Run HIPAA Security Risk Assessment for Clinic Sites — Free

Assessment Scope and Site Identification

Clinic site name, address, and department(s) in scope are documented

Assessment date, inspector name, and site contact are recorded

ePHI systems, devices, and workflows in scope are identified

Note (optional)

Assessment scope includes all clinic locations, remote access points, and third-party connections critical (required)

Yes No N/A

Administrative Safeguards and Governance

Security risk analysis has been performed and is documented critical (required)

Yes No N/A

Risk management plan addresses identified threats, vulnerabilities, and remediation timelines

Yes No N/A

Note (optional)

Security officer or responsible privacy/security lead is designated critical (required)

Yes No N/A

Workforce HIPAA security awareness training is current

Policies for access control, password management, and acceptable use are available and current

Yes No N/A

Note (optional)

Business associate agreements are documented for vendors handling ePHI critical (required)

Yes No N/A

Physical Safeguards and Facility Controls

Public access to areas containing ePHI is controlled by badge, lock, or reception screening critical (required)

Yes No N/A

Workstations displaying PHI are positioned to prevent casual viewing by patients or visitors

Yes No N/A

Photo evidence (optional)

Note (optional)

Screens automatically lock after an appropriate inactivity period critical (required)

Yes No N/A

Paper PHI is stored in locked cabinets or secure rooms when unattended critical (required)

Yes No N/A

Portable devices containing ePHI are secured against theft or unauthorized access critical (required)

Yes No N/A

Visitor management controls are in place for non-workforce persons in restricted areas

Yes No N/A

Note (optional)

Technical Safeguards

Unique user IDs are assigned to each workforce member with access to ePHI critical (required)

Yes No N/A

Multi-factor authentication is enabled for remote access and privileged accounts critical (required)

Yes No N/A

Access rights are reviewed and removed promptly for terminated or transferred users

Yes No N/A

Note (optional)

Audit logs are enabled and reviewed for unauthorized access or unusual activity critical (required)

Yes No N/A

Encryption is enabled for laptops, mobile devices, and data at rest where feasible critical (required)

Yes No N/A

Transmission of ePHI over email, portals, or other networks uses secure methods

Yes No N/A

Note (optional)

Backups are performed and restoration testing is documented

Yes No N/A

Note (optional)

Incident Response, Breach Readiness, and Remediation

Security incident response procedure is documented and accessible to staff critical (required)

Yes No N/A

Recent security incidents, if any, were investigated and closed with documented corrective actions

Yes No N/A

Note (optional)

Breach notification decision-making process is defined and understood by responsible staff critical (required)

Yes No N/A

Open deficiencies have owners and target completion dates

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Run: HIPAA Security Risk Assessment for Clinic Sites

Assessment Scope and Site Identification

Administrative Safeguards and Governance

Physical Safeguards and Facility Controls

Technical Safeguards

Incident Response, Breach Readiness, and Remediation

Get your results