HIPAA Gap & Remediation Tracker

Tracks the gaps found against the readiness items, with priority, owner, deadline and status.

Available soon

Format: Excel
Size: 97 KB
Length: 13 sheets
Version: 1.0
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Your Gaps
EXAMPLE Gaps
Items
Priorities
Summary
Escalation & Review
Lists
Definitions
Framework References

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Set the As-at date on the Summary sheet. Overdue is measured against it. Use today's date, or type =TODAY().
2	After each readiness self-assessment (HIPAA Security Rule Readiness Self-Assessment), enter the level of every item in the "Your latest level" column of the Items sheet. Its Check column shows each item below Operating that has no gap.
3	For each such item, add one row on Your Gaps: a gap ID (GP-01 and so on), the item, what is missing in plain words, and the level the item had. The priority and what it exposes are worked out.
4	Enter the change that closes the gap, one named owner, the effort, and the date raised (the date of the assessment). If a plan already set an earlier date, enter it as the earlier planned date. The due date is worked out: the days for the priority after the date raised, or the earlier planned date.
5	Keep the status current: Open (agreed, not started); In progress (work started; due date unchanged); Done (the change is made and its record is filed; the item is re-rated at the next assessment); Withdrawn (dropped, with the management body's recorded reason).
6	When a gap is Done, enter the date and where the record is kept, so the evidence checklist (HIPAA Documentation & Evidence Checklist) can point to it. Do not change the item's level until the next reassessment.
7	Escalate a Priority 1 gap at once, and reassess on the triggers: see the Escalation & Review sheet (HR-29, HR-30). The Summary sheet is the report: counts by priority and by area.
8	To clear the EXAMPLE, ignore the EXAMPLE Gaps sheet or delete it, and the EXAMPLE level column on the Items sheet. Your Gaps starts blank. Do not type over the white columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

HR-29: A blocking gap is escalated at once: the security official tells the executive sponsor, the gap goes on the tracker as Priority 1 with an owner and a date, and it is reported at the next management review until it is closed. The pack's deadlines are its own, not the Rule's.

Why the priority follows the item: a duty the Rule asks for that has nothing in place is the most exposed, a duty in place that cannot be shown comes next, and an improvement last. Priority 1 (A required duty has nothing in place): A blocking item is Not started or Planned. Priority 2 (A required duty is in place but cannot be shown): A blocking item is In place but not Operating: the records would not stand up if asked for. Priority 3 (An improvement): A non-blocking item is below Operating.

The deadlines are the pack's. They are the days of P10's finding priorities, kept the same so the packs agree. The Security Rule sets no deadline for closing a gap, and nothing here is a deadline of any authority.

This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.

EXAMPLE: Acme Corp (EXAMPLE), a business associate, as at 2026-09-30. Its readiness result was "Not ready", with 3 blocking gaps, and it raised 19 gaps. The EXAMPLE tracker is read at 2026-11-16, 47 days later, so that overdue gaps show.

Limits. The tracker records what you decide to do about a gap. It does not say whether a gap breaches any rule; counsel confirms. It does not rate the risk behind a gap: that is the risk analysis. A closed gap is re-rated at the next assessment, not by this file.

Tailoring. One person may own most gaps in a small organisation; keep one owner for each all the same. Where a provider runs your IT, the owner manages the provider, and the gap is Done only when you hold the provider's record.

Your Gaps

Your gaps, one row each. Yellow columns are yours; area, priority, due date, days overdue and flag are worked out. Overdue is measured at the As-at date on Summary.

Row	Gap	Readiness item	Area	What the item asks	What is missing	Level when raised	Blocking item?	Priority	What it exposes	Change that closes it	Owner	Effort	Raised	Earlier planned date	Due	Status	Done	Evidence	Days overdue	Flag	Not closed (1 = yes)

EXAMPLE Gaps

EXAMPLE: the gaps of Acme Corp (EXAMPLE) raised at its assessment of 2026-09-30, read at 2026-11-16. For reading only; the formulas work as on Your Gaps.

