifications

PRIORITISED REMEDIATION
1. [P1 Fix first] Risk analysis (164.308(a)(1)(ii)(A), Required). Answer: Not sure
   Action: Inventory every place ePHI is created, received, stored or sent; for each, list threats, vulnerabilities, current controls, likelihood and impact; assign a risk level; write it down and set a review date. The HHS SRA Tool or NIST SP 800-66r2 gives a structure.
2. [P1 Fix first] Risk management (164.308(a)(1)(ii)(B), Required). Answer: Not sure
   Action: Turn each medium or high risk into a remediation item with an owner, a due date and the control that will reduce it; review progress at least quarterly.
3. [P1 Fix first] Data backup plan (164.308(a)(7)(ii)(A), Required). Answer: Not sure
   Action: Back up every ePHI system, keep at least one copy offline or immutable, and test restores.
4. [P1 Fix first] Person or entity authentication (164.312(d), Required). Answer: Not sure
   Action: Require multi-factor authentication for remote access, email, cloud apps holding ePHI and every admin account. (The current rule says "verify identity"; it does not name MFA, but the 2025 proposed rule would require it.)
5. [P1 Fix first] Information system activity review (164.308(a)(1)(ii)(D), Required). Answer: Not sure
   Action: Pick the systems holding ePHI, define which logs and reports are reviewed, how often and by whom, and keep a record of each review and what was followed up.
6. [P1 Fix first] Response and reporting (164.308(a)(6)(ii), Required). Answer: Not sure
   Action: Write an incident response procedure (who to call, first steps, evidence, breach-assessment hand-off), practise it once a year and log every incident.
7. [P1 Fix first] Disaster recovery plan (164.308(a)(7)(ii)(B), Required). Answer: Not sure
   Action: Write restore procedures per critical system with order, owner and target time, and store a copy outside your network.
8. [P1 Fix first] Written contract or other arrangement (164.308(b)(1), (b)(3), Required). Answer: Not sure
   Action: List every vendor touching ePHI (IT support, cloud, billing, shredding, email), confirm a current BAA for each, and add a BAA check to procurement.
9. [P1 Fix first] Unique user identification (164.312(a)(2)(i), Required). Answer: Not sure
   Action: Replace shared log-ins with named accounts; where a shared account is unavoidable, record who uses it and when.
10. [P1 Fix first] Audit controls (164.312(b), Required). Answer: Not sure
   Action: Enable audit logging on every ePHI system, keep logs where users cannot alter them, and set a retention period.
11. [P1 Fix first] Security official named (164.308(a)(2), Required). Answer: Not sure
   Action: Designate a security official in writing, with the authority and time to do the job, and tell the workforce who it is.
12. [P1 Fix first] Security awareness and training program (164.308(a)(5)(i), Required). Answer: Not sure
   Action: Train every workforce member at onboarding and periodically, cover phishing, ePHI handling and reporting, and keep completion records.
13. [P1 Fix first] Emergency mode operation plan (164.308(a)(7)(ii)(C), Required). Answer: Not sure
   Action: Define downtime procedures (paper workflows, read-only copies) for critical clinical and business processes and how ePHI stays protected during them.
14. [P1 Fix first] Periodic technical and non-technical evaluation (164.308(a)(8), Required). Answer: Not sure
   Action: Schedule an evaluation (internal or external) at a set interval and after major changes, and keep the report and actions.
15. [P1 Fix first] Workstation security (164.310(c), Required). Answer: Not sure
   Action: Secure workstations in restricted areas, use cable locks where needed, and lock screens automatically.
16. [P1 Fix first] Disposal (164.310(d)(2)(i), Required). Answer: Not sure
   Action: Adopt a disposal procedure with secure wiping or certified destruction and keep certificates.
17. [P1 Fix first] Emergency access procedure (164.312(a)(2)(ii), Required). Answer: Not sure
   Action: Set up monitored break-glass accounts or procedures for critical systems and test them.
18. [P1 Fix first] Written policies and procedures (164.316(a), Required). Answer: Not sure
   Action: Write or update policies for each standard; one policy may cover several standards if it is specific enough.
19. [P1 Fix first] Time limit, availability, updates (164.316(b)(2)(i)-(iii), Required). Answer: Not sure
   Action: Store policies, risk analyses and decisions in one controlled location, keep versions for six years, and set an annual review.
20. [P1 Fix first] Documented addressable decisions (164.306(d)(3), Required). Answer: Not sure
   Action: For every addressable item, record your decision: implemented, alternative measure, or not reasonable and appropriate, with the reasoning from your risk analysis.
21. [P1 Fix first] Termination procedures (164.308(a)(3)(ii)(C), Addressable). Answer: Not sure
   Action: Tie HR leaver and mover events to an access-removal checklist covering every ePHI system, shared accounts, devices, badges and remote access; check it was completed.
22. [P1 Fix first] Protection from malicious software (164.308(a)(5)(ii)(B), Addressable). Answer: Not sure
