Free HIPAA Self-Assessment NFP • Total HIPAA Compliance

Does your company have a designated Privacy Officer?*

The Privacy Officer doesn't have to be a HIPAA expert, but needs to be a person in your company with strong organizational skills and someone who has the ability to sanction employees. Usually, this is a manager, officer, or owner of your company.

Yes
No

Does your company have a designated Security Officer?*

The Security Officer doesn't have to be a HIPAA expert, but needs to be a person in your company with strong organizational skills and someone who has the ability to sanction employees. Usually, this is a manager, officer, or owner of your company. The same person can serve both the Privacy and Security Officer Roles.

Yes
No

Has your company completed a Risk Assessment?*

A detailed Risk Assessment is required for HIPAA Compliance, and this is one of the first items you will be asked for in the event you are audited. This document helps you to identify any security deficiencies that exist in your company.

Yes
No

Have you trained your staff that comes in contact with PHI on the HIPAA law?*

This includes HR staff, owners, IT staff, etc.

Yes
No

Has your company created or updated HIPAA Privacy and Security Policies and Procedures since September 15, 2013?*

September 15, 2013 is when the HIPAA Omnibus Ruling went into affect for all Covered Entities, Business Associates and Business Associate Subcontractors. There have been significant updates to the law, and the fines and penalties have also been increased for non-compliance.

Yes
No

Have all employees that see PHI recently completed training on your company's HIPAA Policies and Procedures?*

Annual training on your company's HIPAA Privacy and Security Policies and Procedures is required for all employees that see or may come in contact with PHI as a part of their job requirement. This may include- HR managers and staff, IT manager and staff, owners, and line managers.

Yes
No

Do you have an agreement with every Business Associate that may come in contact with PHI?*

HIPAA requires that you have an Business Associate Agreement with any 3rd parties that store, transmit or backup your PHI.

Yes
No

How many employees could or do touch PHI?*

You should include- HR staff, managers, IT staff

How many sites does your company have?*