HIPAA Privacy Rule — Self-assessment checklist
A self-assessment based on Standards for Privacy of Individually Identifiable Health Information (Research reconstructed 2026-10-27), last reviewed 2026-10-29.
10 questions in 1 sections
What this checklist covers
A practical, source-linked self-assessment based on the associated research requirements. Administrator approval is required before publication.
Who it may be relevant to: For entities to whom the underlying regulation applies; applicability must be assessed independently.
How the self-assessment works
- Answer each question Yes, No or Not applicable. A No is a valid answer: it simply shows where you may want to look more closely.
- Add notes where they help, then review your answers before you finish. Attaching evidence is part of the assessment in a signed-in workspace, not of this public checklist.
- See a summary of what you answered. Your answers describe your own practices; they are not a legal finding.
Reviewing regularly helps you notice when your practices, systems or the policy itself change.
Start the self-assessmentSection 1 of 1
Permitted PHI use, disclosure and authorizations
Answer Yes, No or Not applicable; a response is not legal certification.
- 1.
Do you limit PHI uses and disclosures?
Covered entities and business associates must use or disclose PHI only as permitted or required by applicable HIPAA provisions.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.502(a)
- 2.
Do you make required disclosures?
A covered entity must disclose PHI to the individual when required by the access or accounting rules, or to HHS when required for enforcement.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.502(a)(2)
- 3.
Do you obtain authorization for marketing uses?
Before marketing uses or disclosures of PHI outside specified exceptions, obtain a valid individual authorization.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.508(a)(3)
- 4.
Do you obtain authorization for sale of PHI?
Where a disclosure meets the regulatory definition of a sale of PHI, obtain a valid authorization including required remuneration notice.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.508(a)(4)
- 5.
Do you screen authorizations for defects?
Do not rely on a defective authorization, including one expired, incomplete, revoked or containing known false material information.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.508(b)(2)
- 6.
Do you use a qualifying limited-data-set agreement?
Before using or disclosing a limited data set to a recipient under §164.514(e), obtain qualifying assurances through a data use agreement.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.514(e)(4)
- 7.
Do you provide a means to request use and disclosure restrictions?
Permit individuals to request restrictions on certain treatment, payment, operations or other uses and disclosures.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 8.
Have you documented how your organization addresses honor applicable fully paid health-plan disclosure restriction?
Agree to the applicable restriction when PHI pertains solely to services paid in full and the disclosure to a health plan is for payment or operations, not otherwise required by law.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 9.
Do you respond to PHI access request?
Act on a qualifying individual access request within 30 days; a single extension not exceeding 30 days may be used under specified written-notice conditions.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
- 10.
Do you respond to disclosure-accounting request?
Act on a qualifying request for an accounting of disclosures no later than 60 days after receipt; extension conditions apply.
Evidence worth keeping: Relevant policies, request logs, training records, notices or assessments, where available. Evidence upload is optional.
Source: 45 CFR Part 164 Subpart E (eCFR edition displayed up to date October 23, 2026), 45 CFR 164.528(c)(1)
This checklist is a self-assessment tool provided for information. It is not legal advice, and completing it does not certify, verify or guarantee compliance with any law or regulation. Review dates you set are your own and are not legal deadlines.