HIPAA Risk Assessment Report

Full Name

Email Address

Phone Number

Clinic Name

Has your clinic completed a formal HIPAA Security Risk Assessment in the last 12 months?yesNo

Do you have a written Risk Management Plan that documents how identified risks are being addressed?YesNo

Does your clinic have a designated HIPAA Security Officer?YesNo

Are your HIPAA policies and procedures documented, reviewed annually, and accessible to staff?YesNo

Does every staff member have a unique login — no shared usernames or passwords?YesNo

Is Multi-Factor Authentication (MFA) enabled for all systems that access patient data?YesNo

Do workstations and systems automatically log off after a period of inactivity?YesNo

Is access to patient records limited by role — staff only see what they need for their job?YesNo

Is all patient data encrypted both when stored and when transmitted?YesNo

Are all laptops, tablets, and mobile devices that access patient data encrypted?YesNo

Does your clinic use a business-grade firewall and secure, segmented Wi-Fi network?YesNo

Do you have automated, encrypted backups of all patient data with tested recovery procedures?YesNo

Do you have 24/7 monitoring or alerts for suspicious activity on your systems?YesNo

Does your clinic have a documented Incident Response Plan for data breaches?YesNo

Has your incident response plan been tested or simulated in the last 12 months?YesNo

Do you maintain audit logs of who accessed or modified patient records?YesNo

Have all staff completed HIPAA security awareness training in the last 12 months?YesNo

Are staff trained to identify phishing emails and social engineering attacks?YesNo

Do you have signed Business Associate Agreements (BAAs) with all third-party vendors who handle patient data?YesNo

Do you verify that your IT and software vendors are HIPAA compliant before granting them access?YesNo

Your HIPAA Compliance Risk Level

top