Fifteen questions. Real citations. No email.

Risk analysis

Can you produce a written, enterprise-wide risk analysis dated within the last 12 months?

Enterprise-wide means every location, every system, and every place ePHI lives. A vulnerability scan is not a risk analysis, and a completed HHS SRA Tool questionnaire has repeatedly failed to satisfy investigators.

45 CFR §164.308(a)(1)(ii)(A)

Risk management

Do you have a dated remediation plan with named owners and evidence that items were completed?

A list of findings is not a risk management plan. The plan needs priorities, an owner per item, target dates, and proof of completion.

45 CFR §164.308(a)(1)(ii)(B)

Business associates

Do you have a current, executed Business Associate Agreement with your IT provider?

A clause inside a master services agreement often does not meet the requirement. Check the date, and check that it names the right legal entity.

45 CFR §164.504(e)

Business associates

Can you list every vendor that holds or touches your ePHI, with executed agreements and renewal dates?

Include the clearinghouse, the billing company, the transcription service, the answering service, the shredding company, and the IT provider’s own subcontractors.

45 CFR §164.308(b)(1)

Access control

Is multi-factor authentication enforced on every path into ePHI, including the VPN, remote desktop, the practice management system, the imaging portal, and the clearinghouse?

MFA on Microsoft 365 alone does not count. The question is whether any path exists that a valid password alone can open.

45 CFR §164.312(d)

Access control

Does every workforce member have a unique login, with no shared front-desk or shared local administrator accounts?

Shared logins are usually defended as clinical workflow. Badge or proximity authentication with fast user switching solves the workflow without destroying attribution.

45 CFR §164.312(a)(2)(i)

Audit controls

Are audit logs retained for at least 12 months and can you actually produce them on request?

Retention and retrievability are different problems. Logs that exist in a system nobody can query are not producible.

45 CFR §164.312(b)

Encryption

Can you produce an encryption status report covering every laptop, desktop, server, and mobile device?

Encryption is addressable, which means implemented or documented as an equivalent alternative. Assumed is neither.

45 CFR §164.312(a)(2)(iv)

Contingency plan

Has a full restore from backup been tested and timed in the last 90 days, with the result written down?

A backup job reporting success is not a restore test. The timing is the artifact, because it is what tells you how long a real recovery takes.

45 CFR §164.308(a)(7)(ii)(D)

Contingency plan

Are your backups immutable and stored where an attacker with domain administrator rights cannot delete them?

If your backup destination is a network share reachable from a compromised server, it is part of the blast radius rather than the recovery plan.

45 CFR §164.308(a)(7)(ii)(A)

Incident response

Have you run an incident response tabletop in the last 12 months, with minutes and after-action items?

A plan that exists only as a Word document nobody has walked through is a plan in name only.

45 CFR §164.308(a)(6)(ii)

Workforce

Can you produce role-based security training completion records, retained six years?

Retained six years is the actual requirement, and it is longer than most learning platforms keep records by default.

45 CFR §164.308(a)(5)

Workforce

Is there a documented record showing access was removed the same day for every departed workforce member in the last year?

Include the practice management system, the clearinghouse, the imaging portal, and any shared vendor accounts, not only email.

45 CFR §164.308(a)(3)(ii)(C)

Device and media

Do you have a current inventory of every device that touches ePHI, including clinical and imaging equipment?

Include the imaging modalities, the anesthesia and monitoring equipment, and anything else the vendor installed and nobody has looked at since.

45 CFR §164.310(d)(2)(iii)

Penalty mitigation

Could you demonstrate 12 rolling months of Recognized Security Practices in place enterprise-wide?

Qualifying practices include NIST CSF, SP 800-53, SP 800-171, and HICP / §405(d). The requirement is documentation of continuous implementation, not a one-time statement.

HITECH §13412