Does your business handle patient data for healthcare clients?

What good looks likeA current BAA for each covered entity, filed where you can find it — plus BAAs with your own subcontractors that touch the data.

If not, fix itGet a signed BAA in place with every healthcare client and every subcontractor that creates, receives, stores or sends their PHI.

What good looks likeA designated security official who owns the program, keeps the documentation and answers client questionnaires.

If not, fix itName a security official — a vCISO can fill this role if no one in-house has the time.

What good looks likeA written list of every place patient data is stored, processed or sent, kept up to date.

If not, fix itMap where PHI lives and flows, so every location is covered by your safeguards and your risk analysis.

What good looks likeA written assessment of the threats to PHI in your environment, the likelihood and impact of each, and the plan to address them.

If not, fix itComplete a documented security risk analysis now, update it at least yearly and after major changes, and track the fixes it finds.

What good looks likePolicies for access, devices, incidents and contingency planning that match how you actually work — with older versions kept on file.

If not, fix itWrite (or update) security policies that match your real practices, review them yearly and keep each version for six years.

What good looks likeFor example, Microsoft 365 under Microsoft’s BAA with the right security settings turned on, and no PHI in personal or free accounts.

If not, fix itMove PHI into services that sign a BAA, configure them securely and keep it out of personal and free accounts.

What good looks likeA stolen password alone can’t open a mailbox, the VPN or an app with patient data.

If not, fix itRequire MFA on email, remote access and every application that stores PHI.

What good looks likeNo shared accounts, and a checklist that closes every account when an employee or contractor departs.

If not, fix itGive every person a unique login and make account removal part of your offboarding checklist.

What good looks likeRole-based permissions on folders, apps and mailboxes, reviewed at least once a year.

If not, fix itSet role-based access to PHI and review who has it at least yearly.

What good looks likeSign-ins and access to patient data are logged, retained and checked for anything unusual.

If not, fix itTurn on audit logging for systems with PHI and have someone review the logs on a schedule.

What good looks likeBitLocker or FileVault on every laptop and encryption on mobile devices — so a lost device is far less likely to become a reportable breach.

If not, fix itEncrypt every laptop and mobile device that may hold PHI and manage them centrally so a lost one can be wiped.

What good looks likeA simple way for staff to send encrypted email, and a rule about when they must use it.

If not, fix itSet up email encryption and a clear rule for when PHI must be sent encrypted.

What good looks likeEDR on every computer and server, watched around the clock, with security updates installed on a schedule.

If not, fix itDeploy managed EDR on every device and automate patching for operating systems and apps.

What good looks likeBackups kept out of ransomware’s reach, restores tested, and a written contingency plan for keeping the work going.

If not, fix itBack up PHI to a copy ransomware can’t reach, test restores and write down your contingency plan.

What good looks likeTraining records you can show a client or investigator, plus phishing tests to back it up.

If not, fix itTrain your workforce on HIPAA security at hire and yearly, and keep the completion records.

What good looks likeWho investigates, who decides, and how you notify each client in the time your BAA requires — and never later than HIPAA’s 60 days.

If not, fix itWrite an incident response plan that includes your BAA notification deadlines, and walk through it with leadership once a year.