HIPAA Security Rule Readiness Self-Assessment

Rates readiness against the Security Rule items and returns the blocking gaps, in counts and with no score.

Available soon

Answer it online instead: How ready are we for HIPAA?About 25 minutes, free, and nothing is stored.

Format: Excel
Size: 76 KB
Length: 9 sheets
Version: 1.1
Updated: 18 Oct 2026

Follow this documentFree account. We can email you when it changes.

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Before you start, decide your role under HIPAA with the HIPAA Applicability Assessment (P31-A02), and have counsel confirm it. Enter the role and the date of this assessment on the Results sheet.
2	Assess again at the interval HR-30 sets: at least every 6 months, after any blocking gap is closed, and after a trigger.
3	On the Assessment sheet, choose a readiness level for each item from the list. Read the item's 'Operating when' column first: an item is Operating only when it meets all of it and the records could be shown if asked for. When in doubt, choose the lower level.
4	The 'Rests on' column names the standards and specifications (HS-xx) in the Security Rule Safeguard Register; the 'Records to look at' column names the records (EV-xx) in the HIPAA Documentation & Evidence Checklist.
5	Record the evidence you looked at, or the fact that decides the level, in the evidence column. Open the document or the record; do not rely on what people say.
6	Where an 'Operating when' text names a review interval (12 months), that interval is the pack's default and the Rule sets none. Six years, where named, is the Rule's retention period for documentation (164.316(b)(2)(i)).
7	For every item below Operating, say what is missing, name one owner, and estimate the effort (Small, Medium, Large; the Results sheet says what each means). The Check column prompts for anything missing.
8	Use Not applicable only on SC-02, OR-04, BR-03, the items written for one role (the 'Applies to' column), and only where that role is not yours. Give the reason in the evidence column; counsel confirms it. Every other item is a duty of every organisation the Rules cover: Not applicable on it is not accepted, it counts as no answer, and the result reads Incomplete.
9	Read the Results sheet. A blocking gap is escalated at once (HR-29).
10	Copy every gap into the HIPAA Gap & Remediation Tracker (P31-A08). The date of this assessment is the date the gap is raised; the tracker sets the due date. Keep a copy of each completed assessment with the records.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.

The readiness levels:

Not started: Nothing exists yet.

Planned: Owner and approach agreed; not yet in place.

In place: Documented and working, but incomplete, short of its own target, or with too little record for a supervisor to sample.

Operating: Working in full and meeting its own target, with records a supervisor could sample.

Not applicable: The duty does not apply to the entity. The reason must be recorded, and confirmed with counsel. It counts neither for nor against the result.

Blocking items. Every item marked Blocking rests on the Rule's own text: a standard or a required specification of the Security Rule, or the breach notification rules. A blocking item below In place is a blocking gap. An item about addressable specifications is blocking because the assessment of each is required, and a written reason is required where one is not implemented as written; the pack asks for a record of every decision. No one safeguard is required by this. The items that are not blocking (SC-01, GV-03, BR-04, RS-01, RS-02) are preconditions or practices that help you show the work.

The result. Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply with the reason recorded; Not applicable can be chosen only on SC-02, OR-04 and BR-03, which are written for one role, and on any other item it counts as no answer. Incomplete: some item has no answer. The result is about your records against these items. It is not a finding about the law and it is never a score. "Ready" means every item is recorded as Operating: it does not mean HIPAA ready, and an item marked Not applicable is left out of the result, so confirm each one with counsel. Not applicable items count neither for nor against the result.

Gap priority, by exposure. Priority 1 (A required duty has nothing in place): a blocking item is Not started or Planned. Close within 30 days of the assessment. Priority 2 (A required duty is in place but cannot be shown): a blocking item is In place but not Operating: the records would not stand up if asked for. Close within 90 days of the assessment. Priority 3 (An improvement): a non-blocking item is below Operating. Close within 180 days of the assessment. These are the pack's own targets and the Rule sets none. The close-by date is the latest allowed; the tracker keeps an earlier date where a plan already set one.

The rules this workbook applies: HR-29 ("A blocking gap is escalated at once: the security official tells the executive sponsor, the gap goes on the tracker as Priority 1 with an owner and a date, and it is reported at the next management review until it is closed. The pack's deadlines are its own, not the Rule's.") and HR-30 ("The readiness self-assessment is repeated at least every [[6]] months, after any blocking gap is closed, and after a trigger: a new system or supplier that handles ePHI, a breach, a merger, or a change in the law. The interval is the pack's default, not the Rule's."). The other rules are in the pack's documents.

EXAMPLE: Acme Corp (EXAMPLE), a business associate of the clinics it serves, as at 30 Sep 2026. The Results sheet calculates Not ready from its answers (blocking gaps RA-04, OR-02, DC-02); the result is not typed.

