HIPAA Security Rule — Self-assessment checklist
A self-assessment based on Security Standards for the Protection of Electronic Protected Health Information (Research reconstructed 2026-10-27), last reviewed 2026-10-29.
10 questions in 1 sections
What this checklist covers
A practical, source-linked self-assessment based on the associated research requirements. Administrator approval is required before publication.
Who it may be relevant to: For entities to whom the underlying regulation applies; applicability must be assessed independently.
How the self-assessment works
- Answer each question Yes, No or Not applicable. A No is a valid answer: it simply shows where you may want to look more closely.
- Add notes where they help, then review your answers before you finish. Attaching evidence is part of the assessment in a signed-in workspace, not of this public checklist.
- See a summary of what you answered. Your answers describe your own practices; they are not a legal finding.
Reviewing regularly helps you notice when your practices, systems or the policy itself change.
Start the self-assessmentSection 1 of 1
Security risk management and governance
Answer Yes, No or Not applicable; a response is not legal certification.
- 1.
Do you conduct ePHI security risk analysis?
Assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. No universal annual cycle exists in this section.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 2.
Do you manage identified security risks?
Implement reasonable and appropriate security measures to reduce identified risks and vulnerabilities.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 3.
Do you apply workforce security sanctions?
Apply appropriate sanctions against workforce members who violate the security policies or procedures.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 4.
Do you review information system activity?
Implement procedures to regularly review system-activity records, including access reports, logs and security incident tracking, with organisation-defined cadence.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 5.
Do you designate security official?
Identify an official responsible for developing and implementing Security Rule policies and procedures.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart C (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.308(a)(2)
- 6.
Do you control workforce ePHI access?
Implement workforce procedures permitting appropriate access while preventing access by personnel without authorization.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 7.
Do you manage authorization to ePHI?
Implement policies and procedures authorizing access to ePHI consistent with the Privacy Rule.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 8.
Do you maintain security awareness and training program?
Establish security-awareness training for all workforce members including management; no universal annual cadence is stated.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 9.
Do you respond to and document security incidents?
Identify and respond to suspected or known incidents, mitigate harmful effects where practicable and document outcomes.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 10.
Do you maintain retrievable ePHI backups?
Maintain procedures to create retrievable exact copies of ePHI as part of the contingency plan.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
This checklist is a self-assessment tool provided for information. It is not legal advice, and completing it does not certify, verify or guarantee compliance with any law or regulation. Review dates you set are your own and are not legal deadlines.