Resources · HIPAA checklist
The Security Rule, in order. Mapped to the workspace.
Checking a box here does not mean OCR will leave you alone. It means the register has the safeguard an examiner will ask for.
Scope
Before you sign another BAA.
- 01
ePHI classification is written.
What you store, what a vendor stores, what is only auth metadata.
- 02
Covered entity vs business associate is decided.
The BAA you sign depends on this. Do not guess in the contract.
- 03
Security official is named.
A person on the control. Not a distribution list.
Safeguards
Inside ReadyComply.
- 01
Risk analysis is current.
Treatments are tasks. A stale PDF is a finding.
- 02
Workforce access and training are filed.
Provisioning matches the Authio org. Training has a roster.
- 03
Incident and contingency have a last test date.
Restore drills belong in evidence.
- 04
BAAs are on file for every ePHI vendor.
A logo is not a contract.
- 05
Technical safeguards have configs, not slogans.
Unique IDs, audit logs, integrity, authentication, transmission.
Evaluation
On a schedule.
- 01
Periodic evaluation is dated.
Findings become tasks. ReadyComply is not OCR.
- 02
Environmental or technical changes trigger a re-evaluation.
A new system, a new vendor, or an incident restarts the clock on the safeguards it touches.
- 03
Business associate evaluations are tracked separately.
Their safeguards are not yours to attest to. Their BAA and their own assurances are what you can actually check.
Also in ReadyComply
Open the modules.
Controls
Scope SOC 2, ISO 27001, HIPAA, and GDPR families to each system. Track status, owner, and why something is out of scope.
Evidence
File what you have against a control. Manual upload or a read-only connector.
Policies
Versioned drafts next to the controls they support. Know which text is current.
Frameworks
All four catalogs.
SOC 2
Trust Services Criteria as a readiness register. The report is still a CPA firm.
ISO 27001
ISMS clauses and Annex A themes. Certification is a body, not this product.
HIPAA
Security Rule safeguard families. A BAA and an OCR review are still yours.
GDPR
Accountability articles for a SaaS register. Not a supervisory-authority opinion.
Guide
Read the longer page.
Open the workspace. Keep the register current.
Sign in. Create the first system. Start with what you can already prove.
Sign in