# IHS HIPAA Security Checklist

+--------------+----------------------------------------+--------------+
| HIPAA        | Safeguard                              | Status       |
| Security     |                                        |              |
| Rule         | \(R\) = Required, (A) = Addressable    | Complete,    |
| Reference    |                                        | n/a          |
+--------------+----------------------------------------+--------------+
| **Ad         |                                        |              |
| ministrative |                                        |              |
| Safeguards** |                                        |              |
+--------------+----------------------------------------+--------------+
| **164.30     | **Security Management Process:         | []{.mark}    |
| 8(a)(1)(i)** | Implement policies and procedures to   |              |
|              | prevent, detect, contain, and correct  |              |
|              | security violations.**                 |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Has a Risk Analysis been completed IAW |              |
| a)(1)(ii)(A) | NIST Guidelines? (R)                   |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Has the Risk Management process been   |              |
| a)(1)(ii)(B) | completed IAW NIST Guidelines? (R)     |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Do you have formal sanctions against   |              |
| a)(1)(ii)(C) | employees who fail to comply with      |              |
|              | security policies and procedures? (R)  |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented procedures to     |              |
| a)(1)(ii)(D) | regularly review records of IS         |              |
|              | activity such as audit logs, access    |              |
|              | reports, and security incident         |              |
|              | tracking? (R)                          |              |
+--------------+----------------------------------------+--------------+
| 1            | **Assigned Security Responsibility:    | COMPLETE     |
| 64.308(a)(2) | Identify the security official who is  |              |
|              | responsible for the development and    |              |
|              | implementation of the policies and     |              |
|              | procedures required by this subpart    |              |
|              | for the entity.**                      |              |
+--------------+----------------------------------------+--------------+
| 164.         | **Workforce Security: Implement        |              |
| 308(a)(3)(i) | policies and procedures to ensure that |              |
|              | all members of its workforce have      |              |
|              | appropriate access to EPHI, as         |              |
|              | provided under paragraph (a)(4) of     |              |
|              | this section, and to prevent those     |              |
|              | workforce members who do not have      |              |
|              | access under paragraph (a)(4) of this  |              |
|              | section from obtaining access to       |              |
|              | electronic protected health            |              |
|              | information (EPHI).**                  |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented procedures for    |              |
| a)(3)(ii)(A) | the authorization and/or supervision   |              |
|              | of employees who work with EPHI or in  |              |
|              | locations where it might be accessed?  |              |
|              | (A)                                    |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented procedures to     |              |
| a)(3)(ii)(B) | determine that the Access of an        |              |
|              | employee to EPHI is appropriate? (A)   |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented procedures for    |              |
| a)(3)(ii)(C) | terminating access to EPHI when an     |              |
|              | employee leaves you organization or as |              |
|              | required by paragraph (a)(3)(ii)(B) of |              |
|              | this section? (A)                      |              |
+--------------+----------------------------------------+--------------+
| 164.         | **Information Access Management:       |              |
| 308(a)(4)(i) | Implement policies and procedures for  |              |
|              | authorizing access to EPHI that are    |              |
|              | consistent with the applicable         |              |
|              | requirements of subpart E of this      |              |
|              | part.**                                |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | If you are a clearinghouse that is     |              |
| a)(4)(ii)(A) | part of a larger organization, have    |              |
|              | you implemented policies and           |              |
|              | procedures to protect EPHI from the    |              |
|              | larger organization? (A)               |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented policies and      |              |
| a)(4)(ii)(B) | procedures for granting access to      |              |
|              | EPHI, for example, through access to a |              |
|              | workstation, transaction, program, or  |              |
|              | process? (A)                           |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented policies and      |              |
| a)(4)(ii)(C) | procedures that are based upon your    |              |
|              | access authorization policies,         |              |
|              | established, document, review, and     |              |
|              | modify a user's right of access to a   |              |
|              | workstation, transaction, program, or  |              |
|              | process? (A)                           |              |
+--------------+----------------------------------------+--------------+
| 164.         | **Security Awareness and Training:     |              |
| 308(a)(5)(i) | Implement a security awareness and     |              |
|              | training program for all members of    |              |
|              | its workforce (including               |              |
|              | management).**                         |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Do you provide periodic information    |              |
| a)(5)(ii)(A) | security reminders? (A)                |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Do you have policies and procedures    |              |
| a)(5)(ii)(B) | for guarding against, detecting, and   |              |
|              | reporting malicious software? (A)      |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Do you have procedures for monitoring  |              |
| a)(5)(ii)(C) | login attempts and reporting           |              |
|              | discrepancies? (A)                     |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Do you have procedures for creating,   |              |
| a)(5)(ii)(D) | changing, and safeguarding passwords?  |              |
|              | (A)                                    |              |
+--------------+----------------------------------------+--------------+
| 164.         | **Security Incident Procedures:        |              |
| 308(a)(6)(i) | Implement policies and procedures to   |              |