Applies to. Most items are for everyone. 'Hybrid entities', 'Group health plans', 'Covered entities' are for organisations in that role; any other organisation marks the item Not applicable, with the reason.

Not covered here. The notification deadlines and who decides to notify (P09 RD-17 to RD-20 and the decision rights; P18-A09 and P18-A10). The Privacy Rule's own duties, which are the covered entity's counsel's. State laws and customer contracts. The proposed Security Rule changes, which are a proposal and are not applied. Anything about paper records.

Tailoring for a small organisation: every standard applies, and the Rule lets you choose measures that fit your size and risks (164.306(b)). One or two people may own most items; estimate effort in the weeks they really have.

Tailoring for IT run by a service provider: rate an item on what you can show, not on what the provider says. The owner is the person who manages the provider, and Operating needs the provider's records to be available to you. Add any customer-contract term as an item on the blank rows at the foot of the Assessment sheet.

Limitations: see the foot of the Results sheet.

Assessment

One row per readiness item. Yellow columns are yours; the columns to the right of Effort calculate. Rate each item against its 'Operating when' column.

Example	Item ID	Area	Readiness item	Rests on (A03 standards and specifications)	Applies to	Operating when	Records to look at (A07)	Blocking?	Readiness level	Evidence and facts (reason, if not applicable)	What is missing (below Operating)	Gap owner (one role)	Effort	Blocking gap?	Gap priority	Close by (latest)	Check	Order (working)	Blocking IDs so far (working)	May be Not applicable (working)	Level counted (working)
EXAMPLE	SC-01	Role and scope	Our role under HIPAA is decided, recorded and confirmed	160.102; 160.103; 164.105 (area basis)	All	The applicability assessment is complete, its answers and the result are recorded, counsel confirmed it, and it was reviewed in the last 12 months.		No	Operating	Applicability assessment (A02) done in March: business associate. Counsel confirmed it in writing.				No	None		OK			No	Operating
EXAMPLE	SC-02	Role and scope	Health care components are designated and the designation is kept	160.102; 160.103; 164.105 (area basis)	Hybrid entities	A hybrid entity has a written designation of its health care components and keeps it for six years. Not applicable if the entity is not a hybrid entity.	EV-26	Yes	Not applicable	Not a covered entity, so no health care components. Counsel confirmed.				No	None		OK			Yes	Not applicable
EXAMPLE	SC-03	Role and scope	We know every place ePHI lives or moves	HS-01.1	All	The ePHI inventory covers every system, device, backup, supplier and data flow, names the owner of each, and was reviewed in the last 12 months.		Yes	In place	Inventory lists 31 systems and 9 data flows with owners. Contractor laptops and ticket attachments are missing.	Add the contractor laptops and the ticketing tool's attachments to the inventory, with owners.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2006		No	In place
EXAMPLE	GV-01	Governance	A security official is named in writing	HS-02	All	One person is named in writing by the executive sponsor, with the date, and the name is in the policy.	EV-03	Yes	Operating	Letter from the chief technology officer names Max Okafor (EXAMPLE); the name is in the policy.				No	None		OK			No	Operating
EXAMPLE	GV-02	Governance	Security policies and procedures are written, approved and in force	HS-21, HS-22	All	Written policies and procedures cover every standard, are approved at the level P04 sets, and are available to the people who use them.	EV-01	Yes	Operating	Policies for all 22 standards approved by the chief technology officer; current versions on the intranet.				No	None		OK			No	Operating
EXAMPLE	GV-03	Governance	Leaders approve the risk analysis and oversee the plan	HS-01	All	The executive sponsor approved the latest risk analysis and receives a report on the risk management plan at the interval the pack sets.		No	In place	The chief technology officer signed the March risk analysis. The plan is reported only when a risk changes.	Set a reporting interval for the risk management plan and put it on the management review agenda.	Security official	Small	No	Priority 3	29 Mar 2027	OK	3009		No	In place
EXAMPLE	GV-04	Governance	A sanction policy exists and is applied	HS-01.3	All	The policy is written and communicated, and the record shows it applied when it was needed.	EV-07	Yes	Operating	Sanction policy in the handbook; two warnings last year, each with the policy step recorded.				No	None		OK			No	Operating
