HIPAA Security Risk Assessment · ISO/IEC 27001:2022
How well do you protect electronic protected health information under HIPAA?
64 requirements covering scoping (covered entity, business associate, hybrid entity, ePHI inventory), every standard and implementation specification of the HIPAA Security Rule (administrative, physical and technical safeguards, organizational requirements, policies and documentation), the Breach Notification Rule, the Privacy Rule obligations that a security assessment normally touches, and the enforcement provisions of 45 CFR Part 160. Each requirement states whether the specification is Required or Addressable and is mapped to the 93 Annex A controls and clauses 4-10 of ISO/IEC 27001:2022. You get compliance percentages, prioritised gaps, practical guidance and a PDF report. For covered entities and business associates of any size; the result supports, but does not replace, the risk analysis of 45 CFR 164.308(a)(1)(ii)(A). Regulatory snapshot: 13/11/2026.
No data from this assessment is transmitted to GoToCertify.
How it works
- Profile: a few facts and yes/no questions exclude non-applicable requirements.
- Assessment: a 0-4 maturity level per requirement, with evidence and notes.
- Dashboard: overall score and compliance % by area; once unlocked, also by source, by control and P1/P2 gaps by area.
- Report: free summary PDF; with Pro the full report with action plan, guidance, control map, roadmap and Excel export.
64 requirements · 12 assessment areas · mapped to ISO 27001 · 60-90 minutes
HIPAA Security Rule45 CFR Part 164 Subpart C (164.302-164.318): general rules and flexibility of approach, administrative, physical and technical safeguards, business associate contracts, policies, procedures and six-year documentation retention. Implementation specifications are Required or Addressable (164.306(d)). Text checked against the eCFR on 13/11/2026.
Breach Notification, Privacy and Enforcement RulesSubpart D (164.400-164.414): notice to individuals, media and HHS without unreasonable delay and within 60 calendar days of discovery, with the 500-individual threshold. Subpart E: minimum necessary, notice of privacy practices, access, accounting, administrative requirements. Part 160 Subparts C and D: compliance reviews and four civil money penalty tiers.
ISO/IEC 27001:2022Every requirement is linked to Annex A controls and clauses 4-10: the coverage map shows how an ISO 27001 information security management system supports HIPAA compliance and where HIPAA asks for something more specific (business associate contracts, breach notices, individual rights).
Assessment areas
- SCO – Scope, entity status and ePHI inventory
Decide first what you are under 45 CFR 160.103: a covered entity (health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction), a business associate, or both. Then find all electronic protected health information you create, receive, maintain or transmit (164.306(a)(1)). Implementation specifications are either Required or Addressable: under 164.306(d) a Required specification must be implemented; for an Addressable one you must assess whether it is reasonable and appropriate in your environment, then implement it or document why not and adopt an equivalent alternative measure if reasonable and appropriate. Addressable never means optional. - RSK – Security management process and evaluation
The security management process of 164.308(a)(1) is the core of the Security Rule: an accurate and thorough risk analysis, risk management measures that bring risks to a reasonable and appropriate level, a sanction policy and regular review of system activity; all four specifications are Required. Keep the analysis current through the periodic evaluation of 164.308(a)(8) and the maintenance duty of 164.306(e). - WFA – Security responsibility, workforce security and access management
Name one security official (164.308(a)(2)), then control who in the workforce can reach ePHI: authorisation and supervision, clearance, termination of access (164.308(a)(3)) and the granting, review and modification of access rights (164.308(a)(4)). Most specifications here are Addressable: record for each one the decision required by 164.306(d)(3). - TRN – Security awareness and training
164.308(a)(5) requires a security awareness and training programme for the whole workforce, management included. Its four specifications (security reminders, protection from malicious software, log-in monitoring, password management) are Addressable: implement each one, or document why it is not reasonable and appropriate and which equivalent measure replaces it. - INC – Security incidents and contingency planning
Identify, respond to, mitigate and document security incidents (164.308(a)(6), Required). Prepare for emergencies with a data backup plan, a disaster recovery plan and an emergency mode operation plan (164.308(a)(7), all Required), and support them with testing and a criticality analysis (Addressable). An incident involving PHI must also be assessed under the Breach Notification Rule. - PHY – Physical safeguards
164.310 protects electronic information systems, buildings and equipment: facility access controls, workstation use, workstation security, and device and media controls. Disposal and media re-use are Required; the facility specifications, accountability and backup before moving equipment are Addressable under 164.306(d). Workstation includes laptops and other devices with similar functions, wherever they are used. - TEC – Technical safeguards
164.312 sets five standards: access control, audit controls, integrity, person or entity authentication and transmission security. Unique user identification and emergency access are Required; automatic logoff, encryption at rest and in transit, the integrity mechanism and transmission integrity controls are Addressable, which under 164.306(d)(3) means implement them or document why not and what equivalent measure is used. The rule is technology-neutral: choose measures from the risk analysis. - BAA – Business associates and organizational requirements
