Privacy & Data Protection · Checklist

HIPAA Readiness Checklist — Privacy, Security and Breach rules, item by item.

For organizations that create, receive, maintain or transmit protected health information (PHI) in the US market — covered entities and business associates alike. Built for sector alignment alongside your core privacy program, not as a replacement for it.

Reviewed by Bhawna Narula, Founder & CTO, VVnT SeQuor · Last reviewed October 2026

Mapped to current published standards & statute text

Checklist items, each with a test procedure & evidence example

Stages, organized the way a real implementation unfolds

Free to use. Work through it here, no form needed. To get your readiness score, submit it for expert review below.

Expert review

Get your readiness score

Work through the checklist, then submit it — an expert scores it using Self-Compliance and emails you the result.

Check off at least one item below to unlock

Open "How to verify this" on any item for the exact test procedure & evidence an auditor would want Progress saves only in this browser — nothing is sent anywhere until you submit it for review

0 of 51 items checked off

Browsing:

1.1Covered-entity or business-associate status is documented, with the exact PHI flows in scope§160.103HIPAA applies differently depending on your role — getting this wrong miscalibrates every control that follows.
How to verify this →
Test procedureReview the documented determination of covered-entity/business-associate status and the PHI flows it's based on.
Practical example / evidenceStatus determination document naming in-scope PHI flows
1.2A security officer is formally designated, by name, with documented responsibility§164.308(a)(2)§164.308(a)(2) requires a named individual — not a shared team responsibility with no single owner.
How to verify this →
Test procedureConfirm the designation is documented, not just known informally.
Practical example / evidenceSecurity officer designation memo or policy
1.3A risk analysis covering all ePHI the organization creates, receives, maintains or transmits is currentHigh risk§164.308(a)(1)(ii)(A)This is the single most frequently cited gap in OCR enforcement actions — an outdated or incomplete risk analysis undermines everything built on it.
How to verify this →
Test procedureCheck the risk analysis's last-completed date and scope against current systems holding ePHI.
Practical example / evidenceRisk analysis document, dated, scoped to all current ePHI systems
1.4A risk management plan addresses each risk the analysis identified, with owners and target dates§164.308(a)(1)(ii)(B)A risk analysis without a corresponding remediation plan is half the requirement.
How to verify this →
Test procedureMatch each identified risk in the analysis to a tracked remediation item.
Practical example / evidenceRisk management plan/tracker mapped to risk analysis findings
1.5Risk analysis is refreshed on a defined cadence and after material changes (new system, merger, major incident)A risk analysis frozen at one point in time goes stale the moment your environment changes.
How to verify this →
Test procedureCheck the refresh history against any major environment change in the period.
Practical example / evidenceRisk analysis version history
1.6Sanction policy for workforce members who violate security policies is documented and has been applied§164.308(a)(1)(ii)(C)A sanction policy that's never been enforced reads, to an auditor, like a policy that doesn't really exist.
How to verify this →
Test procedureAsk for an example of the sanction policy being applied, or confirm none has been needed with a documented rationale.
Practical example / evidenceSanction policy and, where applicable, an enforcement record

Stage 1 of 10

2.1Workforce access to ePHI is authorized, documented and reviewed against current job role§164.308(a)(3)Access that was correct at hire but never reviewed after a role change is a common drift point.
How to verify this →
Test procedureSample a handful of access grants against current job roles and last review date.
Practical example / evidenceAccess authorization records with a review cadence
2.2Termination procedures revoke ePHI access immediately upon workforce separationHigh risk§164.308(a)(3)(ii)(C)A delay between termination and access revocation is one of the most common, and most damaging, access control gaps.
How to verify this →
Test procedurePick a recent termination and check the time gap between separation and access revocation.
Practical example / evidenceTermination checklist and timestamped access-revocation log
2.3Security awareness and training is provided to all workforce members with ePHI access, periodically§164.308(a)(5)Training that happened once at onboarding years ago doesn't meet a "periodic" requirement.
How to verify this →
Test procedureCheck training completion records against the stated training cadence.
Practical example / evidenceTraining completion log with dates
2.4A security incident response procedure defines detection, response and documentation steps§164.308(a)(6)This is broader than breach notification — it covers every security incident, reportable or not.
How to verify this →
Test procedureReview the incident response procedure for detection, response and documentation steps distinct from the breach notification process.
Practical example / evidenceIncident response procedure document
2.5A contingency plan (data backup, disaster recovery, emergency mode operation) is documented and tested§164.308(a)(7)Untested contingency plans routinely fail at the point they're actually needed.
How to verify this →
Test procedureAsk for the most recent contingency plan test and its result.
Practical example / evidenceContingency plan plus a recent test record
2.6Periodic technical and non-technical evaluation of security safeguards is performed against this standard§164.308(a)(8)§164.308(a)(8) requires an evaluation distinct from the risk analysis — a check that controls still meet the standard as the environment evolves.
How to verify this →
Test procedureReview the most recent evaluation report and its scope against current safeguards.
Practical example / evidencePeriodic evaluation report