EXAMPLE	RA-01	Risk analysis and management	A risk analysis covers all ePHI, accurately and thoroughly	HS-01.1	All	The latest risk analysis follows A04, covers the whole inventory including suppliers, rates every risk on the P05 scale, and is signed by the security official.	EV-04	Yes	Operating	March risk analysis follows A04, covers both subcontractors, rates 8 risks on the P05 scale, signed by the security official.				No	None		OK			No	Operating
EXAMPLE	RA-02	Risk analysis and management	The risk analysis is current	HS-01.1	All	It was reviewed in the last 12 months and after each trigger since, and every version is kept for six years.	EV-05	Yes	In place	Reviewed in March. The support console added in July is not in it yet.	Add the support console to the risk analysis and record the trigger.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2012		No	In place
EXAMPLE	RA-03	Risk analysis and management	A risk management plan reduces risks to a reasonable and appropriate level	HS-01.2	All	Every risk above appetite has a treatment, an owner and a date, progress is tracked in the gap tracker (A08), and accepted risks follow P05 RM-08.	EV-06	Yes	In place	Each of the 8 risks has a treatment, owner and date, tracked in a spreadsheet, not yet in the gap tracker (A08).	Move the plan's actions into the gap tracker (A08) so progress is tracked in one place.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2013		No	In place
EXAMPLE	RA-04	Risk analysis and management	Information system activity is reviewed regularly	HS-01.4	All	Audit logs, access reports and incident reports are reviewed at the set interval by someone who does not administer the system, and the reviews are recorded.	EV-08	Yes	Planned	Logs are collected but nobody reviews them on a schedule. A weekly review is planned from next month.	Start the weekly log review by someone who does not administer the systems, and record each review.	Security official	Medium	Yes	Priority 1	30 Oct 2026	OK	1014	RA-04	No	Planned
EXAMPLE	WS-01	Workforce and operations	Access is authorised, cleared and ended for the workforce	HS-03	All	Procedures for authorisation or supervision, clearance and termination are written and followed (P13), and the leaver records show access ended on time.	EV-09	Yes	In place	Joiner and leaver steps are followed for staff (P13). Contractor accounts are not in the leaver feed (ER-04).	Bring contractor accounts into the leaver feed and show it in the leaver records.	HR lead	Small	No	Priority 2	29 Dec 2026	OK	2015	RA-04	No	In place
EXAMPLE	WS-02	Workforce and operations	Access to ePHI is authorised by role and reviewed	HS-04	All	Access follows minimum necessary roles (P07, P13, P14), is granted and changed through a recorded process, and is reviewed at the interval P07 sets. A clearinghouse that is part of a larger organisation isolates its ePHI from it.	EV-10	Yes	Operating	Role-based groups; changes by ticket; access review done in July with signed results (P07).				No	None		OK		RA-04	No	Operating
EXAMPLE	WS-03	Workforce and operations	Everyone in the workforce, including management, is trained	HS-05	All	A training and reminder programme covers malicious software, log-in monitoring and passwords (P16), and the records show everyone, including management, was reached.	EV-11	Yes	Operating	Annual course and monthly reminders (P16); records show all staff and the executive team completed it.				No	None		OK		RA-04	No	Operating
EXAMPLE	WS-04	Workforce and operations	Security incidents are identified, handled and documented	HS-06	All	Procedures follow P09, every incident has a record with its outcome, and the harmful effects were reduced as far as practicable.	EV-12	Yes	Operating	Incident procedure follows P09; the last 6 events each have a record and the steps taken to reduce harm.				No	None		OK		RA-04	No	Operating
EXAMPLE	WS-05	Workforce and operations	Backups, recovery and emergency mode are planned	HS-07.1, HS-07.2, HS-07.3	All	A data backup plan, a disaster recovery plan and an emergency mode operation plan exist and are current (P22, P23).	EV-13	Yes	Operating	Backup, disaster recovery and emergency mode plans approved in February (P22, P23).				No	None		OK		RA-04	No	Operating
EXAMPLE	WS-06	Workforce and operations	Contingency plans are tested and the criticality of data is assessed	HS-07.4, HS-07.5	All	A test was run in the last 12 months and revised from its findings, and the applications and data criticality analysis is current. Where a specification was judged not reasonable and appropriate, the record says why.	EV-14	Yes	In place	Restore test run in August with findings. Failover to the second region untested (ER-05); criticality analysis a year old.	Test the failover to the second region; refresh the criticality analysis.	HR lead	Small	No	Priority 2	29 Dec 2026	OK	2020	RA-04	No	In place