Row	Gap	Readiness item	Area	What the item asks	What is missing	Level when raised	Blocking item?	Priority	What it exposes	Change that closes it	Owner	Effort	Raised	Due	Status	Days overdue	Flag	Not closed (1 = yes)
EXAMPLE	GP-01	SC-03	Role and scope	We know every place ePHI lives or moves	We know every place ePHI lives or moves: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Add the support exports, the contractor laptops and the ticketing tool to the ePHI inventory, with an owner for each flow (ER-02, ER-07).	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-02	GV-03	Governance	Leaders approve the risk analysis and oversee the plan	Leaders approve the risk analysis and oversee the plan: now In place	In place	No	Priority 3	An improvement	Put the risk management plan on the executive sponsor's quarterly agenda and record the report.	Security official	Small	30 Sep 2026	29 Mar 2027	Open	0	Not yet due	1
EXAMPLE	GP-03	RA-02	Risk analysis and management	The risk analysis is current	The risk analysis is current: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Review the risk analysis for the new support tooling, record the review date, and keep the earlier version (P31-A04).	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-04	RA-03	Risk analysis and management	A risk management plan reduces risks to a reasonable and appropriate level	A risk management plan reduces risks to a reasonable and appropriate level: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Give every open treatment (ER-01 to ER-08) an owner and a date, and report progress each quarter.	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-05	RA-04	Risk analysis and management	Information system activity is reviewed regularly	Information system activity is reviewed regularly: now Planned	Planned	Yes	Priority 1	A required duty has nothing in place	Start the log review at the interval set (HR-24) by someone who does not administer the system, and keep the sign-off.	Security official	Medium	30 Sep 2026	30 Oct 2026	In progress	17	Overdue	1
EXAMPLE	GP-06	WS-01	Workforce and operations	Access is authorised, cleared and ended for the workforce	Access is authorised, cleared and ended for the workforce: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Bring contractor accounts into the HR leaver feed so access ends on the last day (ER-04; P13).	HR lead	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-07	WS-06	Workforce and operations	Contingency plans are tested and the criticality of data is assessed	Contingency plans are tested and the criticality of data is assessed: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Run and record the failover test to the second hosting region (ER-05; P22).	HR lead	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-08	WS-07	Workforce and operations	An evaluation was done and is repeated	An evaluation was done and is repeated: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Do the evaluation for the changes made since the last one, on 2025-11-20, and record what called for it.	HR lead	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-09	OR-01	Business associates	Every business associate and subcontractor that can reach ePHI is under a written agreement	Every business associate and subcontractor that can reach ePHI is under a written agreement: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Sign the agreement with the ticketing tool's provider, or stop sending patient details to it (ER-07; P31-A05).	Vendor owner	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-10	OR-02	Business associates	The agreements' security terms were checked	The agreements' security terms were checked: now Planned	Planned	Yes	Priority 1	A required duty has nothing in place	Check the hosting agreement against P31-A05, ask the provider for BT-04 and BT-06, and record the answer.	Vendor owner	Medium	30 Sep 2026	30 Oct 2026	In progress	17	Overdue	1
EXAMPLE	GP-11	OR-03	Business associates	The register of business associates is complete	The register of business associates is complete: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Add the ticketing tool and its owner to the register of business associates.	Vendor owner	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-12	PH-03	Physical safeguards	Devices and media are controlled, from receipt to disposal	Devices and media are controlled, from receipt to disposal: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Record each wipe of a retired laptop, with the date and who did it (ER-08).	Facilities lead	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-13	TE-01	Technical safeguards	Every user has a unique identity and emergency access is defined	Every user has a unique identity and emergency access is defined: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Require multi-factor sign-in for support staff and test the emergency access procedure (ER-06; P14).	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-14	TE-03	Technical safeguards	ePHI is protected from alteration and in transit	ePHI is protected from alteration and in transit: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Move support exports to a secure download link and record the encryption decision (ER-01, ER-02).	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-15	DC-02	Documentation	Every addressable specification has a decision on record	Every addressable specification has a decision on record: now Planned	Planned	Yes	Priority 1	A required duty has nothing in place	Write a decision record for each addressable specification, starting with encryption (P31-A07, Addressable Decisions sheet).	Security official	Medium	30 Sep 2026	30 Oct 2026	Open	17	Overdue	1
EXAMPLE	GP-16	BR-02	Breach readiness	Notification is ready to run on its clocks	Notification is ready to run on its clocks: now In place	In place	Yes	Priority 2	A required duty is in place but cannot be shown	Fill the contact list and the notice templates (P18-A09, P18-A10) and record the time of discovery in every incident (P09 IM-13).	Security official	Small	30 Sep 2026	29 Dec 2026	Open	0	Not yet due	1
EXAMPLE	GP-17	BR-04	Breach readiness	The treatment of secured PHI is recorded	The treatment of secured PHI is recorded: now Not started	Not started	No	Priority 3	An improvement	Add a field to the breach assessment (P31-A06) that records how the PHI was secured and that the key was not compromised.	Security official	Small	30 Sep 2026	29 Mar 2027	Open	0	Not yet due	1
EXAMPLE	GP-18	RS-01	Beyond the minimum	Recognised security practices have been in place for at least 12 months and can be shown	Recognised security practices have been in place for at least 12 months and can be shown: now Planned	Planned	No	Priority 3	An improvement	Choose the recognised security practices to rely on and start dating the records that show them (42 U.S.C. 17941).	Security official	Small	30 Sep 2026	29 Mar 2027	Open	0	Not yet due	1
EXAMPLE	GP-19	RS-02	Beyond the minimum	The proposed Security Rule changes are watched	The proposed Security Rule changes are watched: now Not started	Not started	No	Priority 3	An improvement	Name someone to follow the proposed rule (90 FR 898) and report its status each quarter.	Security official	Small	30 Sep 2026	29 Mar 2027	Open	0	Not yet due	1

