HIPAA Compliance Checklist (On-Page)

Governance & Scope

• [ ] CE / BA classification documented
• [ ] ePHI system inventory (create/receive/maintain/transmit)
• [ ] BA register with executed BAAs
• [ ] Privacy Officer / Security Officer designated

Security Rule

• [ ] Risk analysis (§164.308(a)(1)) current and signed
• [ ] Risk management plan with owners/dates
• [ ] Required specs implemented; Addressable decisions documented
• [ ] Workforce training completed and attested
• [ ] Audit controls examining ePHI activity (§164.312(b))
• [ ] Contingency / backup / disaster recovery tested
• [ ] Security Rule documentation retained 6 years (164.316(b)(2))

Privacy & Breach

• [ ] Notice of Privacy Practices current
• [ ] Minimum necessary workflows (164.502(b))
• [ ] Incident response + breach clocks rehearsed (164.400–414)

How CyberSilo Helps

• CSA turns checklist rows into living control evidence
• ThreatHawk backs Technical Safeguard monitoring items

Frequently Asked Questions

Is there an official HHS HIPAA checklist Excel?

HHS publishes guidance and audit protocols; organisations maintain their own trackers. This page is an operational outline, not an HHS form.

How often should we revisit the checklist?

At least when systems change materially, after incidents, and on a scheduled cadence aligned to risk analysis updates.

Can software complete the checklist for us?

Software organises evidence; leadership remains accountable for CE/BA compliance.

Related HIPAA Resources

HIPAA hub · OCR prep · Software · CSA