Toolkit
HIPAA readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. US covered entities (health plans, clearinghouses, most providers) and their business associates that create, receive, maintain or transmit protected health information.
Scope
- Covers protected health information, with extra technical safeguards for electronic PHI
- Many technology vendors become business associates simply by hosting or processing PHI for a covered entity, even without looking at the data
- Consumer health apps not acting for a covered entity usually fall outside HIPAA, though other laws can still apply
Key requirements
- Run an accurate, thorough, enterprise-wide risk analysis covering all electronic PHI — the foundation the Security Rule builds on
- Implement administrative, physical and technical safeguards; assess every 'addressable' specification rather than treating it as optional
- Apply the minimum necessary standard and keep a current Notice of Privacy Practices
- Sign a business associate agreement before any business associate creates, receives, maintains or transmits PHI
- Notify affected individuals without unreasonable delay and within 60 calendar days of discovering a breach; notify HHS, and the media for breaches over 500 people
- Train the workforce and keep documentation for six years from creation or last effective date
Evidence to gather
- Risk analysis and risk management plan, kept current
- Policies and procedures for privacy, security and breach response
- Business associate agreements, upstream and downstream
- Workforce training records
- Access and audit log reviews
- Breach register and notifications sent
- Contingency and backup testing evidence
Common gaps
- Claiming to be 'HIPAA certified' — there is no such government certification
- A risk analysis that covers only the EHR and leaves out email, backups, laptops and SaaS tools
- Treating 'addressable' specifications as optional instead of assessing and documenting the decision
- Assuming the cloud provider's BAA covers everything — configuration and access remain a shared responsibility
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full HIPAA guide, the official text, or a qualified adviser.