Items

The 36 items of the HIPAA Security Rule Readiness Self-Assessment. A blocking item rests on a standard or required specification of the Rule. Enter your latest level; the EXAMPLE level is for reference. Add an item of your own on a blank row.

Item ID	Area	Readiness item	Blocking?	Applies to	Operating when	EXAMPLE level	Check
SC-01	Role and scope	Our role under HIPAA is decided, recorded and confirmed	No	All	The applicability assessment is complete, its answers and the result are recorded, counsel confirmed it, and it was reviewed in the last 12 months.	Operating	Enter the latest level
SC-02	Role and scope	Health care components are designated and the designation is kept	Yes	Hybrid entities	A hybrid entity has a written designation of its health care components and keeps it for six years. Not applicable if the entity is not a hybrid entity.	Not applicable	Enter the latest level
SC-03	Role and scope	We know every place ePHI lives or moves	Yes	All	The ePHI inventory covers every system, device, backup, supplier and data flow, names the owner of each, and was reviewed in the last 12 months.	In place	Enter the latest level
GV-01	Governance	A security official is named in writing	Yes	All	One person is named in writing by the executive sponsor, with the date, and the name is in the policy.	Operating	Enter the latest level
GV-02	Governance	Security policies and procedures are written, approved and in force	Yes	All	Written policies and procedures cover every standard, are approved at the level P04 sets, and are available to the people who use them.	Operating	Enter the latest level
GV-03	Governance	Leaders approve the risk analysis and oversee the plan	No	All	The executive sponsor approved the latest risk analysis and receives a report on the risk management plan at the interval the pack sets.	In place	Enter the latest level
GV-04	Governance	A sanction policy exists and is applied	Yes	All	The policy is written and communicated, and the record shows it applied when it was needed.	Operating	Enter the latest level
RA-01	Risk analysis and management	A risk analysis covers all ePHI, accurately and thoroughly	Yes	All	The latest risk analysis follows A04, covers the whole inventory including suppliers, rates every risk on the P05 scale, and is signed by the security official.	Operating	Enter the latest level
RA-02	Risk analysis and management	The risk analysis is current	Yes	All	It was reviewed in the last 12 months and after each trigger since, and every version is kept for six years.	In place	Enter the latest level
RA-03	Risk analysis and management	A risk management plan reduces risks to a reasonable and appropriate level	Yes	All	Every risk above appetite has a treatment, an owner and a date, progress is tracked in the gap tracker (A08), and accepted risks follow P05 RM-08.	In place	Enter the latest level
RA-04	Risk analysis and management	Information system activity is reviewed regularly	Yes	All	Audit logs, access reports and incident reports are reviewed at the set interval by someone who does not administer the system, and the reviews are recorded.	Planned	Enter the latest level
WS-01	Workforce and operations	Access is authorised, cleared and ended for the workforce	Yes	All	Procedures for authorisation or supervision, clearance and termination are written and followed (P13), and the leaver records show access ended on time.	In place	Enter the latest level
WS-02	Workforce and operations	Access to ePHI is authorised by role and reviewed	Yes	All	Access follows minimum necessary roles (P07, P13, P14), is granted and changed through a recorded process, and is reviewed at the interval P07 sets. A clearinghouse that is part of a larger organisation isolates its ePHI from it.	Operating	Enter the latest level
WS-03	Workforce and operations	Everyone in the workforce, including management, is trained	Yes	All	A training and reminder programme covers malicious software, log-in monitoring and passwords (P16), and the records show everyone, including management, was reached.	Operating	Enter the latest level
WS-04	Workforce and operations	Security incidents are identified, handled and documented	Yes	All	Procedures follow P09, every incident has a record with its outcome, and the harmful effects were reduced as far as practicable.	Operating	Enter the latest level
WS-05	Workforce and operations	Backups, recovery and emergency mode are planned	Yes	All	A data backup plan, a disaster recovery plan and an emergency mode operation plan exist and are current (P22, P23).	Operating	Enter the latest level
WS-06	Workforce and operations	Contingency plans are tested and the criticality of data is assessed	Yes	All	A test was run in the last 12 months and revised from its findings, and the applications and data criticality analysis is current. Where a specification was judged not reasonable and appropriate, the record says why.	In place	Enter the latest level
WS-07	Workforce and operations	An evaluation was done and is repeated	Yes	All	A technical and non-technical evaluation was done against the standards, and repeated after the last change that called for one and at least every 12 months.	In place	Enter the latest level
