HIPAA Compliance Checklist

Ensure the confidentiality, integrity, and availability of all electronic protected health information.

NPI Provided (National Provider Identifier)

HPID Issued (#######)

EIN Issued (##-#######)

Receive a standard transaction on behalf of the covered entity and translate it into a nonstandard transaction.

Receive a nonstandard transaction from the covered entity and translate it into a standard transaction for transmission on behalf of the covered entity.

Dedicated Privacy Official

Ensure the confidentiality, integrity, and availability of all electronic protected health information the covered entity or business associate creates, receives, maintains, or transmits.

Covered entities and business associates may use any security measures that allow the covered entity or business associate to reasonably and appropriately implement the standards and implementation specifications.

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with § 164.306(a).

Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity or business associate.

Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

Implement policies and procedures to ensure that all members of its workforce have appropriate access to electronic protected health information.

Implement procedures for the authorization and/or supervision of workforce members who work with electronic protected health information or in locations where it might be accessed.

Implement procedures to determine that the access of a workforce member to electronic protected health information is appropriate.

Implement policies and procedures for authorizing access to electronic protected health information that are consistent with the applicable requirements of subpart E of this part.

If a health care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization.

Implement policies and procedures for granting access to electronic protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.

Implement a security awareness and training program for all members of its workforce (including management).

Periodic security updates.