   Action: Deploy anti-malware or EDR on every device that touches ePHI, keep it updated, and train staff on how to spot and report suspected malware.
23. [P1 Fix first] Encryption and decryption (164.312(a)(2)(iv), Addressable). Answer: Not sure
   Action: Turn on full-disk encryption for every laptop and mobile device and encryption at rest for servers and cloud storage; document any exception and its alternative control.
24. [P1 Fix first] Encryption (164.312(e)(2)(ii), Addressable). Answer: Not sure
   Action: Enforce TLS for email and web, use secure messaging or portal delivery for ePHI, and encrypt interfaces and remote access.
25. [P2 Fix next] Sanction policy (164.308(a)(1)(ii)(C), Required). Answer: Not sure
   Action: Write a graduated sanction policy, get HR and leadership sign-off, train staff on it and record each sanction applied.
26. [P2 Fix next] Isolating health care clearinghouse functions (164.308(a)(4)(ii)(A), Required). Answer: Not sure
   Action: Separate clearinghouse systems and access so the wider organisation cannot reach the clearinghouse's ePHI.
27. [P2 Fix next] Access authorization (164.308(a)(4)(ii)(B), Addressable). Answer: Not sure
   Action: Write role-based access rules for each ePHI system, name the approvers and keep approval records.
28. [P2 Fix next] Access establishment and modification (164.308(a)(4)(ii)(C), Addressable). Answer: Not sure
   Action: Run access reviews for ePHI systems at a set interval (for example quarterly for privileged accounts), remove what is not needed and record the result.
29. [P2 Fix next] Log-in monitoring (164.308(a)(5)(ii)(C), Addressable). Answer: Not sure
   Action: Alert on repeated failed log-ins and unusual sign-ins for ePHI systems and email, and define who follows up.
30. [P2 Fix next] Password management (164.308(a)(5)(ii)(D), Addressable). Answer: Not sure
   Action: Set password rules (length, no reuse, a password manager), block known-breached passwords, and add multi-factor authentication for remote and email access.
31. [P2 Fix next] Testing and revision procedures (164.308(a)(7)(ii)(D), Addressable). Answer: Not sure
   Action: Run a restore test and a tabletop at least yearly, record the results and update the plans.
32. [P2 Fix next] Workstation use (164.310(b), Required). Answer: Not sure
   Action: Write workstation use rules, including for home and mobile working, and train staff on them.
33. [P2 Fix next] Media re-use (164.310(d)(2)(ii), Required). Answer: Not sure
   Action: Wipe devices before reissue and record it.
34. [P2 Fix next] Accountability (164.310(d)(2)(iii), Addressable). Answer: Not sure
   Action: Maintain an asset inventory of laptops, phones, drives and removable media with an owner and location.
35. [P3 Plan it] Authorization and/or supervision (164.308(a)(3)(ii)(A), Addressable). Answer: Not sure
   Action: Document who authorises access to ePHI and how people without access (cleaners, contractors) are supervised where ePHI is present.
36. [P3 Plan it] Workforce clearance procedure (164.308(a)(3)(ii)(B), Addressable). Answer: Not sure
   Action: Define clearance steps by role, apply them before access is granted, and keep the record.
37. [P3 Plan it] Applications and data criticality analysis (164.308(a)(7)(ii)(E), Addressable). Answer: Not sure
   Action: Rank systems by clinical and business impact and use the ranking to set restore order and backup frequency.
38. [P3 Plan it] Contingency operations (164.310(a)(2)(i), Addressable). Answer: Not sure
   Action: Document emergency facility access for restore staff and vendors (keys, codes, escalation contacts).
39. [P3 Plan it] Facility security plan (164.310(a)(2)(ii), Addressable). Answer: Not sure
   Action: Write a short facility security plan: locks, server room access, alarms, visitor handling.
40. [P3 Plan it] Access control and validation procedures (164.310(a)(2)(iii), Addressable). Answer: Not sure
   Action: Restrict server and records areas by role, sign in and escort visitors, and review badge access periodically.
41. [P3 Plan it] Data backup and storage (164.310(d)(2)(iv), Addressable). Answer: Not sure
   Action: Add a backup step to equipment moves and replacements.
42. [P3 Plan it] Automatic logoff (164.312(a)(2)(iii), Addressable). Answer: Not sure
   Action: Enforce screen lock and session timeouts suited to each setting (shorter in public areas).
43. [P3 Plan it] Mechanism to authenticate ePHI (164.312(c)(1), (c)(2), Addressable). Answer: Not sure
   Action: Use integrity features (checksums, database controls, immutable backups, file-integrity monitoring) on core ePHI stores.
44. [P3 Plan it] Integrity controls (164.312(e)(2)(i), Addressable). Answer: Not sure
   Action: Use protocols with integrity protection (TLS, SFTP, VPN) for every ePHI transfer.
45. [P3 Plan it] Security reminders (164.308(a)(5)(ii)(A), Addressable). Answer: Not sure
   Action: Send short periodic reminders (current scams, reporting route, device rules) and keep copies.
46. [P3 Plan it] Maintenance records (164.310(a)(2)(iv), Addressable). Answer: Not sure
   Action: Keep a simple log of lock, door, alarm and camera changes and repairs.

