Every domain of MTC Group's HIPAA Compliance Checklist, free to read, covering both covered entities and business associates. The same real §-citations that power the live platform. Create a free account to print any domain, or the whole guide, as a PDF.
Want the whole thing at once?
View the full checklist and print or save it as one PDF.
Risk analysis, a risk management plan, and the sanction policy that backs it up.
14 checklist items →
Who gets access when they join, what happens when they leave, and annual security awareness training.
14 checklist items →
Role-based access, unique user IDs, and the access-authorization paper trail.
7 checklist items →
An incident response plan, the four-factor breach test, and the notification clocks: a business associate reports to its covered entities, a covered entity notifies patients, HHS, and the media.
13 checklist items →
Data backup, disaster recovery, and emergency-mode operations when systems go down.
9 checklist items →
Facility access controls, workstation security, and device/media disposal.
19 checklist items →
Encryption, audit logging, transmission security, and automatic logoff.
20 checklist items →
Signed BAAs before any PHI moves: a covered entity obtains assurances from every business associate, a business associate flows the same restrictions down to its subcontractors.
11 checklist items →
Minimum necessary, permitted uses and disclosures, verification of who is asking, and the individual-rights support each entity type owes.
8 checklist items →
Six-year retention and an evidence trail an auditor can actually follow.
4 checklist items →
The NIST CSF 2.0 governance bridge behind Recognized Security Practices, real HITECH mitigating-factor credit if you can show twelve continuous months of it.
1 checklist item →
A covered entity's own direct Privacy Rule duties to patients, notice, access, amendment, and accounting, that a Business Associate never carries itself.
11 checklist items →