OR-01	Business associates	Every business associate and subcontractor that can reach ePHI is under a written agreement	Yes	All	Each has a signed agreement with the Security Rule content (A05), made before ePHI was shared.	In place	Enter the latest level
OR-02	Business associates	The agreements' security terms were checked	Yes	All	Each agreement was checked against A05's terms before signature, and gaps were recorded and followed up.	Planned	Enter the latest level
OR-03	Business associates	The register of business associates is complete	Yes	All	Every supplier and subcontractor that can reach ePHI is on the register, with the agreement, the owner and the date reviewed (P06).	In place	Enter the latest level
OR-04	Business associates	Plan documents oblige the plan sponsor to safeguard ePHI	Yes	Group health plans	A group health plan's documents are amended as 164.314(b) asks. Not applicable if you are not a group health plan, and a plan that gives its sponsor only summary health information, enrolment status or information under an authorisation may fall outside 164.314(b): ask counsel.	Not applicable	Enter the latest level
PH-01	Physical safeguards	Physical access to systems and facilities is controlled	Yes	All	A facility security plan, access and validation procedures and maintenance records exist, and contingency operations are assessed.	Operating	Enter the latest level
PH-02	Physical safeguards	Workstation use and security are specified and in place	Yes	All	Workstation use is specified and every workstation that reaches ePHI has physical safeguards.	Operating	Enter the latest level
PH-03	Physical safeguards	Devices and media are controlled, from receipt to disposal	Yes	All	Disposal and media re-use are written and recorded, and the accountability and backup-before-move specifications are assessed.	In place	Enter the latest level
TE-01	Technical safeguards	Every user has a unique identity and emergency access is defined	Yes	All	No shared accounts reach ePHI, an emergency access procedure exists and has been tested, and automatic logoff and encryption are assessed (P14). The identity of a person or entity seeking access is verified.	In place	Enter the latest level
TE-02	Technical safeguards	Activity in ePHI systems is recorded and can be examined	Yes	All	Audit controls are on for every system that holds ePHI, the records are protected, and the review (RA-04) uses them.	Operating	Enter the latest level
TE-03	Technical safeguards	ePHI is protected from alteration and in transit	Yes	All	Integrity mechanisms and transmission security are in place, and encryption of ePHI in transit and at rest has been assessed with a recorded decision.	In place	Enter the latest level
DC-01	Documentation	Documentation is kept six years, available and reviewed	Yes	All	Documents are retained for six years from creation or last effect, made available to those who use them, reviewed at least every 12 months, and the register shows the retention end date.	Operating	Enter the latest level
DC-02	Documentation	Every addressable specification has a decision on record	Yes	All	Each addressable specification has an addressable decision record: implemented, an equivalent alternative, or not implemented with the reasons.	Planned	Enter the latest level
BR-01	Breach readiness	A breach assessment procedure is in place and used	Yes	All	The procedure follows A06, assessments are signed and kept, and the exclusions and the four factors are applied to each event.	Operating	Enter the latest level
BR-02	Breach readiness	Notification is ready to run on its clocks	Yes	All	The roles, the templates and the contacts for the notices exist (P18-A09, P18-A10), and the time of discovery is recorded for every incident (P09 IM-13).	In place	Enter the latest level
BR-03	Breach readiness	Smaller breaches are logged for the later notice to the Secretary	Yes	Covered entities	Breaches below the threshold for the notice to the Secretary that goes with the notice to individuals (P09 RD-19, P18-A09) are logged as they are found so that the later notice can be made. Not applicable if you are a business associate only.	Not applicable	Enter the latest level
BR-04	Breach readiness	The treatment of secured PHI is recorded	No	All	Where an event involved encrypted or destroyed PHI, the record shows how the method meets HHS's guidance and that the key was not compromised.	Not started	Enter the latest level
RS-01	Beyond the minimum	Recognised security practices have been in place for at least 12 months and can be shown	No	All	The organisation chose recognised security practices, the record shows they were in place for at least the previous 12 months, and it can show them. This is not required by the Security Rule; it is something the Secretary must consider.	Planned	Enter the latest level
RS-02	Beyond the minimum	The proposed Security Rule changes are watched	No	All	Someone is assigned to follow the status of the proposed rule and to report to the security official when a final rule is published.	Not started	Enter the latest level