EXAMPLE	WS-07	Workforce and operations	An evaluation was done and is repeated	HS-08	All	A technical and non-technical evaluation was done against the standards, and repeated after the last change that called for one and at least every 12 months.	EV-15	Yes	In place	Evaluation done in November 2025. The support console has not been evaluated since it was added.	Evaluate the support console and record the trigger for the evaluation.	HR lead	Small	No	Priority 2	29 Dec 2026	OK	2021	RA-04	No	In place
EXAMPLE	OR-01	Business associates	Every business associate and subcontractor that can reach ePHI is under a written agreement	HS-09, HS-19	All	Each has a signed agreement with the Security Rule content (A05), made before ePHI was shared.	EV-17	Yes	In place	The hosting provider has a signed agreement. The ticketing tool has none (ER-07).	Sign the ticketing tool's agreement, or stop using it for tickets that quote patient details.	Vendor owner	Small	No	Priority 2	29 Dec 2026	OK	2022	RA-04	No	In place
EXAMPLE	OR-02	Business associates	The agreements' security terms were checked	HS-19	All	Each agreement was checked against A05's terms before signature, and gaps were recorded and followed up.		Yes	Planned	Hosting agreement checked against A05: 2 terms missing (BT-04, BT-06), follow-up under way. Ticketing tool not checked.	Close the 2 missing terms with the hosting provider; check the ticketing tool's terms against A05.	Vendor owner	Medium	Yes	Priority 1	30 Oct 2026	OK	1023	RA-04, OR-02	No	Planned
EXAMPLE	OR-03	Business associates	The register of business associates is complete	HS-09	All	Every supplier and subcontractor that can reach ePHI is on the register, with the agreement, the owner and the date reviewed (P06).	EV-16	Yes	In place	Register lists both subcontractors with owner. The ticketing tool's review date is blank.	Fill in the ticketing tool's review date.	Vendor owner	Small	No	Priority 2	29 Dec 2026	OK	2024	RA-04, OR-02	No	In place
EXAMPLE	OR-04	Business associates	Plan documents oblige the plan sponsor to safeguard ePHI	HS-20	Group health plans	A group health plan's documents are amended as 164.314(b) asks. Not applicable if you are not a group health plan, and a plan that gives its sponsor only summary health information, enrolment status or information under an authorisation may fall outside 164.314(b): ask counsel.	EV-18	Yes	Not applicable	Not a group health plan, so no plan sponsor. Counsel confirmed.				No	None		OK		RA-04, OR-02	Yes	Not applicable
EXAMPLE	PH-01	Physical safeguards	Physical access to systems and facilities is controlled	HS-10	All	A facility security plan, access and validation procedures and maintenance records exist, and contingency operations are assessed.	EV-19	Yes	Operating	Offices have badge access with logs; the provider holds the data centres; facility plan and maintenance log kept.				No	None		OK		RA-04, OR-02	No	Operating
EXAMPLE	PH-02	Physical safeguards	Workstation use and security are specified and in place	HS-11, HS-12	All	Workstation use is specified and every workstation that reaches ePHI has physical safeguards.	EV-20	Yes	Operating	Workstation use policy signed by all staff; managed laptops lock automatically.				No	None		OK		RA-04, OR-02	No	Operating
EXAMPLE	PH-03	Physical safeguards	Devices and media are controlled, from receipt to disposal	HS-13	All	Disposal and media re-use are written and recorded, and the accountability and backup-before-move specifications are assessed.	EV-21	Yes	In place	Disposal procedure written. Old laptops are wiped by staff with no record (ER-08).	Record each wipe and keep the certificate.	Facilities lead	Small	No	Priority 2	29 Dec 2026	OK	2028	RA-04, OR-02	No	In place
EXAMPLE	TE-01	Technical safeguards	Every user has a unique identity and emergency access is defined	HS-14, HS-17	All	No shared accounts reach ePHI, an emergency access procedure exists and has been tested, and automatic logoff and encryption are assessed (P14). The identity of a person or entity seeking access is verified.	EV-22	Yes	In place	Unique IDs for all staff; emergency access tested in June. Support console is single-factor (ER-06); 12 contractor laptops lack disk encryption (ER-01).	Require multi-factor sign-in for the support console; encrypt the 12 contractor laptops.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2029	RA-04, OR-02	No	In place
EXAMPLE	TE-02	Technical safeguards	Activity in ePHI systems is recorded and can be examined	HS-15	All	Audit controls are on for every system that holds ePHI, the records are protected, and the review (RA-04) uses them.	EV-24	Yes	Operating	Audit logging is on for the database, support console and hosting accounts; logs are write-protected.				No	None		OK		RA-04, OR-02	No	Operating
