Free checklist · For MSPs and consultants serving healthcare clients
HIPAA Security Risk Assessment Checklist
Covered entities and business associates must conduct an accurate and thorough risk analysis under the HIPAA Security Rule. This checklist walks through the administrative, physical and technical safeguards so you can run the assessment with a healthcare client.
Summarised from 45 CFR Part 164 Subpart C for assessment purposes. Not legal advice; confirm requirements with the regulation and counsel.
Administrative safeguards (§164.308)
Risk analysis
Documented assessment of threats and vulnerabilities to ePHI confidentiality, integrity and availability.
Risk management
Measures implemented to reduce identified risks to a reasonable level.
Sanction policy
Consequences for workforce members who violate security policies.
Information system activity review
Audit logs, access reports and incident tracking reviewed regularly.
Assigned security responsibility
A named security official.
Workforce security & access authorization
Access to ePHI granted by role; terminated promptly.
Security awareness training
Including phishing, password management and malware protection.
Security incident procedures
Identify, respond to, mitigate and document incidents.
Contingency plan
Data backup, disaster recovery and emergency mode operation plans.
Periodic evaluation
Technical and non-technical evaluation of safeguards.
Business associate agreements
BAAs in place with vendors that handle ePHI.
Get the full HIPAA Security Risk Assessment Checklist
All 25 items, plus a spreadsheet (CSV) you can open in Excel or Google Sheets. Free — we'll email you the link too.
No spam. Unsubscribe in one click. Prefer to skip? Start free — the full framework is built in.
Run this for every client — without the spreadsheet
HIPAA is included in every NovaGRC plan. Run the assessment once per clinic or practice, track remediation, and hand the owner a white-label board report.
The Starter plan is free: one client workspace, up to 3 team members, no credit card.