← All checklists
HIPAA readiness checklist
Every HIPAA Security, Privacy and Breach Notification Rule requirement a covered entity or business associate has to act on, mapped to its 45 CFR citation, with the evidence OCR or an assessor will ask for. Preview 18 of the 100 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers HIPAA Security, Privacy and Breach Notification RulesReviewed 30 Oct 2026100 items · 11 sections
Scope, governance and documentation
10 items
- 160.103Confirm whether you are a covered entity, a business associate or both, and record the reasoning for each line of business.Evidence: Written determination signed by counsel or the compliance lead.
- Prep 1Map where electronic PHI is created, received, stored and sent, including cloud services, endpoints, backups and vendors.Evidence: ePHI inventory and data-flow diagram, dated.
Security management process
6 items
- 164.308
(a) Run an accurate and thorough risk analysis of threats and vulnerabilities to all ePHI across the organization (required).Evidence: Current risk analysis covering every system in the ePHI inventory.(1) (ii) (A)
Workforce security, access and training
11 items
- 164.308
(a) Authorize and supervise workforce members who work with ePHI or in places where it can be accessed (addressable).Evidence: Access authorization records and supervision procedures.(3) (ii) (A) - 164.308
(a) Check that a person's access to ePHI is appropriate before granting it, for example through background checks (addressable).Evidence: Clearance procedure and sample screening records.(3) (ii) (B)
Incident response and contingency planning
6 items
- 164.308
(a) Identify and respond to suspected or known security incidents, reduce harmful effects where practical and document incidents and outcomes (required).Evidence: Incident response procedure and incident log.(6) (ii)
Physical safeguards
10 items
- 164.310
(a) Allow facility access to support data restoration under the contingency plan during an emergency (addressable).Evidence: Emergency facility access procedure.(2) (i) - 164.310
(a) Protect facilities and equipment from unauthorized physical access, tampering and theft (addressable).Evidence: Facility security plan, or provider attestations for hosted sites.(2) (ii)
Technical safeguards
10 items
- 164.312
(a) Give every user a unique name or number to identify and track their activity (required).Evidence: User directory export showing no shared accounts.(2) (i) - 164.312
(a) Have a procedure to get necessary ePHI during an emergency (required).Evidence: Break-glass procedure and records of its use.(2) (ii)
Business associates
7 items
- 164.308
(b) Get satisfactory written assurances from each business associate that it will safeguard the ePHI it handles for you (required).Evidence: Signed business associate agreements for every vendor touching PHI.(1)
Privacy Rule uses and disclosures
12 items
- 164.502
(a) Use or disclose PHI only as the Privacy Rule permits or requires.Evidence: Use and disclosure policy mapped to permitted purposes. - 164.502
(b) Limit uses, disclosures and requests to the minimum necessary for the purpose, outside the listed exceptions such as treatment.Evidence: Minimum necessary policy.
Individual rights
7 items
- 164.520Publish a notice of privacy practices, provide it at first service, post it on your website and seek written acknowledgment where required.Evidence: Current notice, website link and acknowledgment records.
Privacy administration
10 items
- 164.530
(a) Name a privacy official and a contact person or office for complaints and questions.Evidence: Designation letter and published contact details. - 164.530
(b) Train all workforce members on PHI policies, at hire and when material changes occur.Evidence: Training records with dates.
Breach notification
11 items
- 164.402Presume any impermissible use or disclosure of unsecured PHI is a breach unless a documented four-factor risk assessment shows a low probability of compromise.Evidence: Breach risk assessment template and completed assessments.
- 164.404
(a) Treat a breach as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent.Evidence: Incident intake procedure that timestamps discovery.
Changelog
- v1.030 Oct 2026First release. Covers the HIPAA Security Rule with required and addressable specifications marked, the Privacy Rule and the Breach Notification Rule. The January 2025 proposed Security Rule changes are noted as pending, not final.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.