EXAMPLE	TE-03	Technical safeguards	ePHI is protected from alteration and in transit	HS-16, HS-18	All	Integrity mechanisms and transmission security are in place, and encryption of ePHI in transit and at rest has been assessed with a recorded decision.	EV-25	Yes	In place	TLS in transit; integrity checks on the database. Encryption of emailed exports is not decided (ER-02).	Record the encryption decision for exports and move exports to a secure download link.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2031	RA-04, OR-02	No	In place
EXAMPLE	DC-01	Documentation	Documentation is kept six years, available and reviewed	HS-22	All	Documents are retained for six years from creation or last effect, made available to those who use them, reviewed at least every 12 months, and the register shows the retention end date.	EV-02, EV-29	Yes	Operating	Document register shows owner, version, approval, next review and the six-year end date; all reviewed this year.				No	None		OK		RA-04, OR-02	No	Operating
EXAMPLE	DC-02	Documentation	Every addressable specification has a decision on record	HS-03, HS-04, HS-05, HS-07, HS-10, HS-13, HS-14, HS-16, HS-18	All	Each addressable specification has an addressable decision record: implemented, an equivalent alternative, or not implemented with the reasons.	EV-23	Yes	Planned	A decision record exists for encryption only; the other 8 standards with addressable specifications have none.	Write the addressable decision record for the 8 standards that lack one.	Security official	Medium	Yes	Priority 1	30 Oct 2026	OK	1033	RA-04, OR-02, DC-02	No	Planned
EXAMPLE	BR-01	Breach readiness	A breach assessment procedure is in place and used	164.402; 164.404 to 164.414 (area basis)	All	The procedure follows A06, assessments are signed and kept, and the exclusions and the four factors are applied to each event.	EV-27	Yes	Operating	Procedure follows A06; the 3 events this year each have a signed assessment.				No	None		OK		RA-04, OR-02, DC-02	No	Operating
EXAMPLE	BR-02	Breach readiness	Notification is ready to run on its clocks	164.402; 164.404 to 164.414 (area basis)	All	The roles, the templates and the contacts for the notices exist (P18-A09, P18-A10), and the time of discovery is recorded for every incident (P09 IM-13).		Yes	In place	Roles and contacts named; templates drafted from P18-A10, not yet approved. Discovery time recorded (P09 IM-13).	Approve the notice templates and test the contact list.	Security official	Small	No	Priority 2	29 Dec 2026	OK	2035	RA-04, OR-02, DC-02	No	In place
EXAMPLE	BR-03	Breach readiness	Smaller breaches are logged for the later notice to the Secretary	164.402; 164.404 to 164.414 (area basis)	Covered entities	Breaches below the threshold for the notice to the Secretary that goes with the notice to individuals (P09 RD-19, P18-A09) are logged as they are found so that the later notice can be made. Not applicable if you are a business associate only.	EV-28	Yes	Not applicable	Not a covered entity. Smaller breaches go to the covered entity customer under the agreement. Counsel confirmed.				No	None		OK		RA-04, OR-02, DC-02	Yes	Not applicable
EXAMPLE	BR-04	Breach readiness	The treatment of secured PHI is recorded	164.402; 164.404 to 164.414 (area basis)	All	Where an event involved encrypted or destroyed PHI, the record shows how the method meets HHS's guidance and that the key was not compromised.		No	Not started	No event has involved encrypted data, and no method for the record is written.	Write down how the record of secured PHI is made, using HHS's guidance.	Security official	Small	No	Priority 3	29 Mar 2027	OK	3037	RA-04, OR-02, DC-02	No	Not started
EXAMPLE	RS-01	Beyond the minimum	Recognised security practices have been in place for at least 12 months and can be shown	42 U.S.C. 17941; 90 FR 898 (area basis)	All	The organisation chose recognised security practices, the record shows they were in place for at least the previous 12 months, and it can show them. This is not required by the Security Rule; it is something the Secretary must consider.	EV-30	No	Planned	A recognised framework is chosen and the plan to put its practices in place is agreed; the 12 months have not started.	Put the practices in place, then keep the records for at least 12 months.	Security official	Small	No	Priority 3	29 Mar 2027	OK	3038	RA-04, OR-02, DC-02	No	Planned
EXAMPLE	RS-02	Beyond the minimum	The proposed Security Rule changes are watched	42 U.S.C. 17941; 90 FR 898 (area basis)	All	Someone is assigned to follow the status of the proposed rule and to report to the security official when a final rule is published.		No	Not started	Nobody is assigned to follow the proposed rule.	Assign a person to follow the proposed rule and report to the security official.	Security official	Small	No	Priority 3	29 Mar 2027	OK	3039	RA-04, OR-02, DC-02	No	Not started

