Tool 1 of 3
Technology framework and assessment checklist
Mark where your practice stands on every item in the four pillars. The roadmap builds itself as you go.
Start with the purple Required rows (about 10 minutes), then work through the rest (about 45 minutes). Open any row to see what good looks like, the regulatory basis, the typical cost and the low-cost route.
Your answers stay on this device. Nothing you type is sent anywhere. The page saves your work in this browser so you can come back to it, and the download buttons build the files on your device. Use a shared computer? Select Clear when you finish.
A HIPAA Security Rule requirement applies, including addressable specifications you implement or document an alternative for.
Federal guidance recommends it, and the proposed Security Rule update may make it required.
It can help. Score it with the Human Filter before you buy.
Not a tier. Each row's details show the lowest-cost route that still meets the need.
Your roadmap
Builds from every row marked Missing or Partial, Required firstYour first two fixes: the first two Required rows marked Missing. In the session exercise, these are the two you circle.
Working checklists
Included in your Excel and PDF downloadsOffboarding checklist one departing person at a time
Required (addressable): 164.308(a)(3)(ii)(C) termination procedures. The proposed Security Rule update would require access removed no later than one hour after employment ends.
Systems inventory every system that touches patient information
Each integration adds a BAA, a failure point and another copy of patient data. List every system, then use it for rows P1-15, P2-01 and P2-02.
| Layer | System | Holds PHI | BAA on file | Suite sign-in | Owner | How to export | Renewal | Remove |
|---|
Cyber coverage questions ask your agent in writing
From the policy itself
Cyber coverage is not a HIPAA requirement. Pricing is quote-based and varies widely with revenue, record count and the controls in place.
About the sources
HIPAA Security Rule citations (45 CFR Part 164, Subpart C) were checked against the eCFR as of October 23, 2026. (R) marks a required implementation specification and (A) an addressable one. Notes marked NPRM refer to the proposed Security Rule update published January 6, 2025. It is not final, and the current rule remains in force.
Typical costs are category-level ranges at list price, checked in November 2026. They span several vendors and change often, so get current quotes before you budget. Google Workspace and Microsoft 365 are named together as examples of a productivity suite; no other products are named.