Session tools

HITECH on a Shoestring

Modernizing practice IT without losing the human touch

Three tools for a small outpatient practice with no IT staff: a framework that shows what good looks like and what it costs, a worksheet for deciding whether a new technology earns its place, and a starting AI policy.

Required

A HIPAA Security Rule requirement applies, including addressable specifications you implement or document an alternative for.

Best practice

Federal guidance recommends it, and the proposed Security Rule update may make it required.

Optional

It can help. Run it through the Human Filter Worksheet before you buy.

On a budget

Not a tier. It marks the low-cost route for each item in the framework.

Doing the exercise from the session?Open the one-page Required items checklist. Mark each item done, partial or missing, then circle the first two missing items.

Use the tools online

Fill them in on your phone or computer and download the result as Excel, PDF or Word. Your answers stay in your browser; nothing is sent anywhere.

Tool 1

Technology framework and assessment checklist

Mark every item in the four pillars done, partial or missing. Your first two fixes and a 30, 90 and 180 day roadmap build as you go.

Download: Excel, PDF

Start the checklist → Tool 2

Human Filter

Score a technology you're considering on Presence, Displacement, Failure mode, Ownership and Exit, and record whether to adopt, pilot or decline.

Download: PDF, Word

Score a tool → Tool 3

AI use policy builder

Name your approved tools and policy owner, then download a two-page policy with a staff signature page.

Download: Word, PDF

Build your policy →

Printable and editable files

The same three tools as files, for printing or for working offline.

Tiered Technology Framework and Assessment Checklist

Every technology category across the four pillars (secure infrastructure, clinical systems, patient engagement and business intelligence), with its tier, regulatory basis, typical cost range and low-cost route. Mark where your practice stands, and the Roadmap tab sorts what's missing into a 30, 90 and 180 day plan. Plan on 10 minutes for the Required rows and about 45 for everything.

Tabs: Start here, Framework, My practice, Offboarding checklist, Systems inventory, Cyber coverage questions, Roadmap, Required items.

Human Filter Worksheet

Score any technology you're considering on five questions before you adopt it: Presence, Displacement, Failure mode, Ownership and Exit. The total and two gate questions point to adopt, pilot or decline, and you write down the reason in a sentence your staff could repeat. Page 2 works through an ambient AI scribe as an example. Takes 10 to 15 minutes with one clinician and one front desk person.

Sample AI Use Policy

A two-page starting policy built on four rules: one approved tool, signed in to a practice account covered by a business associate agreement (BAA); the minimum patient information the task needs; clinicians own every decision, note and bill; and no personal accounts or unapproved tools. Fill in the bracketed fields and have staff sign the second page. Review it with your attorney before you adopt it.

Free federal tools

These help you document the security work you already do. All are free from the U.S. Department of Health and Human Services.

HHS Security Risk Assessment Tool
Built for small and medium practices. Produces the dated, documented risk analysis that OCR asks for. Runs on Windows, or as an Excel workbook on any computer.
HHS Cybersecurity Performance Goals
Essential goals (MFA, email security, training, patching, incident planning) and Enhanced goals. Best practice rows in the framework map to these.
405(d) Health Industry Cybersecurity Practices, Technical Volume 1
The 2023 edition, written for small healthcare organizations, including the cyber insurance sub-practice. PDF.
HIPAA Security Rule, 45 CFR Part 164 Subpart C
The current regulation text. Every Required row in the framework cites its section here.

Why the paperwork matters. Since a 2021 amendment to HITECH (Pub. L. 116-321), regulators investigating a breach must consider whether you followed recognized security practices, such as the 405(d) practices, for the prior 12 months. It can lower penalties. It is not a safe harbor, and a policy on file without evidence that you follow it does not count.

A proposed update to the Security Rule (published January 2025) would make MFA and encryption mandatory and require removing a departing employee's access within one hour. It is not final. The tools mark each row it would change.