ALL ANSWERS
Administrative safeguards (45 CFR 164.308)
  164.308(a)(1)(ii)(A) Risk analysis [R]: Not sure
  164.308(a)(1)(ii)(B) Risk management [R]: Not sure
  164.308(a)(1)(ii)(C) Sanction policy [R]: Not sure
  164.308(a)(1)(ii)(D) Information system activity review [R]: Not sure
  164.308(a)(2) Security official named [R]: Not sure
  164.308(a)(3)(ii)(A) Authorization and/or supervision [A]: Not sure
  164.308(a)(3)(ii)(B) Workforce clearance procedure [A]: Not sure
  164.308(a)(3)(ii)(C) Termination procedures [A]: Not sure
  164.308(a)(4)(ii)(A) Isolating health care clearinghouse functions [R]: Not sure
  164.308(a)(4)(ii)(B) Access authorization [A]: Not sure
  164.308(a)(4)(ii)(C) Access establishment and modification [A]: Not sure
  164.308(a)(5)(i) Security awareness and training program [R]: Not sure
  164.308(a)(5)(ii)(A) Security reminders [A]: Not sure
  164.308(a)(5)(ii)(B) Protection from malicious software [A]: Not sure
  164.308(a)(5)(ii)(C) Log-in monitoring [A]: Not sure
  164.308(a)(5)(ii)(D) Password management [A]: Not sure
  164.308(a)(6)(ii) Response and reporting [R]: Not sure
  164.308(a)(7)(ii)(A) Data backup plan [R]: Not sure
  164.308(a)(7)(ii)(B) Disaster recovery plan [R]: Not sure
  164.308(a)(7)(ii)(C) Emergency mode operation plan [R]: Not sure
  164.308(a)(7)(ii)(D) Testing and revision procedures [A]: Not sure
  164.308(a)(7)(ii)(E) Applications and data criticality analysis [A]: Not sure
  164.308(a)(8) Periodic technical and non-technical evaluation [R]: Not sure
  164.308(b)(1), (b)(3) Written contract or other arrangement [R]: Not sure
Physical safeguards (45 CFR 164.310)
  164.310(a)(2)(i) Contingency operations [A]: Not sure
  164.310(a)(2)(ii) Facility security plan [A]: Not sure
  164.310(a)(2)(iii) Access control and validation procedures [A]: Not sure
  164.310(a)(2)(iv) Maintenance records [A]: Not sure
  164.310(b) Workstation use [R]: Not sure
  164.310(c) Workstation security [R]: Not sure
  164.310(d)(2)(i) Disposal [R]: Not sure
  164.310(d)(2)(ii) Media re-use [R]: Not sure
  164.310(d)(2)(iii) Accountability [A]: Not sure
  164.310(d)(2)(iv) Data backup and storage [A]: Not sure
Technical safeguards (45 CFR 164.312)
  164.312(a)(2)(i) Unique user identification [R]: Not sure
  164.312(a)(2)(ii) Emergency access procedure [R]: Not sure
  164.312(a)(2)(iii) Automatic logoff [A]: Not sure
  164.312(a)(2)(iv) Encryption and decryption [A]: Not sure
  164.312(b) Audit controls [R]: Not sure
  164.312(c)(1), (c)(2) Mechanism to authenticate ePHI [A]: Not sure
  164.312(d) Person or entity authentication [R]: Not sure
  164.312(e)(2)(i) Integrity controls [A]: Not sure
  164.312(e)(2)(ii) Encryption [A]: Not sure
Policies and documentation (45 CFR 164.316)
  164.316(a) Written policies and procedures [R]: Not sure
  164.316(b)(2)(i)-(iii) Time limit, availability, updates [R]: Not sure
  164.306(d)(3) Documented addressable decisions [R]: Not sure

