How ready are we for HIPAA?

How this is worked out, and what it is not

1. Blocking items. Every item marked Blocking rests on the Rule's own text: a standard or a required specification of the Security Rule, or the breach notification rules. A blocking item below In place is a blocking gap. An item about addressable specifications is blocking because the assessment of each is required, and a written reason is required where one is not implemented as written; the pack asks for a record of every decision. No one safeguard is required by this. The items that are not blocking (SC-01, GV-03, BR-04, RS-01, RS-02) are preconditions or practices that help you show the work.
2. The result. Not ready: at least one blocking item is below In place (a blocking gap). Ready, with actions: no blocking gap, but some items are below Operating. Ready: every item is Operating, or does not apply with the reason recorded; Not applicable can be chosen only on SC-02, OR-04 and BR-03, which are written for one role, and on any other item it counts as no answer. Incomplete: some item has no answer. The result is about your records against these items. It is not a finding about the law and it is never a score. "Ready" means every item is recorded as Operating: it does not mean HIPAA ready, and an item marked Not applicable is left out of the result, so confirm each one with counsel. Not applicable items count neither for nor against the result.
3. Gap priority, by exposure. Priority 1 (A required duty has nothing in place): a blocking item is Not started or Planned. Close within 30 days of the assessment. Priority 2 (A required duty is in place but cannot be shown): a blocking item is In place but not Operating: the records would not stand up if asked for. Close within 90 days of the assessment. Priority 3 (An improvement): a non-blocking item is below Operating. Close within 180 days of the assessment. These are the pack's own targets and the Rule sets none. The close-by date is the latest allowed; the tracker keeps an earlier date where a plan already set one.

Nothing here is scored out of 100 and there is no percentage. Results are in words and counts, and the questions, the levels and the rule are the workbook's: the same answers give the same result in both.

• This is a self-assessment. It is as good as the evidence behind each level. A second person checking the levels of the blocking items is the best defence against optimism.
• The result describes your records against these items. It is not a finding about the law, and it is not legal advice. The Rules provide no certificate of compliance, and no result here is one. Counsel confirms your role (P31-A02) and any Not applicable item.
• A blocking item is one that rests on the Rule's text: a standard or a required specification of the Security Rule, or the breach notification rules. Recognised security practices (42 U.S.C. 17941) and the proposed Security Rule changes (90 FR 898) are not duties of the current Rule, and the items about them are never blocking.
• A level of Operating on every item makes it likely, not certain, that your records would stand up if asked for. Whether each safeguard is reasonable and appropriate for you is a judgement the risk analysis supports, not this self-assessment.
• The result is one of four words with the counts beside it. Never turn the counts into a percentage, a score or a traffic-light total.