Stage 2 of 10

3.1Facility access controls limit physical access to systems and locations where ePHI is stored or processed§164.310(a)(1)Covers data centers, server rooms and any office area where ePHI-holding devices are accessible.
How to verify this →
Test procedureReview facility access logs or controls for at least one location holding ePHI systems.
Practical example / evidenceFacility access control policy and access logs
3.2Workstation use policies specify the functions that can be performed on workstations accessing ePHI§164.310(b)Covers both physical placement (screen visibility, shared spaces) and permitted use.
How to verify this →
Test procedureReview the workstation use policy against actual workstation placement for at least one ePHI-access point.
Practical example / evidenceWorkstation use policy
3.3Workstation security measures (screen locks, physical positioning) protect against unauthorized viewing§164.310(c)A workstation left unlocked, or positioned facing a public walkway, is a common, easily-missed physical gap.
How to verify this →
Test procedureSpot-check screen-lock timeout settings and physical positioning for ePHI-access workstations.
Practical example / evidenceScreen-lock configuration and workstation placement review
3.4Device and media controls govern the receipt, removal, reuse and disposal of hardware holding ePHIMedium risk§164.310(d)(1)Device disposal without proper data destruction is a frequent source of breach.
How to verify this →
Test procedureReview the disposal/reuse procedure and check for a certificate of destruction on a recently retired device.
Practical example / evidenceDevice/media disposal procedure and a sample destruction certificate
3.5A record is maintained of the movements of hardware and electronic media containing ePHI, and the person responsibleCovers accountability for devices moving between locations, custodians or disposal.
How to verify this →
Test procedureReview the hardware/media movement log for at least one recent device transfer.
Practical example / evidenceHardware/media movement log

Stage 3 of 10

4.1Unique user identification is assigned to every individual accessing ePHI — no shared loginsHigh risk§164.312(a)(2)(i)Shared credentials make it impossible to attribute access to an individual, which undermines every other technical control.
How to verify this →
Test procedureCheck authentication configuration for any shared/generic accounts with ePHI access.
Practical example / evidenceUser account inventory showing unique IDs, no shared credentials
4.2Automatic logoff terminates an electronic session after a predetermined period of inactivity§164.312(a)(2)(iii)An addressable specification, but expected practice wherever sessions access ePHI from shared or unattended devices.
How to verify this →
Test procedureCheck session-timeout configuration for a sampled ePHI-access application.
Practical example / evidenceSession timeout configuration
4.3Encryption protects ePHI at rest, or an equivalent documented alternative measure is in placeHigh risk§164.312(a)(2)(iv)Encryption is addressable, not required outright — but where not implemented, the alternative and its rationale must be documented.
How to verify this →
Test procedureCheck encryption configuration for ePHI datastores, or review the documented alternative-measure rationale.
Practical example / evidenceEncryption configuration, or a documented alternative-measure analysis
4.4Audit controls record and examine activity in systems containing ePHI§164.312(b)Logging that exists but is never reviewed doesn't meet the intent of this standard.
How to verify this →
Test procedureReview audit log configuration and evidence that logs are actually examined, not just retained.
Practical example / evidenceAudit log configuration and a log-review record
4.5Integrity controls protect ePHI from improper alteration or destruction, with mechanisms to confirm it§164.312(c)(1)Covers both preventing unauthorized changes and having a way to detect them if they occur.
How to verify this →
Test procedureReview integrity-verification mechanisms (checksums, version control, access logging) for a sampled ePHI system.
Practical example / evidenceIntegrity control documentation for a sampled system
4.6Transmission security protects ePHI against unauthorized access while being transmitted over a network§164.312(e)(1)Covers encryption in transit and integrity controls for data moving between systems or to external parties.
How to verify this →
Test procedureCheck encryption configuration for at least one ePHI transmission path (e.g. application-to-application, email).
Practical example / evidenceTransmission encryption configuration
4.7Entity/person authentication verifies that the person seeking access is the one claimed, before granting it§164.312(d)Password strength, multi-factor authentication and related controls sit here.
How to verify this →
Test procedureReview authentication requirements (password policy, MFA) for at least one ePHI-access system.
Practical example / evidenceAuthentication policy and configuration for a sampled system

