Complete HIPAA Security Rule Checklist

Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports. Minimum monthly review recommended.

Implement procedures for authorization and/or supervision of workforce members who work with ePHI or in locations where it might be accessed. Include role definitions and approval processes.

Implement procedures to determine that workforce member access to ePHI is appropriate. Background checks, reference verification, and security clearance processes.

Implement procedures for terminating access to ePHI when employment ends or as required by changes in job responsibilities. Must include same-day access removal and credential collection.

If a health care clearinghouse is part of larger organization, implement policies and procedures to protect ePHI of clearinghouse from unauthorized access by larger organization. (Only applies to clearinghouses)

Implement policies and procedures for granting access to ePHI (e.g., through access to a workstation, transaction, program, process, or other mechanism). Formal approval and documentation required.

Implement policies and procedures that, based on workforce member access authorization, establish, document, review, and modify access rights. Periodic access reviews required.

Periodic security updates communicated to workforce. Can include email reminders, posters, newsletters about security threats and proper handling of ePHI. Quarterly minimum recommended.

Procedures for guarding against, detecting, and reporting malicious software. Train workforce on recognizing suspicious emails, safe browsing, and download restrictions.

Procedures for monitoring log-in attempts and reporting discrepancies. Train workforce to recognize unauthorized access attempts and report suspicious activity immediately.

Procedures for creating, changing, and safeguarding passwords. Train workforce on strong password creation, secure storage, and prohibition on sharing credentials.

Implement procedures for periodic testing and revision of contingency plans. Annual testing minimum; more frequent testing recommended for critical systems.

Assess relative criticality of specific applications and data in support of other contingency plan components. Prioritize systems by business impact and recovery requirements.

Establish procedures that allow facility access in support of restoration of lost data under disaster recovery and emergency mode operations plan. Define who can access facilities during emergencies.

Implement policies and procedures to safeguard facility and equipment therein from unauthorized physical access, tampering, and theft. Include access controls, surveillance, and security personnel.

Implement procedures to control and validate person's access to facilities based on role or function. Badge systems, visitor logs, escorts for non-employees.

Implement policies and procedures to document repairs and modifications to physical components of facility related to security (e.g., hardware, walls, doors, locks). Log all maintenance activities.

Implement electronic procedures that terminate electronic session after predetermined time of inactivity. 15-minute standard for high-risk areas; 30 minutes acceptable for lower-risk.

Implement mechanism to encrypt and decrypt ePHI. AES-256 minimum for data at rest; TLS 1.2+ for data in transit. Encryption provides safe harbor from breach notification.

Note: While technically "addressable," encryption is effectively required in practice due to breach notification rules and OCR enforcement patterns.