Results

Results

The result, the blocking gaps, readiness by area and every gap in priority order, calculated from the Assessment sheet. Only the yellow settings are yours.

EXAMPLE: the example organisation's self-assessment. Clear the EXAMPLE column and the yellow answers to use your own.

Settings

Date of this assessment	30 Sep 2026	EXAMPLE: the example quarter end. Close-by dates count from it.
Months to the next assessment (HR-30)	6	The [[6]] in HR-30: the pack's default, not the Rule's.
Our role (from the P31-A02 result)	Business associate	From the HIPAA Applicability Assessment. EXAMPLE: the result for the example organisation. Counsel confirms the role.
Assessed by (role)	EXAMPLE: Max Okafor (EXAMPLE), Head of Information Security, the security official	The person who rated the items and checked the evidence.

The result

In one line	Business associate. Not ready: 3 blocking gaps, 16 other items below Operating.
Result	Not ready	Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply with the reason recorded; Not applicable can be chosen only on SC-02, OR-04 and BR-03, which are written for one role, and on any other item it counts as no answer. Incomplete: some item has no answer. The result is about your records against these items. It is not a finding about the law and it is never a score. "Ready" means every item is recorded as Operating: it does not mean HIPAA ready, and an item marked Not applicable is left out of the result, so confirm each one with counsel.
Blocking gaps	3	Each is a Priority 1 gap: listed first below, with its effort.
Blocking gaps, by item ID	RA-04, OR-02, DC-02
Escalate (HR-29)	At once: the security official tells the executive sponsor; each blocking gap goes on the tracker as Priority 1 with an owner and a date; report it at each management review until it is closed.
Next assessment due (HR-30)	30 Mar 2027	Or sooner: after a blocking gap is closed, a new system or supplier that handles ePHI, a breach, a merger or a change in the law.

Readiness by area

Area	Basis (45 CFR)	Items	Operating	In place	Planned	Not started	Not applicable	Not assessed	Result: at Operating	Blocking gaps
Role and scope	160.102; 160.103; 164.105	3	1	1	0	0	1	0	1 of 2 at Operating	0
Governance	164.308(a)(1), (a)(2); 164.316(a)	4	3	1	0	0	0	0	3 of 4 at Operating	0
Risk analysis and management	164.308(a)(1)	4	1	2	1	0	0	0	1 of 4 at Operating	1
Workforce and operations	164.308(a)(3) to (a)(8)	7	4	3	0	0	0	0	4 of 7 at Operating	0
Business associates	164.308(b); 164.314	4	0	2	1	0	1	0	0 of 3 at Operating	1
Physical safeguards	164.310	3	2	1	0	0	0	0	2 of 3 at Operating	0
Technical safeguards	164.312	3	1	2	0	0	0	0	1 of 3 at Operating	0
Documentation	164.306(d); 164.316	2	1	0	1	0	0	0	1 of 2 at Operating	1
Breach readiness	164.402; 164.404 to 164.414	4	1	1	0	1	1	0	1 of 3 at Operating	0
Beyond the minimum	42 U.S.C. 17941; 90 FR 898	2	0	0	1	1	0	0	0 of 2 at Operating	0
All areas		36	14	13	4	2	3	0	14 of 33 at Operating	3
Read the counts, not a percentage: an item In place works but is incomplete or has too little record to show. Items without an Item ID are not counted; Not applicable items are left out of 'at Operating'.

Effort to close the gaps

Effort	Priority 1 (blocking)	Priority 2	Priority 3	All gaps	What it means
Small	0	12	4	16	Under [[2]] weeks of work, inside one team, within budget.
Medium	3	0	0	3	[[2]] to [[8]] weeks, or two or more teams, within budget.
Large	0	0	0	0	More than [[8]] weeks, or money the budget does not hold.
Not estimated	0	0	0	0	Enter the effort on the Assessment sheet.
All gaps	3	12	4	19

Every gap, in priority order (copy into the gap tracker)

No.	Item ID	Readiness item	Priority	Level	What is missing	Owner	Effort	Close by (latest)	Row
1	RA-04	Information system activity is reviewed regularly	Priority 1, blocking	Planned	Start the weekly log review by someone who does not administer the systems, and record each review.	Security official	Medium	30 Oct 2026	11
2	OR-02	The agreements' security terms were checked	Priority 1, blocking	Planned	Close the 2 missing terms with the hosting provider; check the ticketing tool's terms against A05.	Vendor owner	Medium	30 Oct 2026	20
3	DC-02	Every addressable specification has a decision on record	Priority 1, blocking	Planned	Write the addressable decision record for the 8 standards that lack one.	Security official	Medium	30 Oct 2026	30
4	SC-03	We know every place ePHI lives or moves	Priority 2	In place	Add the contractor laptops and the ticketing tool's attachments to the inventory, with owners.	Security official	Small	29 Dec 2026	3
5	RA-02	The risk analysis is current	Priority 2	In place	Add the support console to the risk analysis and record the trigger.	Security official	Small	29 Dec 2026	9
6	RA-03	A risk management plan reduces risks to a reasonable and appropriate level	Priority 2	In place	Move the plan's actions into the gap tracker (A08) so progress is tracked in one place.	Security official	Small	29 Dec 2026	10
7	WS-01	Access is authorised, cleared and ended for the workforce	Priority 2	In place	Bring contractor accounts into the leaver feed and show it in the leaver records.	HR lead	Small	29 Dec 2026	12
8	WS-06	Contingency plans are tested and the criticality of data is assessed	Priority 2	In place	Test the failover to the second region; refresh the criticality analysis.	HR lead	Small	29 Dec 2026	17
9	WS-07	An evaluation was done and is repeated	Priority 2	In place	Evaluate the support console and record the trigger for the evaluation.	HR lead	Small	29 Dec 2026	18
10	OR-01	Every business associate and subcontractor that can reach ePHI is under a written agreement	Priority 2	In place	Sign the ticketing tool's agreement, or stop using it for tickets that quote patient details.	Vendor owner	Small	29 Dec 2026	19
11	OR-03	The register of business associates is complete	Priority 2	In place	Fill in the ticketing tool's review date.	Vendor owner	Small	29 Dec 2026	21
12	PH-03	Devices and media are controlled, from receipt to disposal	Priority 2	In place	Record each wipe and keep the certificate.	Facilities lead	Small	29 Dec 2026	25
13	TE-01	Every user has a unique identity and emergency access is defined	Priority 2	In place	Require multi-factor sign-in for the support console; encrypt the 12 contractor laptops.	Security official	Small	29 Dec 2026	26
14	TE-03	ePHI is protected from alteration and in transit	Priority 2	In place	Record the encryption decision for exports and move exports to a secure download link.	Security official	Small	29 Dec 2026	28
15	BR-02	Notification is ready to run on its clocks	Priority 2	In place	Approve the notice templates and test the contact list.	Security official	Small	29 Dec 2026	32
16	GV-03	Leaders approve the risk analysis and oversee the plan	Priority 3	In place	Set a reporting interval for the risk management plan and put it on the management review agenda.	Security official	Small	29 Mar 2027	6
17	BR-04	The treatment of secured PHI is recorded	Priority 3	Not started	Write down how the record of secured PHI is made, using HHS's guidance.	Security official	Small	29 Mar 2027	34
18	RS-01	Recognised security practices have been in place for at least 12 months and can be shown	Priority 3	Planned	Put the practices in place, then keep the records for at least 12 months.	Security official	Small	29 Mar 2027	35
19	RS-02	The proposed Security Rule changes are watched	Priority 3	Not started	Assign a person to follow the proposed rule and report to the security official.	Security official	Small	29 Mar 2027	36