Priorities

Priorities and deadlines

How a gap's priority is set, and how many days it has. The days are the pack's, from P10's finding priorities; the Rule sets no deadline for closing a gap.

The three priorities

Priority	What it exposes	When it applies	Days	What the days count
Priority 1	A required duty has nothing in place	A blocking item is Not started or Planned.	30	Calendar days from the date raised, or the earlier planned date
Priority 2	A required duty is in place but cannot be shown	A blocking item is In place but not Operating: the records would not stand up if asked for.	90	Calendar days from the date raised, or the earlier planned date
Priority 3	An improvement	A non-blocking item is below Operating.	180	Calendar days from the date raised, or the earlier planned date

How the priority is set

Level when raised	Blocking item	Item that is not blocking
Not started	Priority 1	Priority 3
Planned	Priority 1	Priority 3
In place	Priority 2	Priority 3
Operating	No gap at this level	No gap at this level
Not applicable	No gap at this level	No gap at this level

A blocking item rests on a standard or a required specification of the Rule; an item that rests on addressable specifications is blocking because the assessment and its record are required. The Items sheet marks each item.

How the due date is set

Due = the date raised plus the priority's days, or the earlier planned date if one was set and it falls before that. A planned date later than the priority allows is ignored. The Due column does this for you; type nothing in it.

Summary

Summary

Counts from the gap sheets at each as-at date: your gaps first, the EXAMPLE below. Counts only; there is no score. Take it to the management review (HR-29).

As-at date (your gaps)		Use today's date, or type =TODAY().
As-at date (EXAMPLE)	16 Nov 2026	EXAMPLE: 47 days after 2026-09-30.

Your gaps

Measure	Count
Not closed (Open, In progress, or no status)	0
Overdue	0
Priority 1 not closed (blocking gaps)	0
Priority 2 not closed	0
Priority 3 not closed	0
Done	0
Withdrawn	0
Items below Operating with no gap (Items sheet)	0

Priority	Days	Status Open	Status In progress	Status Done	Status Withdrawn	Not closed	Overdue
Priority 1	30	0	0	0	0	0	0
Priority 2	90	0	0	0	0	0	0
Priority 3	180	0	0	0	0	0	0
All priorities		0	0	0	0	0	0

Area	Not closed	Overdue	Priority 1	Priority 2	Priority 3	Done or withdrawn
Role and scope	0	0	0	0	0	0
Governance	0	0	0	0	0	0
Risk analysis and management	0	0	0	0	0	0
Workforce and operations	0	0	0	0	0	0
Business associates	0	0	0	0	0	0
Physical safeguards	0	0	0	0	0	0
Technical safeguards	0	0	0	0	0	0
Documentation	0	0	0	0	0	0
Breach readiness	0	0	0	0	0	0
Beyond the minimum	0	0	0	0	0	0
All areas	0	0	0	0	0	0

A gap whose item is not on the Items sheet is counted in no area.

