HIPAA Compliance Checker

Encryption is documented but not enforced everywhere. Most teams have AES-256 on the production database but miss backups, log files, S3 buckets used for exports, and dev/staging environments that contain real PHI for testing. § 164.312(a)(2)(iv) is addressable, not required, but the OCR position since 2024 is that any PHI in storage without encryption is a presumed breach if accessed.

MFA is enabled for users but not for administrators, service accounts, or break-glass roles. The 2024 Change Healthcare incident — the largest healthcare breach in US history — traced back to a single Citrix account without MFA. Privileged access is exactly where MFA gaps cost the most.

Audit logs exist but are mutable. Logs in the same database as the data they log, or logs that admins can edit, fail the tamper-resistance expectation in § 164.312(b). Tamper-evident log storage (append-only, off-system, with hash chains or WORM storage) is the standard auditors now expect.

BAAs are signed but not tracked. Teams sign BAAs at vendor onboarding and forget about them. When a sub-processor changes (your email provider switches to a new infrastructure vendor, your AI vendor adds a new sub-processor for inference), the BAA chain breaks silently. Quarterly BAA inventory review catches this.

Workforce training is annual and generic. Generic HIPAA training drives policy fatigue. OCR has been clear in recent enforcement actions that role-specific training (developers get encryption and access control content, support staff get social engineering and minimum-necessary content) is the expectation.

Incident response is documented but never tested. Most organizations have an incident response plan they wrote once and never exercised. The first time someone runs the plan should not be during a real breach. Annual tabletop exercises with the engineering team are the lowest-effort high-value control here.

Risk analysis is a checkbox, not a process. § 164.308(a)(1)(ii)(A) requires an accurate and thorough risk analysis of confidentiality, integrity, and availability of all ePHI. A one-time analysis from three years ago does not satisfy the rule. Risk analysis is meant to be ongoing, with documented updates as systems and threats change.

Address every Critical-risk gap first. Critical-flagged items in your report are the controls that map directly to the most-cited deficiencies in OCR settlements. Fixing these reduces both audit exposure and breach-cost exposure most efficiently.

Generate or refresh your written risk analysis. Use the gap report as input. The risk analysis is the document OCR asks for first in every investigation — having a current, comprehensive one is the single highest-leverage compliance artifact you can hold.

Inventory every system, service, and vendor that touches PHI. Map data flows end-to-end. Most gaps surface when you draw the actual flow rather than working from memory. Include AI vendors, email, analytics, observability tools, and any third-party integrations.

Confirm BAAs are signed and current for every business associate. Re-check that the BAA terms still match your actual data sharing relationship — many BAAs signed during early scale predate features your platform now offers.

Schedule a tabletop incident response exercise within 90 days. Run a realistic scenario (ransomware on a server containing PHI; a developer accidentally pushing a database backup to a public bucket; a phishing-driven account takeover). Document what the team got right and what processes failed.