Order: Priority 1 first, then Priority 2, then Priority 3; within a priority, in the order of the Assessment sheet. The grey Row column is the item's position in the assessment table. To hand a gap over, copy it into the HIPAA Gap & Remediation Tracker (P31-A08), whose fields are: gap, readiness item, what is missing, priority, owner, effort, raised, due, status, done, evidence. The tracker sets each gap's due date: this date or an earlier one a plan already set.

Limitations

This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the blocking items is the best defence against optimism.

The result describes your records against these items. It is not a finding about the law, and it is not legal advice. The Rules provide no certificate of compliance, and no result here is one. Counsel confirms your role (P31-A02) and any Not applicable item.

A blocking item is one that rests on the Rule's text: a standard or a required specification of the Security Rule, or the breach notification rules. Recognised security practices (42 U.S.C. 17941) and the proposed Security Rule changes (90 FR 898) are not duties of the current Rule, and the items about them are never blocking.

A level of Operating on every item makes it likely, not certain, that your records would stand up if asked for. Whether each safeguard is reasonable and appropriate for you is a judgement the risk analysis supports, not this self-assessment.

Effort is an estimate in bands. Use it to plan and to ask for resources, not as a commitment.

The result is one of four words with the counts beside it. Never turn the counts into a percentage, a score or a traffic-light total.

Lists

Level	YesNo	Effort	AreaName	PriorityName	PriorityDays	NaItem
Not started	Yes	Small	Role and scope	Priority 1	30	SC-02
Planned	No	Medium	Governance	Priority 2	90	OR-04
In place		Large	Risk analysis and management	Priority 3	180	BR-03
Operating			Workforce and operations
Not applicable			Business associates