A covered entity may let a business associate handle ePHI only after obtaining satisfactory assurances in a written contract or other arrangement (164.308(b), 164.502(e)); business associates must do the same with their subcontractors. 164.314(a) and 164.504(e) list the mandatory contract terms. Group health plans must also amend plan documents before sharing PHI with the plan sponsor (164.314(b), 164.504(f)). - DOC – Policies, procedures and documentation
164.316 requires reasonable and appropriate policies and procedures in written (or electronic) form, a written record of every action, activity or assessment the rule requires to be documented, retention for 6 years from creation or from the date last in effect (whichever is later), availability to the people who implement them and periodic review. All three implementation specifications are Required. - BRN – Breach notification
An impermissible acquisition, access, use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment of at least the four factors in 164.402 shows a low probability of compromise. Covered entities notify individuals without unreasonable delay and within 60 calendar days of discovery, the media when more than 500 residents of a State or jurisdiction are affected, and HHS (at the same time for 500 or more individuals, yearly for smaller breaches). Business associates notify the covered entity. The burden of proof lies with the organisation (164.414(b)). - PRV – Privacy Rule obligations linked to security
This area covers only the Privacy Rule duties that a security assessment normally touches: minimum necessary (164.502(b), also binding on business associates), notice of privacy practices (164.520), access (164.524), accounting of disclosures (164.528) and the administrative requirements of 164.530 (privacy official, training, safeguards, complaints, sanctions, mitigation, policies and six-year documentation). It is not a full Privacy Rule assessment: permitted uses and disclosures, authorizations, amendment and other rights are out of scope. - ENF – Compliance, investigations and civil money penalties
Under 45 CFR Part 160 the Secretary of HHS investigates complaints, conducts compliance reviews and imposes civil money penalties in four tiers based on culpability (160.404): did not know, reasonable cause, willful neglect corrected within 30 days, willful neglect not corrected. The dollar amounts printed in 160.404(b) are adjusted annually for inflation and published at 45 CFR Part 102: check the current figures there. Correcting a violation that is not due to willful neglect within 30 days is an affirmative defence (160.410(c)).
Key regulatory dates
| Date | Source | Status | |
|---|---|---|---|
| 14/04/2003 | Privacy Rule | Compliance date of the Privacy Rule (Subpart E) for covered health care providers, health plans other than small health plans and health care clearinghouses (45 CFR 164.534) | In force |
| 14/04/2004 | Privacy Rule | Compliance date of the Privacy Rule for small health plans (45 CFR 164.534(b)(2)); a small health plan is a health plan with annual receipts of 5 million dollars or less (160.103) | In force |
| 20/04/2005 | Security Rule | Compliance date of the Security Rule (Subpart C) for covered health care providers, health care clearinghouses and health plans other than small health plans (45 CFR 164.318) | In force |
| 20/04/2006 | Security Rule | Compliance date of the Security Rule for small health plans (45 CFR 164.318(a)(2)) | In force |
| 18/02/2009 | General Provisions and Enforcement | The four-tier civil money penalty structure of 45 CFR 160.404(b)(2) applies to violations occurring on or after this date | In force |
| 23/09/2009 | Breach Notification Rule | Subpart D applies to breaches of protected health information occurring on or after this date (45 CFR 164.400) | In force |
| 22/09/2014 | Privacy Rule | End of the deemed-compliance period for business associate contracts that were in place before 25/01/2013 and not renewed or modified between 26/03/2013 and 23/09/2013 (45 CFR 164.532(e)): since then every business associate and subcontractor contract must meet the current 164.314(a) and 164.504(e) terms | In force |
| Discovery + 60 days | Breach Notification Rule | Recurring: notice to affected individuals, to the media (more than 500 residents of a State or jurisdiction) and to the Secretary (500 or more individuals) without unreasonable delay and in no case later than 60 calendar days after discovery of a breach; same outer limit for the business associate's notice to the covered entity (45 CFR 164.404(b), 164.406(b), 164.408(b), 164.410(b)) | Recurring |
| 01/03/2027 | Breach Notification Rule | Recurring every year: breaches involving fewer than 500 individuals discovered in calendar year 2026 must be notified to the Secretary not later than 60 days after the end of the calendar year (45 CFR 164.408(c)); date computed as 31/12/2026 plus 60 days | Recurring |
| Request + 30 days | Privacy Rule | Recurring: action on an individual's request for access no later than 30 days after receipt, with one extension of no more than 30 days (45 CFR 164.524(b)(2)); accounting of disclosures no later than 60 days after receipt, with one extension of no more than 30 days (164.528(c)(1)) | Recurring |
| 6 years | Security Rule | Recurring: documentation retained for 6 years from the date of its creation or the date when it last was in effect, whichever is later (45 CFR 164.316(b)(2)(i), 164.530(j)(2), 164.105(c)(2)); the Secretary may commence a penalty action within 6 years from the date of the violation (160.414) | Recurring |
| 06/01/2025 | Security Rule | Notice of proposed rulemaking to modify the Security Rule published in the Federal Register (90 FR 898, RIN 0945-AA22; comments closed 07/03/2025). Not adopted as of 13/11/2026: the current Security Rule remains in effect | Proposal - monitor |
| 28/01/2026 | General Provisions and Enforcement | Latest annual inflation adjustment of civil money penalties (91 FR 3666), reflected in the table of 45 CFR 102.3 | In force |
Frequently asked questions
Is the HIPAA Security Risk Assessment self-assessment free?
