Live HIPAA safeguards check

Live tests

• Passing
  Connections are encrypted (HTTPS only)A plain http:// request is turned away to https://, and browsers are told to use HTTPS only.45 CFR 164.312(e)(1)
• Passing
  The practice workspace requires sign-inA request for workspace data without a signed-in, two-step-verified session is refused, and nothing is cached.45 CFR 164.312(a)(1), 164.312(d)
• Passing
  No trackers where practice or patient information is enteredThe workspace, sign-in, sign-up, Claim Check and contact pages load scripts only from our own site.HHS guidance on tracking technologies
• Passing
  Sensitive fields are encrypted with a key held in a key vaultA test value is encrypted and decrypted with the live data key (AES-256-GCM); a tampered copy is rejected.45 CFR 164.312(a)(2)(iv)
• Passing
  The database connection is encryptedThe live database session reports TLS in use.45 CFR 164.312(e)(2)(ii)
• Passing
  The database is reachable only on a private networkThe database address resolves to a private network address, not the internet.45 CFR 164.312(e)(1)
• Passing
  The audit log and claim history cannot be changed or deletedAn attempt to change and to delete audit and claim history records is made and must be refused by the database.45 CFR 164.312(b), 164.312(c)(1)
• Passing
  Activity is being recorded in the audit logA check entry is written to the audit log and read back.45 CFR 164.312(b)
• Passing
  Automatic sign-out, two-step sign-in and lockout are in forceThe running service signs people out after 15 idle minutes, ends every session within 12 hours, and locks an account after 5 wrong tries.45 CFR 164.312(a)(2)(iii), 164.312(d)

Record

• In progress
  A named HIPAA Security OfficialNot yet in place.45 CFR 164.308(a)(2)
• In progress
  Written risk analysis, reviewed yearlyNot yet in place.45 CFR 164.308(a)(1)(ii)(A)
• In progress
  Written security policies adoptedNot yet in place.45 CFR 164.316
• In progress
  Staff security trainingNot yet in place.45 CFR 164.308(a)(5)
• In progress
  Incident response and breach notification planNot yet in place.45 CFR 164.308(a)(6)
• In progress
  Yearly evaluation of these safeguardsNot yet in place.45 CFR 164.308(a)(8)
• Passing
  Business associate agreement with our hosting provider (Microsoft)Done Oct 4, 2026. Next due Oct 4, 2027.45 CFR 164.308(b), 164.314(a)
• In progress
  Business associate agreement with our claims clearinghouseNot yet in place.45 CFR 164.308(b), 164.314(a)
• Passing
  Encrypted backups kept 35 days in two US regionsDone Oct 23, 2026. Next due Jan 23, 2027.45 CFR 164.308(a)(7)(ii)(A)
• Passing
  Restore from backup testedDone Oct 5, 2026. Next due Jan 5, 2027.45 CFR 164.308(a)(7)(ii)(D)
• In progress
  Automatic alerts on suspicious activityNot yet in place.45 CFR 164.308(a)(1)(ii)(D), 164.308(a)(6)
• In progress
  Review of who has accessNot yet in place.45 CFR 164.308(a)(4)