Physical safeguards

Technical safeguards

Documentation

Breach readiness

Beyond the minimum

Definitions

Definitions

Term	Meaning in this workbook
Protected health information (PHI)	Individually identifiable health information held or transmitted in any form or medium, with four exclusions (160.103).
Electronic protected health information (ePHI)	PHI that is transmitted by electronic media or maintained in electronic media. It is what the Security Rule protects.
Covered entity	A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a standard transaction.
Business associate	A person who handles PHI for a covered entity (or for another business associate) in the way 160.103 describes, or provides listed services that involve disclosure of PHI to it. A subcontractor of a business associate that handles PHI for it is a business associate too.
Hybrid entity	A single legal entity that is a covered entity, has both covered and non-covered functions, and has designated its health care components.
Required	The entity must implement it.
Addressable	The entity must assess whether it is a reasonable and appropriate safeguard in its environment, and then implement it, or document why not and implement an equivalent alternative measure if that is reasonable and appropriate. It is never optional and never skipped without a record.
Security official	The one person identified as responsible for developing and implementing the security policies and procedures (164.308(a)(2)).
Breach	An acquisition, access, use or disclosure of PHI not permitted under the Privacy Rule that compromises its security or privacy (164.402), subject to three exclusions and the presumption the definition sets.
Unsecured PHI	PHI that has not been rendered unusable, unreadable or indecipherable through a method HHS specifies in guidance, such as encryption with the key kept safe, or destruction.
Readiness	What your records show against an item of this pack today. It is not a finding that you comply with the law.
Standard and implementation specification	A standard is a requirement of the Security Rule. An implementation specification is a more detailed requirement under a standard, either required or addressable.
Blocking item	An item marked Blocking: it rests on the Rule's own text. Below In place it is a blocking gap: Not started or Planned.
Result	One of four words, with the counts beside it, set out on the Instructions sheet. Never a score.
Recognised security practices	Security practices an organisation chooses, such as a recognised framework. HITECH section 13412 asks the Secretary to consider whether they were in place for the previous 12 months. They are not a duty of the Security Rule.
HR-01 to HR-30	The rules of this pack. HR-29 and HR-30 are quoted on the Instructions sheet.
EXAMPLE	A worked example: Acme Corp (EXAMPLE), as at 2026-09-30. Clear the EXAMPLE column and the yellow answers before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 9.1 — Monitoring, measurement, analysis and evaluation	The workbook as a whole: a planned check of readiness, with its results recorded
NIST CSF 2.0	GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed”	Results: the result and the gaps found, for the management body to oversee
HIPAA — 45 CFR Parts 160 and 164	§ 164.306 — covered entities and business associates must ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit, and protect against reasonably anticipated threats and impermissible uses and disclosures. They “may use any security measures that allow” them “to reasonably and appropriately implement the standards”, taking into account size, complexity and capabilities, technical infrastructure, “the costs of security measures” and “the probability and criticality of potential risks”. Each implementation specification is “required or addressable”. For an addressable one the entity must assess whether it is “a reasonable and appropriate safeguard in its environment” and then implement it if reasonable and appropriate or, if not, document why and “implement an equivalent alternative measure if reasonable and appropriate”. Security measures are reviewed and modified as needed (§ 164.306(e))	DC-02 and the 'Operating when' texts: the general requirements, the factors that decide what is reasonable and appropriate, and the required or addressable treatment of each specification
HIPAA — 45 CFR Parts 160 and 164	§ 164.308(a)(1) — the security management process standard: “Implement policies and procedures to prevent, detect, contain, and correct security violations.” Its four required implementation specifications are risk analysis (“an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information”), risk management, a sanction policy and information system activity review	RA-01 to RA-04 and GV-04: the risk analysis, risk management, sanction policy and information system activity review
HIPAA — 45 CFR Parts 160 and 164	§ 164.308(a)(8) — evaluation: “Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information”. The rule sets no interval	WS-07 and the reassessment rule HR-30: an evaluation, repeated when the environment or operations change
HIPAA — 45 CFR Parts 160 and 164	§ 164.316 — policies and procedures in writing (which may be electronic) and a written record of any action, activity or assessment the subpart requires to be documented. Documentation is retained “for 6 years from the date of its creation or the date when it last was in effect, whichever is later”, made available to those who implement the procedures, and reviewed periodically and updated in response to environmental or operational changes	DC-01: policies and procedures in writing, a written record of each assessment, retained and reviewed
HITECH Act, as codified in 42 U.S.C.	42 U.S.C. 17941 (HITECH Act section 13412, added by Pub. L. 116-321, 5 January 2021) — when determining fines, the length and extent of an audit, or remedies, the Secretary “shall consider whether the covered entity or business associate has adequately demonstrated that it had, for not less than the previous 12 months, recognized security practices in place”. “Recognized security practices” are standards, guidelines, best practices, methodologies, procedures and processes developed under section 272(c)(15) of title 15 and section 1533(d) of title 6, and other cybersecurity programs developed, recognized or promulgated under other statutes; “Such practices shall be determined by the covered entity or business associate, consistent with the HIPAA Security rule”. The Secretary has no authority to increase fines for a lack of such practices, and an entity is not liable for electing not to engage in them	RS-01: recognised security practices in place for the previous 12 months, an item that is never blocking
HHS proposed rule (not in force)	“HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information”, 90 FR 898 (6 January 2025). A notice of proposed rulemaking that would change 45 CFR Parts 160 and 164, chiefly the Security Rule (Subpart C). It is a proposal: comments closed on 7 March 2025 and no final rule was found in the Federal Register on 18 October 2026. The current text of the Security Rule is the text in Part 164 as the eCFR prints it. This pack is written to that text, and does not rely on the proposal	RS-02: following a proposal, which this workbook does not apply and which is never blocking

Editions referenced: 45 CFR Parts 160 and 164 as the eCFR prints them (current to 6 October 2026); HITECH Act provisions at 42 U.S.C. 17931, 17934 and 17941; HHS Office for Civil Rights guidance on risk analysis, business associates and unsecured protected health information; NIST SP 800-66 Rev. 2 (informative); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); as published and read on 18 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of the HIPAA Rules, or that your organisation holds a certificate.

The proposed rule published at 90 FR 898 is a proposal. It is not part of the text this pack applies. Counsel confirms its status before any document is relied on.