Stage 4 of 10

5.1A Notice of Privacy Practices is distributed and acknowledged, covering all required disclosures§164.520Covers uses/disclosures of PHI, individual rights and the covered entity's duties — a specific, enumerated list.
How to verify this →
Test procedureReview the current NPP against the required-content list and check for a distribution/acknowledgment record.
Practical example / evidenceNPP document and acknowledgment records
5.2A documented, working process gives individuals access to their PHI within 30 days (extendable once by 30)High risk§164.524This mirrors GDPR/DPDPA access-request timelines but runs on HIPAA's own clock and format rules.
How to verify this →
Test procedureRun or review a test access request and time the response against the 30-day requirement.
Practical example / evidenceAccess-request procedure and a timed test or real request record
5.3A process exists for individuals to request amendment of their PHI, with required responses either way§164.526Whether granted or denied, the covered entity must respond with specific required content either way.
How to verify this →
Test procedureReview the amendment-request procedure for both the grant and denial response paths.
Practical example / evidenceAmendment-request procedure document
5.4An accounting of disclosures can be produced for the six years preceding a request, for disclosures that require it§164.528Not every disclosure needs to be tracked for this purpose — but the ones that do must be retrievable for six years.
How to verify this →
Test procedureReview the disclosure-tracking log and attempt to produce a sample accounting.
Practical example / evidenceDisclosure accounting log and a sample accounting output
5.5Individuals can request restrictions on uses/disclosures and confidential communications, and requests are honored where required§164.522Some restriction requests are mandatory to honor (e.g. a self-pay patient restricting disclosure to their health plan).
How to verify this →
Test procedureReview the restriction-request procedure and confirm it distinguishes mandatory from discretionary restrictions.
Practical example / evidenceRestriction-request procedure document

Stage 5 of 10

6.1A minimum-necessary standard is applied and documented for routine uses and disclosures of PHI§164.502(b)Covers internal uses (e.g. which roles see which PHI fields) as well as external disclosures.
How to verify this →
Test procedureReview the minimum-necessary policy and check it against an actual role-based access configuration.
Practical example / evidenceMinimum-necessary policy and role-based access configuration
6.2Uses and disclosures of PHI are mapped against the permitted categories (treatment, payment, operations, authorized, required by law)A PHI disclosure outside these categories, without valid authorization, is a Privacy Rule violation regardless of intent.
How to verify this →
Test procedureSample a PHI disclosure and confirm it maps to a permitted category or valid authorization.
Practical example / evidencePHI disclosure log mapped to permitted-use categories
6.3Valid, HIPAA-compliant authorization forms are used for disclosures outside TPO (treatment/payment/operations)§164.508Authorization forms have specific required elements — a generic consent form often doesn't meet them.
How to verify this →
Test procedureReview the authorization form template against the required elements in §164.508.
Practical example / evidenceAuthorization form template checked against §164.508 requirements
6.4De-identification of PHI (where used) follows either the Safe Harbor or Expert Determination method correctly§164.514(b)Partial de-identification (removing some but not all 18 Safe Harbor identifiers) does not meet the standard.
How to verify this →
Test procedureReview a sample de-identified dataset against the full Safe Harbor identifier list, or review the expert determination documentation.
Practical example / evidenceDe-identification methodology documentation

