HIPAA Risk Assessment Quiz

Yes, every vendor that touches PHI is covered by a current BAA.

Low vendor-management risk.

Most are covered, but one or two tools still need review.

A small vendor gap still needs cleanup.

I am not sure which vendors need a BAA or whether mine are signed.

Unclear vendor obligations create exposure.

No, I use tools that handle PHI without a signed BAA.

This is a serious compliance gap.

Unique logins, MFA, and least-privilege access are standard.

Access controls are well aligned.

Unique logins exist, but MFA or offboarding is inconsistent.

Controls exist but are not fully mature.

Some access is shared or permissions are broader than they should be.

Access sprawl increases avoidable risk.

Shared accounts or weak passwords are still common.

Unauthorized access risk is high.

All devices are encrypted, updated, and protected with auto-lock and remote wipe.

Endpoint controls are strong.

Most devices are secured, but there are a few inconsistent settings or personal devices.

A partial device policy needs tightening.

I rely on a mix of personal and business devices without a clear standard.

Device posture is hard to defend.

Some devices with PHI access are not encrypted or centrally managed.

Lost-device exposure is substantial.

Through a secure portal or encrypted messaging designed for healthcare.

Client communication is appropriately secured.

Mostly secure, with rare exceptions when clients request regular email or text.

Documented exceptions still matter.

Standard email or text is still common for convenience.

Communication practices need a safer default.

I routinely send PHI through channels that are not secure or documented.

This is a major privacy risk.

I have reliable audit logs for record access and changes.

Accountability is in place.

Some systems log activity, but coverage is incomplete.

Visibility is partial.

I am not sure what gets logged or how I would review it.

Blind spots make incidents harder to manage.

I do not have a practical audit trail for client record activity.

Investigation and accountability are weak.

Within the last 12 months, with documented follow-up items.

Review cadence is healthy.

More than a year ago, but I know what needs updating.

The process needs a refresh.

I have done informal checks, but not a documented review.

Informal review is usually not enough.

I have never completed a documented HIPAA risk review.

This is one of the clearest gaps to fix first.

Training is documented during onboarding and refreshed regularly.

Workforce safeguards are established.

Training exists, but refreshers and documentation are inconsistent.

The process needs more consistency.

Training is mostly verbal or ad hoc.

Expectations are not defensible enough.

There is no real training process beyond common sense.

People risk is high.

We have a documented response plan with escalation, containment, and breach review steps.

Response maturity is solid.

There is a rough process, but it is not fully documented.

The basics exist, but the process is fragile.

I would know who to call, but the steps are not written down.

Response depends on memory under stress.

I do not have a defined incident-response plan.

Incident handling is reactive instead of planned.