Business Associate Risk Screening Survey

Step 1 of 25

SECURITY PRACTICES

Which of the following security practices does your organization currently have implemented with supporting documentation? (Select all that apply)*

Policies and procedures

Regular HIPAA and security training

Documented change management procedures

Access controls

Network security

Endpoint protection

Email protection

Vulnerability and patch mManagment

Incident response plan

Business continuity and disaster recovery plan

Other

Please specify if other is selected.

SECURITY PRACTICES

Have you conducted a Security Risk Analysis within the past year (with audit-ready documentation)?*

Yes

SECURITY PRACTICES

Has your organization had any mergers, acquisitions, changes in leadership in the past year?*

Yes

SECURITY PRACTICES

Do you maintain a record of where ePHI is used, disclosed, maintained, or transmitted?*

Yes

SECURITY PRACTICES

Do you have cyber liability insurance to cover potential data breaches and other security incidents?*

Yes

SECURITY PRACTICES

Do any staff members take home laptops containing unencrypted ePHI?*

Yes

SECURITY PRACTICES

Has your organization obtained any relevant certifications or undergone any security audits (such as HITRUST CSF, SOC2, ISO 27001, PCI DSS, Penetration testing, etc.)?*

Yes

SECURITY PRACTICES

How do you control access to restricted areas and your facility? (Select all that apply)*

Implemented access control systems

security guards

Video surveillance

security entry points

Visitor management systems

Other

Please specify if other is selected.

SECURITY PRACTICES

Do you have procedures in place to ensure that keys, passwords, records, and other access to PHI are collected from employees when they leave or are terminated?*

Yes

SECURITY PRACTICES

Do you have procedures in place to ensure appropriate disposal of hardware, devices, and hard-copy and digital records?*

Yes

SECURITY PRACTICES

How often do you review records of information system activity, such as audit logs, access reports, and security incident tracking reports?*

Weekly

Monthly

Quarterly

Annually

Other

Please specify if other is selected.

SECURITY PRACTICES

Which integrity controls and measures have you implemented to ensure the accuracy and completeness of PHI? (Select all that apply)*

Data Validation

Error Correction

Backup Procedures

Other

Please specify if other is selected.

SECURITY PRACTICES

How do you restrict and control physical access to assets like files, information, and devices? (Select all that apply)*

Policies limiting physical access

Devices and machines are secured in locked rooms

Restricted ability to remove devices from a secure area

Other

Please specify if other is selected.

SECURITY PRACTICES

Are personal devices allowed to be connected to the network that contains ePHI?*

Yes

SECURITY PRACTICES

Is ePHI stored or accessed on portable media (e.g., flash drives, tablets, laptops)?*

Yes

SECURITY PRACTICES

What security controls do you have in place? (Select all that apply)*

Unique user identification and authentication

Smartcard, key fob, fingerprint, or biometrics

Documented emergency access procedures

Automatic Logoff

Audit Controls

Role-based permissions

Access key usage monitoring

Multifactor authentication

2-Factor Authentication (2FA)

Other

Please specify if other is selected.

SECURITY PRACTICES

If you have a documented contingency plan with policies and procedures in place for responding to an emergency or other occurrence that damages systems that contain PHI: Which of the following, does it include? (Select all that apply)*

I don't have a contingencyplan documented

Data backup plan

Disaster recovery plan

Emergency mode operation plan

Testing and revision procedures

Applications and data criticality analysis

Other

Please specify if other is selected.

SECURITY PRACTICES

What security mechanism(s) have you implemented to end-user machines such as workstations and laptops against attack? Check all that apply.*

Antivirus

Antispyware

Anti-adware

Firewalls

Malware protection

Intrusion detection and prevention systems

Regular security patching

Encryption

Decryption

VPN

Other

Please specify if other is selected.

SECURITY PRACTICES

How often do you conduct patching of security flaws in servers, applications (including web applications), and third-party software?*

Automated patching is in place

Weekly

Monthly

Quarterly

Annually

Other

Please specify if other is selected.

HIPAA COMPLIANCE

Do you have a designated HIPAA compliance officer or team?*

Yes

HIPAA COMPLIANCE

How often do you conduct HIPAA training for your employees?*

Weekly

Monthly

Quarterly

Annually

Other

Please specify if other is selected.

HIPAA COMPLIANCE

Have you implemented documented policies and procedures for staff to follow to comply with HIPAA regulations, such as the Security Rule and Privacy Rule?*

Yes

HIPAA COMPLIANCE

If you use any third-party vendors who create, maintain, receive, or transmit ePHI on your behalf, do you have the following in place:*

No third-party vendors access PHI on our behalf

Executed formal contracts requiring compliance with applicable privacy and security standards

Written agreements outlining their HIPAA obligations

HIPAA COMPLIANCE

How do you ensure that your subcontractors and vendors also comply with HIPAA? (Select all that apply)*

Regular audits and reviews

Thorough vetting

Verify compliance

Request documentation

Regular communication

Training on HIPAA, security, and data handling practices

Ongoing monitoring and oversight

Other

Please specify if other is selected.

Thank you for completing our Business Associate Risk Screening Survey! One of our representatives will review your responses and reach out to offer personalized insights based on your specific needs. To help us connect with you, please provide your contact information below. We look forward to assisting you with any compliance questions or concerns you may have.

Name*

First Last

Phone Number*

Company Name*

Job Title

Email Address*

Business Associate Risk Screening Survey

CONTACT US

Solutions

Company

Links