Stage 6 of 10

7.1Every vendor or subcontractor that creates, receives, maintains or transmits PHI on your behalf is inventoriedHigh riskThis inventory is the step that most often reveals a missing BAA — vendor lists are usually longer than BAA lists.
How to verify this →
Test procedureCompare the full vendor inventory against the signed-BAA list.
Practical example / evidenceVendor inventory cross-referenced against signed BAAs
7.2A Business Associate Agreement with all required terms is executed before PHI is shared§164.314(a)(2)Required terms include permitted uses, safeguard obligations, breach reporting, subcontractor flow-down and return/destruction at termination.
How to verify this →
Test procedureReview a sample BAA against the required-elements list in §164.314(a)(2).
Practical example / evidenceSample BAA checked against §164.314(a)(2) requirements
7.3Business associates are contractually required to flow BAA terms down to their own subcontractorsA subcontractor one step removed from you, with no BAA of its own, is a common supply-chain gap.
How to verify this →
Test procedureCheck the BAA's subcontractor flow-down clause and ask for evidence it's been exercised.
Practical example / evidenceBAA flow-down clause and, where available, a subcontractor BAA example
7.4Business associates are required to report security incidents and breaches to the covered entity promptlyYour own breach-notification clock often depends on how quickly your business associate tells you.
How to verify this →
Test procedureReview the BAA's incident/breach notification clause for a specific, short reporting deadline.
Practical example / evidenceBAA clause requiring prompt incident/breach reporting

Stage 7 of 10

8.1A designated privacy official is responsible for developing and implementing privacy policies§164.530(a)Can be the same person as the security officer, but the role and its responsibilities must be documented either way.
How to verify this →
Test procedureConfirm the privacy official designation is documented and distinguishable from, or combined with, the security officer role.
Practical example / evidencePrivacy official designation document
8.2Workforce members receive training on privacy policies appropriate to their functions§164.530(b)Training content should be role-appropriate — a billing clerk and a clinician need different depth on different topics.
How to verify this →
Test procedureReview training content against role-specific PHI exposure.
Practical example / evidenceTraining materials and completion records by role
8.3Reasonable safeguards protect PHI from incidental or intentional use/disclosure in day-to-day operationsCovers practical, everyday things — not leaving PHI visible on a shared screen, not discussing it in public areas.
How to verify this →
Test procedureSpot-check a physical or operational area for incidental PHI exposure risk.
Practical example / evidenceSafeguards policy and a spot-check record
8.4A process exists for individuals to file complaints about privacy practices, and complaints are logged§164.530(d)Complaint handling needs to be documented, not just theoretically available.
How to verify this →
Test procedureReview the complaint log, or confirm none have been received with a documented intake process in place.
Practical example / evidenceComplaint process documentation and complaint log

Stage 8 of 10

9.1A documented four-factor risk assessment determines whether an impermissible use/disclosure is a reportable breach§164.402Not every impermissible disclosure is a reportable breach — the risk assessment is what determines that, and it must be documented either way.
How to verify this →
Test procedureReview a completed (or test) four-factor risk assessment for structure and documented conclusion.
Practical example / evidenceBreach risk assessment template and a completed example
9.2Individual notification occurs without unreasonable delay, and no later than 60 days after discoveryHigh risk§164.404The 60-day outer limit is a ceiling, not a target — "without unreasonable delay" is the actual standard.
How to verify this →
Test procedureReview a real or tabletop breach timeline against the 60-day requirement.
Practical example / evidenceBreach notification timeline record
9.3HHS notification follows the correct timeline based on breach size (immediate for 500+, annual log for under 500)§164.408The two-track timeline (60 days for large breaches, annual summary for small ones) is a frequently mismanaged detail.
How to verify this →
Test procedureReview the breach log for correct categorization and notification timeline by breach size.
Practical example / evidenceBreach log showing size-based notification tracking
9.4Media notification occurs for breaches affecting 500+ residents of a state or jurisdiction§164.406A separate obligation from HHS and individual notification, with its own trigger threshold.
How to verify this →
Test procedureConfirm the breach notification procedure includes the media-notification trigger and process.
Practical example / evidenceBreach notification procedure covering the media-notification requirement
9.5A breach log tracks every assessed incident, including those concluded not reportable, with rationaleRegulators can request the full assessment history, not just reported breaches.
How to verify this →
Test procedureReview the breach log for non-reportable incidents with documented rationale.
Practical example / evidenceBreach log including non-reportable, assessed incidents