EXAMPLE gaps

Measure	Count
Not closed (Open, In progress, or no status)	19
Overdue	3
Priority 1 not closed (blocking gaps)	3
Priority 2 not closed	12
Priority 3 not closed	4
Done	0
Withdrawn	0

Priority	Days	Status Open	Status In progress	Not closed	Overdue
Priority 1	30	1	2	3	3
Priority 2	90	12	0	12	0
Priority 3	180	4	0	4	0
All priorities		17	2	19	3

Area	Not closed	Overdue	Priority 1	Priority 2	Priority 3
Role and scope	1	0	0	1	0
Governance	1	0	0	0	1
Risk analysis and management	3	1	1	2	0
Workforce and operations	3	0	0	3	0
Business associates	3	1	1	2	0
Physical safeguards	1	0	0	1	0
Technical safeguards	2	0	0	2	0
Documentation	1	1	1	0	0
Breach readiness	2	0	0	1	1
Beyond the minimum	2	0	0	0	2
All areas	19	3	3	12	4

A gap whose item is not on the Items sheet is counted in no area.

Escalation & Review

Escalation and reassessment

HR-29 and HR-30: what happens to a blocking gap at once, and when the readiness self-assessment is repeated.

Escalating a blocking gap (HR-29)

A blocking gap is escalated at once: the security official tells the executive sponsor, the gap goes on the tracker as Priority 1 with an owner and a date, and it is reported at the next management review until it is closed. The pack's deadlines are its own, not the Rule's.

Step	Who	What happens	What you keep
1. Recognise it	Security official	A readiness item on the Items sheet that is blocking and is Not started or Planned gives a Priority 1 gap. Enter the gap at once; do not wait for the next review.	The gap row
2. Tell the sponsor	Security official	Tell the executive sponsor at once, in writing, which item, what is missing and what it exposes. The sponsor does not need the whole tracker.	The message, with its date
3. Owner and date	Security official; executive sponsor	The gap gets one named owner, an effort and a date. The due date is worked out from the priority, or an earlier planned date if one is set.	Owner, Effort, Raised and Earlier planned date
4. Fund or decide	Executive sponsor	The sponsor funds the work or moves people to it. A blocking gap is a duty the Rule asks for, so accepting a risk does not close it: it stays open until the work is done.	The decision, in the Evidence column
5. Report until closed	Security official	Report the gap at each management review until its status is Done, even when it is on time. The Summary sheet is the report.	The review minutes
6. Close it	Owner; security official	Set the status to Done, enter the date and where the record is kept. Do not change the item's level until the next reassessment.	Status, Done and Evidence columns

If a Priority 1 gap passes its date, tell the executive sponsor again, in writing, and record who set the new date and why. An incident or a possible breach found while closing a gap follows P09; the clocks are in P09 RD-17 to RD-20 and P18-A09, not here.

Reassessing (HR-30)

The readiness self-assessment is repeated at least every [[6]] months, after any blocking gap is closed, and after a trigger: a new system or supplier that handles ePHI, a breach, a merger, or a change in the law. The interval is the pack's default, not the Rule's.

When	What triggers it	What to do
On the interval	The readiness self-assessment is repeated at least every [[6]] months. The Rule sets no interval for this; the pack's default is yours to change.	Re-rate every item on the Items sheet.
After a blocking gap is closed	When the last Priority 1 gap is Done, repeat the assessment, so the result is read from the records and not from the tracker.	Re-rate the items that were blocking.
After a trigger	A new system or supplier that handles ePHI, a breach, a merger, or a change in the law.	Re-rate the items the trigger touches; raise new gaps.

After the reassessment: close, as Done, each gap whose item is now Operating, with the date and the record. Raise a gap for each item that has fallen below Operating. Keep the old Summary counts so that you can show the change over time.

Lists

ItemID	Level	Effort	StatusValues	PriorityName	PriorityDays	PriorityExposure
SC-01	Not started	Small	Open	Priority 1	30	A required duty has nothing in place
SC-02	Planned	Medium	In progress	Priority 2	90	A required duty is in place but cannot be shown
SC-03	In place	Large	Done	Priority 3	180	An improvement
GV-01	Operating		Withdrawn
GV-02	Not applicable

