Is your HIPAA program defensible?
Eight questions, two minutes. Scored against what assessors — and OCR — check first: risk analysis, BAAs, encryption, training, incident response, audit controls, policies, and designated officials.
What a HIPAA gap assessment actually includes
A gap assessment is a pre-assessment dry run: a consultant tests your program against the HIPAA Administrative, Physical, and Technical Safeguards, then hands you a findings list — the risk analysis to complete, the BAAs to sign, the encryption to verify, the training records to fix. It is not a certification (none exists) and produces no status your customers can rely on; its product is a remediation list. Budget it as its own line item.
Readiness help vs. the assessment (why they're separate)
The consultant prepares; the assessor validates. The firm that designs or implements your controls shouldn't be the one assessing them — which is why many buyers deliberately hire a consultant to prepare and a separate firm to validate. The quiz below approximates what readiness probes, in eight questions.
The 2-minute quiz
1. Have you completed a Security Rule risk analysis in the last 12 months that covers all ePHI systems?
2. Do you have signed Business Associate Agreements (BAAs) with every vendor that touches PHI?
3. Is ePHI encrypted at rest and in transit (laptops, backups, email, file shares)?
4. Do all workforce members complete HIPAA privacy/security training, with records?
5. Do you have a written incident-response and breach-notification procedure with named owners?
6. Do you review audit logs and access records for ePHI systems on a defined cadence?
7. Are your HIPAA policies and procedures reviewed and updated at least annually?
8. Do you have a designated privacy official and security official (they can be the same person)?
How scoring works
Each answer is worth 0–2 points (max 16). 0–5: foundational gaps — start with a risk analysis. 6–11: core pieces exist — allow 2–4 months of program work. 12–16: likely ready to engage assessors. This is a self-assessment aid, not an assessment opinion.
Know your score? Get quotes
Assessors scope fees around readiness. Tell us where you stand and get matched.
How it works: tell us once (4 questions, 2 min) → we match HIPAA assessors to your size, setting, and timeline → they send scoped quotes directly. Free, no obligation.