Stage 9 of 10

10.1A data backup plan ensures retrievable, exact copies of ePHI are maintained§164.308(a)(7)(ii)(A)"Exact copies" and "retrievable" both need to be demonstrated, not assumed from a backup schedule existing.
How to verify this →
Test procedureReview the backup plan and request evidence of a successful retrieval test.
Practical example / evidenceBackup plan and a retrieval test record
10.2A disaster recovery plan restores any loss of ePHI data, and an emergency mode operation plan keeps critical processes runningThese are two distinct required plans under the same contingency standard — often conflated into one document that only covers one.
How to verify this →
Test procedureReview both plans separately and check for a distinct emergency-mode-operations component.
Practical example / evidenceDisaster recovery plan and emergency mode operation plan
10.3Applications and data criticality analysis prioritizes systems for restoration orderWithout a documented priority order, recovery efforts can default to whichever system is easiest, not most critical.
How to verify this →
Test procedureReview the criticality analysis and confirm it informs the actual recovery runbook's ordering.
Practical example / evidenceCriticality analysis and recovery runbook
10.4Required policies, procedures, actions and assessments are documented in writing and retained for six years§164.316(b)(2)§164.316's six-year retention applies specifically to HIPAA documentation — distinct from other record-retention schedules.
How to verify this →
Test procedureSpot-check the retention of a policy document or risk assessment against the six-year requirement.
Practical example / evidenceDocument retention log or policy covering the six-year requirement
10.5Documentation is reviewed and updated periodically in response to environmental or operational changesStale documentation that no longer reflects actual practice is itself a finding, independent of whether practice is sound.
How to verify this →
Test procedureCheck document version history against known environmental or operational changes.
Practical example / evidenceDocument version history showing periodic updates

Stage 10 of 10

Frequently asked questions

Does HIPAA apply to us if we're not a healthcare provider?

Yes, if you're a business associate — any vendor that creates, receives, maintains or transmits PHI on behalf of a covered entity, including many SaaS, cloud and data-processing vendors serving the US healthcare market. Confirm your specific role with counsel.

How does this relate to GDPR or DPDPA if we also operate in the EU or India?

They're separate regimes with different triggers, rights and timelines — HIPAA's PHI-specific rules don't substitute for GDPR or DPDPA obligations on the same data, and vice versa. See our GDPR Readiness Checklist and DPDPA Readiness Checklist if either also applies to you.

Are the 2025–2026 proposed Security Rule updates already in effect?

As of this checklist's publication, HHS's proposed Security Rule modifications (removing most "addressable" distinctions, mandating MFA and encryption more broadly) were not yet final. This checklist reflects the Rule as currently in force — confirm current status with counsel or HHS guidance before treating proposed changes as binding.

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

HIPAA Readiness Checklist — Privacy, Security and Breach rules, item by item.

Get your readiness score

Scope, governance & risk analysis

Administrative safeguards

Physical safeguards

Technical safeguards

Privacy Rule — notice & individual rights

Privacy Rule — minimum necessary & permitted uses

Business associate management

Workforce training & sanctions

Breach notification

Contingency planning & documentation

Frequently asked questions

Related reading

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

HIPAA Readiness Checklist — Privacy, Security and Breach rules, item by item.

Get your readiness score

Scope, governance & risk analysis

Administrative safeguards

Physical safeguards

Technical safeguards

Privacy Rule — notice & individual rights

Privacy Rule — minimum necessary & permitted uses

Business associate management

Workforce training & sanctions

Breach notification

Contingency planning & documentation

Frequently asked questions

Related reading

Data Minimization in Practice: Cutting Collected PII Without Breaking Your Product

Privacy by Design: Embedding DPIAs Into Your Product Development Lifecycle