GV-03

GV-04

RA-01

RA-02

RA-03

RA-04

WS-01

WS-02

WS-03

WS-04

WS-05

WS-06

WS-07

OR-01

OR-02

OR-03

OR-04

PH-01

PH-02

PH-03

TE-01

TE-02

TE-03

DC-01

DC-02

BR-01

BR-02

BR-03

BR-04

RS-01

RS-02

Definitions

Definitions

Term	Meaning in this workbook
Gap	A readiness item below Operating at the latest assessment, and the work that brings it there.
Blocking gap	A gap on a blocking item that is Not started or Planned: the Rule asks for the duty and nothing is in place. It is Priority 1.
Priority 1: A required duty has nothing in place	A blocking item is Not started or Planned. Due within the days on the Priorities sheet from the date raised, or by an earlier planned date.
Priority 2: A required duty is in place but cannot be shown	A blocking item is In place but not Operating: the records would not stand up if asked for. Due within the days on the Priorities sheet from the date raised, or by an earlier planned date.
Priority 3: An improvement	A non-blocking item is below Operating. Due within the days on the Priorities sheet from the date raised, or by an earlier planned date.
Effort: Small	Under [[2]] weeks of work, inside one team, within budget.
Effort: Medium	[[2]] to [[8]] weeks, or two or more teams, within budget.
Effort: Large	More than [[8]] weeks, or money the budget does not hold.
Readiness level	What your records show against an item of this pack today. It is not a finding that you comply with the law.
Level: Not started	Nothing exists yet.
Level: Planned	Owner and approach agreed; not yet in place.
Level: In place	Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.
Level: Operating	Working in full and meeting its own target, with records a supervisor could sample.
Level: Not applicable	The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel.
Overdue	A gap that is not Done or Withdrawn and whose due date is before the as-at date.
Not closed	A gap that is not Done or Withdrawn, including one with no status yet.
HR-nn	The pack's rules, HR-01 to HR-30. HR-29 and HR-30 are quoted on the Instructions sheet and the Escalation & Review sheet.
EXAMPLE	A worked example: Acme Corp (EXAMPLE) as at 2026-09-30. It is for reading; Your Gaps starts blank.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 10.2 — Nonconformity and corrective action	Your Gaps: each gap corrected, with its cause, the change and the record
NIST CSF 2.0	ID.IM-01 — “Improvements are identified from evaluations”	The tracker: improvements identified from the self-assessment, owned and dated
HIPAA — 45 CFR Parts 160 and 164	§ 164.306 — covered entities and business associates must ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit, and protect against reasonably anticipated threats and impermissible uses and disclosures. They “may use any security measures that allow” them “to reasonably and appropriately implement the standards”, taking into account size, complexity and capabilities, technical infrastructure, “the costs of security measures” and “the probability and criticality of potential risks”. Each implementation specification is “required or addressable”. For an addressable one the entity must assess whether it is “a reasonable and appropriate safeguard in its environment” and then implement it if reasonable and appropriate or, if not, document why and “implement an equivalent alternative measure if reasonable and appropriate”. Security measures are reviewed and modified as needed (§ 164.306(e))	Priorities: security measures reviewed and modified as needed, and the assessment of addressable specifications that raises a gap
HIPAA — 45 CFR Parts 160 and 164	§ 164.308(a)(1) — the security management process standard: “Implement policies and procedures to prevent, detect, contain, and correct security violations.” Its four required implementation specifications are risk analysis (“an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information”), risk management, a sanction policy and information system activity review	Priority 1: risk management is a required specification; the tracker is where the risks and their treatments are followed
HIPAA — 45 CFR Parts 160 and 164	§ 164.316 — policies and procedures in writing (which may be electronic) and a written record of any action, activity or assessment the subpart requires to be documented. Documentation is retained “for 6 years from the date of its creation or the date when it last was in effect, whichever is later”, made available to those who implement the procedures, and reviewed periodically and updated in response to environmental or operational changes	Escalation and Items: the tracker is documentation, kept and reviewed, and updated when the environment changes

Editions referenced: 45 CFR Parts 160 and 164 as the eCFR prints them (current to 6 October 2026); HITECH Act provisions at 42 U.S.C. 17931, 17934 and 17941; HHS Office for Civil Rights guidance on risk analysis, business associates and unsecured protected health information; NIST SP 800-66 Rev. 2 (informative); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); as published and read on 18 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of the HIPAA Rules, or that your organisation holds a certificate.

The HIPAA Rules in 45 CFR Parts 160 and 164 apply to covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions) and, where the Rules provide, to business associates and their subcontractors. Whether your organisation is one of them is decided by what it does with protected health information, and counsel confirms it. The Security Rule (Subpart C) protects electronic protected health information. The Breach Notification Rule (Subpart D) applies to breaches of unsecured protected health information. This pack does not decide which applies to you.