NEXT STEPS
- Use the official HHS Security Risk Assessment Tool or NIST SP 800-66 Rev. 2 to document a full risk analysis.
- Keep this report and your evidence for six years (164.316(b)(2)(i)).
- Review with your security official and, for legal questions, qualified counsel.

Sources: 45 CFR Part 164 Subpart C (ecfr.gov); HHS Guidance on Risk Analysis; HHS SRA Tool (healthit.gov); NIST SP 800-66r2.

Loading…

TL;DR

The short answer

5 points

The HIPAA Security Rule has three sets of safeguards: administrative (45 CFR 164.308), physical (164.310) and technical (164.312), plus documentation rules in 164.316.
Each implementation specification is Required or Addressable. Addressable is not optional: you assess it, implement it if reasonable and appropriate, or document why not and use an equivalent alternative.
The risk analysis in 164.308(a)(1)(ii)(A) comes first. It must cover all ePHI, and OCR runs an enforcement initiative aimed at organisations that skipped it.
This self-check turns each standard into a question, scores gaps by safeguard and orders the fixes. It is a starting point, not the risk analysis itself, not legal advice and not an OCR audit.
For the official route, HHS publishes the Security Risk Assessment (SRA) Tool; NIST SP 800-66 Rev. 2 explains how to implement each standard.

What the Security Rule asks for

45 CFR 164.308

Administrative safeguards

Risk analysis, people, access decisions, training, incidents, contingency, vendors.

24 items in this check, 13 Required.

45 CFR 164.310

Physical safeguards

Facilities, workstations, devices and media.

10 items in this check, 4 Required.

45 CFR 164.312

Technical safeguards

Access control, audit logs, integrity, authentication, transmission.

9 items in this check, 4 Required.

45 CFR 164.316

Policies and documentation

Written policies, records kept six years, decisions documented.

3 items in this check, 3 Required.

How the score works

Each item has a weight from 1 to 5 (our judgement of how central it is to protecting ePHI); Required items count 1.5 times. Yes, a documented alternative or a legitimate "not applicable" earn full credit, Partly earns half, and No or Not sure earn none. The score per safeguard is the share of available points you earned. Gaps are ordered: risk analysis and risk management first, then Required gaps, then core addressable controls such as encryption and malware protection. The weights are PlayCISO's, not OCR's; OCR publishes no scoring scheme.

A proposed rule published on 6 January 2025 would remove most of the required and addressable distinction and add requirements such as an asset inventory, network map, MFA and encryption. It is still a proposal; this check follows the rule in force today. For background, read HIPAA compliance explained.

Frequently asked questions

What is a HIPAA risk assessment?

The Security Rule calls it a risk analysis: an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all electronic protected health information (ePHI) you hold (45 CFR 164.308(a)(1)(ii)(A)). HHS guidance says it should identify where ePHI is, the threats and vulnerabilities, current controls, likelihood and impact, and assign risk levels, all documented and kept up to date.

Is this tool a HIPAA risk analysis?

No. It is a self-check of whether the Security Rule standards are in place, which helps you find gaps and plan work. A risk analysis looks at the specific threats to each system holding ePHI. Use the HHS Security Risk Assessment Tool or NIST SP 800-66 Rev. 2 for that, and keep this report as supporting evidence.

What is the difference between required and addressable in HIPAA?