|              | address security incidents.**          |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Do you have procedures to identify and |              |
| 08(a)(6)(ii) | respond to suspected or know security  |              |
|              | incidents; mitigate to the extent      |              |
|              | practicable, harmful effects of known  |              |
|              | security incidents; and document       |              |
|              | incidents and their outcomes? (R)      |              |
+--------------+----------------------------------------+--------------+
| 164.         | **Contingency Plan: Establish (and     |              |
| 308(a)(7)(i) | implement as needed) policies and      |              |
|              | procedures for responding to an        |              |
|              | emergency or other occurrence (for     |              |
|              | example, fire, vandalism, system       |              |
|              | failure, and natural disaster) that    |              |
|              | damages systems that contain EPHI.**   |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you established and implemented   |              |
| a)(7)(ii)(A) | procedures to create and maintain      |              |
|              | retrievable exact copies of EPHI? (R)  |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you established (and implemented  |              |
| a)(7)(ii)(B) | as needed) procedures to restore any   |              |
|              | loss of EPHI data that is stored       |              |
|              | electronically? (R)                    |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you established (and implemented  |              |
| a)(7)(ii)(C) | as needed) procedures to enable        |              |
|              | continuation of critical business      |              |
|              | processes and for protection of EPHI   |              |
|              | while operating in the emergency mode? |              |
|              | (R)                                    |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you implemented procedures for    |              |
| a)(7)(ii)(D) | periodic testing and revision of       |              |
|              | contingency plans? (A)                 |              |
+--------------+----------------------------------------+--------------+
| 164.308(     | Have you assessed the relative         |              |
| a)(7)(ii)(E) | criticality of specific applications   |              |
|              | and data in support of other           |              |
|              | contingency plan components? (A)       |              |
+--------------+----------------------------------------+--------------+
| 1            | **Have you established a plan for      |              |
| 64.308(a)(8) | periodic technical and non technical   |              |
|              | evaluation, based initially upon the   |              |
|              | standards implemented under this rule  |              |
|              | and subsequently, in response to       |              |
|              | environmental or operational changes   |              |
|              | affecting the security of EPHI, that   |              |
|              | establishes the extent to which an     |              |
|              | entity's security policies and         |              |
|              | procedures meet the requirements of    |              |
|              | this subpart? (R)**                    |              |
+--------------+----------------------------------------+--------------+
| 1            | **Business Associate Contracts and     |              |
| 64.308(b)(1) | Other Arrangements: A covered entity,  |              |
|              | in accordance with Sec. 164.306, may   |              |
|              | permit a business associate to create, |              |
|              | receive, maintain, or transmit EPHI on |              |
|              | the covered entity's behalf only of    |              |
|              | the covered entity obtains             |              |
|              | satisfactory assurances, in accordance |              |
|              | with Sec. 164.314(a) that the business |              |
|              | associate appropriately safeguard the  |              |
|              | information.**                         |              |
+--------------+----------------------------------------+--------------+
| 1            | Have you established written contracts |              |
| 64.308(b)(4) | or other arrangements with your        |              |
|              | trading partners that documents        |              |
|              | satisfactory assurances required by    |              |
|              | paragraph (b)(1) of this section that  |              |
|              | meets the applicable requirements of   |              |
|              | Sec. 164.314(a)? (R)                   |              |
+--------------+----------------------------------------+--------------+
| **Physical   |                                        |              |
| Safeguards** |                                        |              |
+--------------+----------------------------------------+--------------+
| 1            | **Facility Access Controls: Implement  |              |
| 64.310(a)(1) | policies and procedures to limit       |              |
|              | physical access to its electronic      |              |
|              | information systems and the facility   |              |
|              | or facilities in which they are        |              |
|              | housed, while ensuring that properly   |              |
|              | authorized access is allowed.**        |              |
+--------------+----------------------------------------+--------------+
| 164.         | Have you established (and implemented  |              |
| 310(a)(2)(i) | as needed) procedures that allow       |              |
|              | facility access in support of          |              |
|              | restoration of lost data under the     |              |
|              | disaster recovery plan and emergency   |              |
|              | mode operations plan in the event of   |              |
|              | an emergency? (A)                      |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you implemented policies and      |              |
| 10(a)(2)(ii) | procedures to safeguard the facility   |              |
|              | and the equipment therein from         |              |
|              | unauthorized physical access,          |              |
|              | tampering, and theft? (A)              |              |
+--------------+----------------------------------------+--------------+
| 164.31       | Have you implemented procedures to     |              |
| 0(a)(2)(iii) | control and validate a person's access |              |
|              | to facilities based on their role or   |              |
|              | function, including visitor control,   |              |
|              | and control of access to software      |              |
|              | programs for testing and revision? (A) |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you implemented policies and      |              |
| 10(a)(2)(iv) | procedures to document repairs and     |              |
|              | modifications to the physical          |              |
|              | components of a facility, which are    |              |
|              | related to security (for example,      |              |
