Free tool · HIPAA Security Rule

HIPAA Security Checklist Calculator for Dental & Medical Practices

Mark the 10 essential technical safeguards, see your self-rated readiness and open items, then download or email your results.

Start the CalculatorBook a 30-Minute Risk Assessment
Your answers stay in this browser.

Nothing is sent anywhere unless you ask us to email your results, and then only your totals and the titles of open controls are sent. Owners, dates and notes are never sent.

45 CFR 164.308 / 164.312 • BAA • PCI DSS 4.0.1
< 15 MinChairside PMS & Imaging Failover
4 Minutes24/7 SOC Host & Token Isolation
100% VLANCBCT, EHR & Payment Isolation
Signed BAALive Auditor Evidence Binder

How to use this checklist

  1. 1. Mark a status for each control. Pick In place, Partial, Gap or N/A for each of the 10 controls.
  2. 2. Assign the work. For anything Partial or a Gap, name an owner and a target date.
  3. 3. Note the evidence. Say where the proof lives (policy, screenshot, report, contract), so you can produce it on request. Owners, dates and notes stay in this browser.
  4. 4. Review your results. The results panel counts your answers, works out a self-rated readiness % and lists the open items.
  5. 5. Get a second opinion. Bring the results to a 30-minute risk assessment if you want an outside review.
In place: Implemented today and you can show evidence.Partial: Started, or covers only some users, systems or sites.Gap: Not in place yet.N/A: Does not apply to your firm. Left out of the readiness %.
01. Live-System HIPAA Security Risk Analysis (45 CFR 164.308(a)(1)(ii)(A))

Maintain a continuously updated asset inventory and risk register covering every operatory PC, EHR server, imaging sensor, and cloud portal touching ePHI.

02. Third-Party Clinical & Lab Portal Access Governance (Quest Quanum / Change Healthcare)

Eliminate shared front-desk logins, purge former employees within 0 minutes, and log quarterly access reviews for lab, clearinghouse, and referral portals.

03. FIDO2 Phishing-Resistant MFA on Email & Password-Reset Inboxes

Protect Microsoft 365 / Google Workspace mailboxes that receive lab and EHR password-reset links against AiTM session-token replay attacks.

04. Strict VLAN Micro-Segmentation for CBCT Imaging, Sensors & IoMT

Isolate Dexis, Planmeca, Carestream 3D CBCT, DICOM/PACS, and operatory X-ray workstations from front-desk payment terminals and patient guest Wi-Fi.

05. Sub-15-Minute Chairside PMS/EHR BCDR Failover (Proposed 72-Hour Restore Rule)

Ensure Dentrix, Eaglesoft, Open Dental, eClinicalWorks, or athenahealth workloads fail over in <15 minutes with quarterly verified restoration certificates. The 72-hour restoration requirement is proposed in HHS's January 2025 Security Rule NPRM and is not yet final; today's rule already requires a contingency plan (45 CFR 164.308(a)(7)).

06. 4-Minute 24/7 MDR Endpoint & Identity Containment

Monitor all clinical endpoints 24/7/365 with human-led SOC engineers and behavioral canary traps that isolate ransomware staging in under 4 minutes.

07. Signed HIPAA Business Associate Agreements (BAAs) & Vendor Matrix

Maintain executed HIPAA BAAs and 72-hour breach notification SLAs with your MSP/MSSP, cloud backup provider, VoIP vendor, and imaging contractors.

08. PCI DSS 4.0.1 Cardholder Data Environment (CDE) Isolation

Segment patient credit-card and HSA/FSA payment terminals onto a dedicated PCI VLAN with zero connectivity to clinical ePHI databases.

09. 365-Day Immutable Audit Logs & ePHI Export Telemetry (45 CFR 164.312(b))

Retain tamper-proof audit trails tracking every bulk patient report export, login anomaly, and privilege escalation across PMS and EHR databases.

10. Annual Clinical Incident Response Tabletop & Workforce Phishing Drills

Execute and document annual ransomware/portal-breach tabletop exercises for practice managers and providers to satisfy OCR good-faith enforcement criteria.

Your results and open items

Dental & Medical HIPAA Security Checklist · Generated . Readiness is your own self-assessment, not a compliance determination.

0In place
0Partial
0Gap
0N/A
0Not yet marked
Readiness (self-rated)
–
Gaps and partials with no owner
0

Readiness = controls marked In place ÷ controls you have marked, excluding N/A. Partial counts as not yet in place.

Open items to close (Gaps first, then Partials)

ControlStatusOwnerTarget

Want a second set of eyes on your HIPAA safeguards?

Emry Networks helps dental and medical practices put these safeguards in place and keep the evidence an auditor will ask for. Call (603) 202-3200.

EMRY NETWORKS • DEFENSIBLE IT, 24/7 MDR & LIVE COMPLIANCE ENGINEERING
Jacksonville, FL & Manchester, NH Operations Hubs • Serving Regulated SMBs Across All 50 States • (603) 202-3200 • www.emrynetworks.com/contact-us
Book a 30-Minute Risk Assessment

This checklist is an educational self-check, not legal advice, a certification, or a formal assessment. Confirm requirements against the current regulation, your contracts, and your assessor or counsel.

Rules and documents cited in this checklist

Official sources for the rules, standards and documents named in the controls above. Check them for updates before relying on any requirement.

Related Emry Networks resources
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get audit ready now

Schedule your compliance readiness assessment with our team today.

Book a 30-Minute Risk AssessmentCall (603) 202-3200