HIPAA Compliance Assessment - Medical Compliance Certification

Compliance Test

HIPAA Compliance Assessment

Do I need compliance?

Not sure if you need Bloodborne Pathogen compliance training? Take this quick survey to find out!

Business Name(Required)

Row Start

First Name(Required)

Column Break

Last Name(Required)

Row End

Row Start

Email(Required)

Column Break

Phone(Required)

Row End

When did you last conduct a review of security policies and procedures?

Within the last 6 months

Within the last year

It’s been over a year

Privacy Policies and Procedures - Have you created and do you regularly review and update written privacy policies and procedures as required by law?

Yes

Information Management and Security Program - Do you have written policies and procedures for information management and security?*

Yes

Confidentiality Agreements - Do you have signed confidentiality agreements with employees, partners, and other businesses with access to confidential information (such as “business associate agreements”) and do you keep copies of these agreements?

Yes

Notice of Privacy Policy and Procedures - If you are a health care practitioner, do you obtain a signed acknowledgement of receipt of your privacy policies and procedures when required?

Yes

Risk Assessment - Have you conducted an information security risk assessment?*

Yes

When did you last conduct an information security risk assessment?

-2 Years Ago

2+ Years Ago

Annual Review - Do you annually review your information security policy and procedures to ensure the suitability and effectiveness of information security?

Yes

Forms Review - Do you annually review your standard forms for compliance with state and federal regulations?

Yes

When did you last review or update your practice forms?

-1 Year Ago

1+ Years Ago

Authorization - Do you obtain proper authorization for disclosure of personal information when needed and maintain a record of these authorizations?

Yes

Complaints - Do you have a privacy complaint form that you provide when someone has a problem related to your use or disclosure of information?

Yes

Information Privacy and Security Training - Do you provide annual training to all employees that covers information privacy and security requirements and consequences of legal and policy violations?

Yes

When did you last conduct training?

This Year

Last Year

2+ Years Ago

Access Limits - Do you have procedures for limiting the disclosure of information to the minimum necessary needed for each job function?

Yes

Access Termination - Do you have a written checklist that you follow to restrict a person’s access to information and the facility (keys, passwords) when the person leaves or changes their employment role?

Yes

Personnel Screening - Do you request and verify employee background and work history for employees who will have access to confidential or personal information?

Yes

Physical Assessment - Have you conducted a review of your facility’s physical and environmental security, such as building entry controls, alarms, fire detection, and temperature controls?

Yes

Physical Assessment - Have you conducted a review of your facility’s physical and environmental security, such as building entry controls, alarms, fire detection, and temperature controls?

-1 Year Ago

1+ Years Ago

2+ Years Ago

Physical Access Control - Do you have procedures to monitor and control physical access to facilities? For example, do you have recorded video surveillance or electronic access that logs user access to the facility?

Yes

Environmental Controls - Do you maintain systems for backup power for an orderly computer shutdown process, fire detection, temperature and humidity controls and water damage detection?

Yes

Disaster Recovery Plan - Check each of the following disaster recovery options you have to support your ability to continue your business in the event of a catastrophic loss of information: (Select ALL Correct Answers)

Regular offsite backup of systems and data, with instructions for restoration.

Information with a trusted source to access offsite backups.

Appropriate training of staff for emergency operations.

Monitoring - Do you maintain an unalterable computer system log and routinely audit logs, security events and system use?

Yes

Data Classification - Do you maintain policies and procedures to classify information by its value, sensitivity, and critical need to your business?

Yes

Access Controls - Check each of the following procedures you use to limit or prevent access to information: (Select ALL Correct Answers),

Strong Passwords with periodic changes and restrictions on sharing of passwords.

Control over internet access with strong passwords for routers.

Encryption of any device with protected information that might leave the office.

Periodic audit of user access and privileges.

Network access controls with authentication of users.

Data Storage and Portable Media Protection - Do you follow written policies and procedures to protect data on electronic storage media, including CDs and DVDs, USB storage devices and portable hard drives?

Yes

Lock-Out for Inactive Computing Devices - Do you configure devices to automatically lock after a period of inactivity is enforced?

Yes

Anti-Virus Protection - Do you regularly use and update security software to protect against computer viruses and malware?

Yes

Software Changes - Is your software and systems designed to detect and protect against unauthorized changes to software and information?

Yes

Information Input - Do you have policies and procedures to verify information for accuracy, completeness, and validity?

Yes

Information Correction - Do you have a policy and procedure for identification, reporting, and correction of information errors?

Yes

Software Usage Restrictions - Do you have procedures to comply with software usage restrictions in accordance with contact agreements and copyright laws?

Yes

User Installed Software - Do you have an explicit policy governing the downloading and installation of software by users?

Yes

Outsourced Information Services - Do you ensure that third-party providers of information system services employ adequate security controls in accordance with applicable laws, your policies and service agreements?

Yes

Device Security - Do you apply operating system and application updates, patches, and fixes as soon as they become available?

Yes

Incident Response - Do you have and follow a written information breach notification process and incident response policy and procedure?

Yes

Breach Assessment - Do you have a procedure and guidelines for conducting a breach assessment to determine whether you must provide breach notification under state or federal law?

Yes