|              | hardware, walls, doors, and locks)?    |              |
|              | (A)                                    |              |
+--------------+----------------------------------------+--------------+
| 164.310(b)   | **Have you implemented policies and    |              |
|              | procedures that specify the proper     |              |
|              | functions to be performed, the manner  |              |
|              | in which those functions are to be     |              |
|              | performed, and the physical attributes |              |
|              | of the surroundings of a specific      |              |
|              | workstation or class of workstation    |              |
|              | that can access EPHI? (R)**            |              |
+--------------+----------------------------------------+--------------+
| 164.310(c)   | **Have you implemented physical        |              |
|              | safeguards for all workstations that   |              |
|              | access EPHI to restrict access to      |              |
|              | authorized users? (R)**                |              |
+--------------+----------------------------------------+--------------+
| 1            | **Device and Media Controls: Implement |              |
| 64.310(d)(1) | policies and procedures that govern    |              |
|              | the receipt and removal of hardware    |              |
|              | and electronic media that contain EPHI |              |
|              | into and out of a facility, and the    |              |
|              | movement of these items within the     |              |
|              | facility.**                            |              |
+--------------+----------------------------------------+--------------+
| 164.         | Have you implemented policies and      |              |
| 310(d)(2)(i) | procedures to address final            |              |
|              | disposition of EPHI, and/or hardware   |              |
|              | or electronic media on which it is     |              |
|              | stored? (R)                            |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you implemented procedures for    |              |
| 10(d)(2)(ii) | removal of EPHI from electronic media  |              |
|              | before the media are available for     |              |
|              | reuse? (R)                             |              |
+--------------+----------------------------------------+--------------+
| 164.31       | Do you maintain a record of the        |              |
| 0(d)(2)(iii) | movements of hardware and electronic   |              |
|              | media and the person responsible for   |              |
|              | its movement? (A)                      |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Do you create a retrievable, exact     |              |
| 10(d)(2)(iv) | copy of EPHI, when needed, before      |              |
|              | movement of equipment? (A)             |              |
+--------------+----------------------------------------+--------------+
| **Technical  |                                        |              |
| Safeguards** |                                        |              |
+--------------+----------------------------------------+--------------+
| 1            | **Access Controls: Implement technical |              |
| 64.312(a)(1) | policies and procedures for electronic |              |
|              | information systems that maintain EPHI |              |
|              | to allow access only to those persons  |              |
|              | or software programs that have been    |              |
|              | granted access rights as specified in  |              |
|              | Sec. 164.308(a)(4).**                  |              |
+--------------+----------------------------------------+--------------+
| 164.         | Have you assigned a unique name and/or |              |
| 312(a)(2)(i) | number for identifying and tracking    |              |
|              | user identity? (R)                     |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you established (and implemented  |              |
| 12(a)(2)(ii) | as needed) procedures for obtaining    |              |
|              | for obtaining necessary EPHI during    |              |
|              | and emergency? (R)                     |              |
+--------------+----------------------------------------+--------------+
| 164.31       | Have you implemented procedures that   |              |
| 2(a)(2)(iii) | terminate an electronic session after  |              |
|              | a predetermined time of inactivity?    |              |
|              | (A)                                    |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you implemented a mechanism to    |              |
| 12(a)(2)(iv) | encrypt and decrypt EPHI? (A)          |              |
+--------------+----------------------------------------+--------------+
| 164.312(b)   | **Have you implemented Audit Controls, |              |
|              | hardware, software, and/or procedural  |              |
|              | mechanisms that record and examine     |              |
|              | activity in information systems that   |              |
|              | contain or use EPHI? (R)**             |              |
+--------------+----------------------------------------+--------------+
| 1            | **Integrity: Implement policies and    |              |
| 64.312(c)(1) | procedures to protect EPHI from        |              |
|              | improper alteration or destruction.**  |              |
+--------------+----------------------------------------+--------------+
| 1            | Have you implemented electronic        |              |
| 64.312(c)(2) | mechanisms to corroborate that EPHI    |              |
|              | has not been altered or destroyed in   |              |
|              | an unauthorized manner? (A)            |              |
+--------------+----------------------------------------+--------------+
| 164.312(d)   | **Have you implemented Person or       |              |
|              | Entity Authentication procedures to    |              |
|              | verify that a person or entity seeking |              |
|              | access EPHI is the one claimed? (R)**  |              |
+--------------+----------------------------------------+--------------+
| 1            | **Transmission Security: Implement     |              |
| 64.312(e)(1) | technical security measures to guard   |              |
|              | against unauthorized access to EPHI    |              |
|              | that is being transmitted over an      |              |
|              | electronic communications network.**   |              |
+--------------+----------------------------------------+--------------+
| 164.         | Have you implemented security measures |              |
| 312(e)(2)(i) | to ensure that electronically          |              |
|              | transmitted EPHI is not improperly     |              |
|              | modified without detection until       |              |
|              | disposed of? (A)                       |              |
+--------------+----------------------------------------+--------------+
| 164.3        | Have you implemented a mechanism to    |              |
| 12(e)(2)(ii) | encrypt EPHI whenever deemed           |              |
|              | appropriate? (A)                       |              |
+--------------+----------------------------------------+--------------+