HIPAA Security Rule Checklist

Formal risk analysis identifying threats and vulnerabilities to ePHI

Documented policies for reducing risks to appropriate levels

Consequences for workforce members violating security policies

Regular review of audit logs, access reports, and security incidents

Designated security official responsible for HIPAA compliance

Procedures ensuring only authorized access to ePHI based on role

Policies governing access authorization and establishment

Training program covering security reminders, malware, login monitoring, password management

Documented procedures for identifying, responding to, and reporting incidents

Data backup, disaster recovery, and emergency operations plans

Periodic technical and non-technical evaluation of security controls

Contracts with all vendors who access, transmit, or store ePHI

Procedures limiting physical access to facilities with ePHI

Policies specifying proper functions and physical attributes of workstations

Physical safeguards restricting access to workstations with ePHI

Policies for hardware and electronic media disposal, re-use, and movement

Unique username/identifier for each user accessing ePHI

Procedures for obtaining ePHI during emergencies

Electronic procedures terminating sessions after inactivity

Mechanism to encrypt ePHI at rest and in transit

Hardware, software, and procedures recording and examining access to ePHI

Mechanisms to authenticate ePHI and protect against improper alteration

Procedures verifying that persons seeking access are who they claim to be

Technical measures guarding against unauthorized access during transmission

Complete inventory of all systems, devices, and applications handling ePHI

Documentation of network architecture and data flows involving ePHI

Procedures to apply security patches within 15 days (critical) or 30 days (other)

Regular vulnerability scans with documented remediation timelines

MFA required for all remote access and privileged accounts

Current anti-malware software on all systems with ePHI access

Systems containing ePHI segmented from general network traffic

AES-256 encryption for data at rest; TLS 1.2+ for data in transit