Yes. The questionnaire, the scoring, the dashboard with the score by area and a summary PDF are free and need no account; your answers stay in your browser and are never sent to our servers. Unlocking this assessment (18 EUR for 45 days, optional) adds the full PDF report with prioritised action plan and guidance, the detailed dashboard (by source, by control, gaps by area), the evidence tracker, comparisons with previous assessments and the Excel export; GoToCertify Pro (39 EUR for 45 days) unlocks every assessment and the cross-framework view.
Which standard is the HIPAA Security Risk Assessment assessment mapped to?
Every requirement is linked to the controls of ISO/IEC 27001:2022. The coverage map produced by the tool can be used as a basis for a Statement of Applicability.
How is the compliance percentage calculated?
Each applicable requirement is scored on a maturity scale from 0 (not started) to 4 (fully compliant). The compliance percentage is the ratio between the score obtained and the maximum obtainable. Priorities P1/P2/P3 combine criticality and maturity level.
Who is the assessment for?
Compliance, legal, IT security and risk functions of organisations established or operating in the EU; it is a self-assessment and does not constitute legal advice.
How up to date is the regulatory content?
The regulatory snapshot is dated 2026-11-13 (version 1.0). Proposals not yet adopted are labelled as such. References point to official sources (EUR-Lex, European authorities, ISO).
Other assessments
- EU AI Act – Regulation (EU) 2024/1689 as amended by the Digital Omnibus – mapped to ISO/IEC 42001:2023
- GDPR – Regulation (EU) 2016/679 with EDPB guidance – mapped to ISO/IEC 27701:2025
- NIS2 Directive – Directive (EU) 2022/2555 and Implementing Regulation (EU) 2024/2690 - mapped to ISO/IEC 27001:2022
- NIS2 – Italia – Italian edition of NIS2: Legislative Decree 138/2024 and the ACN baseline security measures (Determination 379907/2025) – mapped to ISO/IEC 27001:2022 (content in Italian, by business function).
- DORA – Regulation (EU) 2022/2554 on digital operational resilience for the financial sector – mapped to ISO/IEC 27001:2022 and ISO 22301:2019
- AI Act – Italia – AI Act, L. 132/2025, D.Lgs. 160/2026 e 179/2026 – mappato su ISO/IEC 42001:2023 (contenuti in italiano)
- DORA – Banche italiane – Italian-bank edition of DORA: Regulation (EU) 2022/2554, RTS/ITS, Bank of Italy Circular 285 and Legislative Decree 23/2025 – mapped to ISO/IEC 27001 and ISO 22301 (content in Italian, by business function).
- ISO/IEC 27001 readiness – Information security management system (ISMS) gap analysis against ISO/IEC 27001:2022 - clauses 4-10 and the 93 Annex A controls, in view of certification
- ISO/IEC 42001 readiness – AI management system (AIMS) gap analysis against ISO/IEC 42001:2023 - clauses 4-10 and the 38 Annex A controls, in view of certification
- ISO/IEC 20000-1 / ITSM maturity – Service management system (SMS) gap analysis against ISO/IEC 20000-1:2018 and maturity of the ITSM processes, with ITIL practice cross-references, in view of certification
- Swiss nFADP (nLPD) – Federal Act on Data Protection (FADP/nLPD/revDSG, SR 235.1) and Data Protection Ordinance (DPO/OPDa/DSV, SR 235.11) – mapped to ISO/IEC 27701:2025
- EU laws for Swiss companies – Scoping of GDPR, AI Act, NIS2, DORA, Cyber Resilience Act, Data Act and Digital Services Act for non-EU (Swiss) companies – mapped to ISO/IEC 27001:2022
- NIST CSF 2.0 – NIST Cybersecurity Framework 2.0 (CSWP 29, 26/02/2024) - maturity by Function and Category, Current vs Target Profile - mapped to ISO/IEC 27001:2022
- SOC 2 Type II readiness – Gap analysis against the AICPA 2017 Trust Services Criteria (revised points of focus 2022) and DC 200 description criteria - mapped to ISO/IEC 27001:2022
Self-assessment aid for information purposes only; it is not legal advice, not an audit and not the risk analysis required by 45 CFR 164.308(a)(1)(ii)(A), and completing it does not demonstrate or certify HIPAA compliance. Requirements paraphrase the regulations in the publisher's own words: the official text of 45 CFR Parts 160 and 164 prevails, and State law may be more stringent. GoToCertify is not affiliated with, endorsed by or acting on behalf of the U.S. Department of Health and Human Services, its Office for Civil Rights, NIST, ISO or IEC. Penalty amounts are adjusted annually and proposed rule changes may be pending: verify the current position on official sources. Regulatory snapshot 13/11/2026. No data from this assessment is transmitted to GoToCertify. © 2026 GoToCertify.