# HIPAA compliance assessment
> Source: https://legalcode.md/skills/legalcode-hipaa-compliance-assessment | [HTML version](https://legalcode.md/skills/legalcode-hipaa-compliance-assessment)

HIPAA compliance assessment for covered entities and business associates covering the Security Rule (45 CFR Part 164 Subpart C), Privacy Rule (45 CFR Part 164 Subpart E), and Breach Notification Rule (45 CFR Part 164 Subpart D).

HIPAA compliance assessment for covered entities and business associates covering the Security Rule (45 CFR Part 164 Subpart C), Privacy Rule (45 CFR Part 164 Subpart E), and Breach Notification Rule (45 CFR Part 164 Subpart D). Assesses all administrative safeguards (security management process, workforce security, information access management, security awareness and training, contingency planning, evaluation, and business associate oversight), physical safeguards (facility access, workstation security, device and media controls), and technical safeguards (access controls, audit controls, integrity, authentication, and transmission security). Evaluates Privacy Rule obligations including minimum necessary standard, individual rights (access, amendment, accounting, restriction, confidential communications), Notice of Privacy Practices, and authorization requirements. Incorporates 2024-2025 Security Rule NPRM awareness (mandatory MFA, encryption mandates, 72-hour restoration, network segmentation) as emerging requirements to prepare for. Assesses business associate agreement completeness under 45 CFR 164.504(e) and 164.314. Produces Security Risk Analysis documentation structured to meet OCR audit expectations and NIST SP 800-66r2 guidance, with COMPLIANT/PARTIAL/NON-COMPLIANT/CRITICAL DEFICIENCY classification, prioritized remediation roadmaps, and Glass Box audit trail. Use when a covered entity or business associate needs to determine compliance posture, prepare for OCR audit, conduct an annual security evaluation under 45 CFR 164.308(a)(8), respond to a security incident, assess a new technology deployment involving ePHI, or build a HIPAA compliance program from scratch.

This skill assesses an organization's compliance posture across all three HIPAA rules: the Security Rule, Privacy Rule, and Breach Notification Rule. It is designed for use by covered entities (health plans, healthcare clearinghouses, healthcare providers) and business associates, and supports both initial assessments and annual evaluations. **Covers:** - Covered entity and business associate determination (45 CFR 160.103) - All 18 Security Rule standards and implementation specifications (45 CFR 164.308/310/312/314/316) - Required vs. Addressable implementation specification analysis - Security Risk Analysis (SRA) documentation framework (45 CFR 164.308(a)(1)) - Annual Security Rule evaluation (45 CFR 164.308(a)(8)) - Privacy Rule obligations: minimum necessary, individual rights, NPP, authorization - Breach Notification Rule: four-factor risk assessment, notification timelines, HHS reporting - Business Associate Agreement (BAA) completeness review (45 CFR 164.504(e), 164.314) - HITECH overlay: expanded BA liability, enhanced penalties, notification obligations - 2024-2025 Security Rule NPRM awareness — emerging requirements [VERIFY finalization status] - NIST SP 800-66r2 (February 2024) implementation guidance alignment - OCR enforcement patterns and Security Risk Analysis Initiative findings - State law preemption analysis (CMIA, Texas MRPA, 42 CFR Part 2 overlay) - Remediation roadmap with IMMEDIATE / NEAR-TERM / BACKGROUND prioritization **Does not:** - Certify HIPAA compliance — compliance certifications require ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*