A Required specification must be implemented. For an Addressable one, 45 CFR 164.306(d)(3) says you must assess whether it is reasonable and appropriate for you; implement it if so; if not, document why and implement an equivalent alternative measure if that is reasonable and appropriate. Skipping an addressable item without that documentation is a gap.

What are the three HIPAA safeguards?

Administrative safeguards (164.308) cover risk analysis and management, the security official, workforce security, access management, training, incident procedures, contingency planning, evaluation and business associate agreements. Physical safeguards (164.310) cover facilities, workstations and device and media controls. Technical safeguards (164.312) cover access control, audit controls, integrity, authentication and transmission security.

Does HIPAA require encryption or MFA?

Under the current rule, encryption at rest (164.312(a)(2)(iv)) and in transit (164.312(e)(2)(ii)) are addressable, and authentication (164.312(d)) is required but does not name MFA. HHS proposed in January 2025 to make both encryption and MFA required, with limited exceptions. As of a July 2026 HHS agenda update, reported by Davis Wright Tremaine, the final rule is expected no earlier than July 2027, so the current rule still applies.

Is there an official HIPAA risk assessment tool?

Yes. HHS (ONC, now ASTP, with OCR) publishes the Security Risk Assessment (SRA) Tool for small and medium-sized providers at healthit.gov. HHS notes that using it does not by itself guarantee compliance.

Sources

eCFR: 45 CFR Part 164, Subpart C: Security Standards for the Protection of Electronic Protected Health Information (current text, read 31 Oct 2026). The binding text of every standard and implementation specification in this tool (164.308, 164.310, 164.312, 164.314, 164.316), each marked Required or Addressable.
eCFR: 45 CFR 164.306(d): Implementation specifications (current text, read 31 Oct 2026). For an addressable specification, the entity must assess whether it is reasonable and appropriate, implement it if so, and if not, document why and implement an equivalent alternative measure if that is reasonable and appropriate. Addressable does not mean optional.
HHS: Summary of the HIPAA Security Rule (current page, read 31 Oct 2026). Plain-language summary of the administrative, physical and technical safeguards, the flexibility of approach, and the required versus addressable distinction.
HHS: Guidance on Risk Analysis Requirements under the HIPAA Security Rule (current page, read 31 Oct 2026). Risk analysis is the foundation of Security Rule compliance. It should cover all ePHI the organisation creates, receives, maintains or transmits, identify threats and vulnerabilities, assess current controls, likelihood and impact, assign risk levels, be documented, and be reviewed and updated periodically.
HHS ONC / ASTP and OCR: Security Risk Assessment (SRA) Tool (current page, read 31 Oct 2026). The official downloadable tool from HHS to help small and medium-sized providers conduct a Security Rule risk assessment. HHS notes that using it does not by itself guarantee compliance.
NIST: SP 800-66 Rev. 2: Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide (Feb 2024). Maps each Security Rule standard to key activities and sample questions, and describes a risk assessment and risk management process for regulated entities.
Federal Register (HHS OCR): HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule) (6 Jan 2025). Proposes, among other changes, removing the required/addressable distinction (with limited exceptions), a written technology asset inventory and network map, multi-factor authentication, and encryption of ePHI at rest and in transit with limited exceptions. A proposal only: it does not change the current rule.
Davis Wright Tremaine: HHS updates HIPAA rulemaking timeframes (8 Jul 2026). HHS moved the expected date of the final Security Rule amendments from May 2026 to July 2027 and moved the item to "long-term actions". Agency timetables are not binding.
HHS OCR: OCR settles HIPAA Security Rule investigation with Health Fitness Corporation (Mar 2025). Announced as the fifth enforcement action under OCR's Risk Analysis Initiative, an enforcement focus on entities that failed to conduct an accurate and thorough risk analysis (the first action was announced in October 2024).

Educational self-assessment. Not legal advice, not an OCR audit, and not a substitute for a documented risk analysis. Confirm obligations with qualified counsel.

More security tools

The tools people use most on PlayCISO.

All tools

Prompt Scan

Catch injected instructions hiding in content your AI agent should only read.

ISO/IEC 27090 Readiness

Score your readiness against the first international standard for AI security threats.

CVE Trends

Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.

Firewall Lab

Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.

NIST CSF 2.0 Assessment

Self-assess all six Functions, from Govern to Recover, and see your weakest one.

APT Naming Rosetta Stone

Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.