# HIPAA Security Rule Technical Safeguards Assessment — Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | [Covered Entity / Business Associate Name] |
| Assessment Date | [YYYY-MM-DD] |
| CISO / Security Officer | [Name, Title] |
| Assessor | [Name, Title, Certification] |
| Scope | [Enterprise-wide / Specific systems] |

---

## Technical Safeguards — §164.312

### Access Control — §164.312(a)(1)

| Specification | Type | Status | Evidence | Gap/Finding |
|--------------|------|--------|----------|-------------|
| Unique User Identification §164.312(a)(2)(i) | Required | [ ] Implemented [ ] Not Implemented | | |
| Emergency Access Procedure §164.312(a)(2)(ii) | Required | [ ] Implemented [ ] Not Implemented | | |
| Automatic Logoff §164.312(a)(2)(iii) | Addressable | [ ] Implemented [ ] Alternative [ ] N/A | | |
| Encryption and Decryption §164.312(a)(2)(iv) | Addressable | [ ] Implemented [ ] Alternative [ ] N/A | | |

**For addressable specifications not implemented as specified:**
- Alternative measure: _______________________________________________
- Justification: _______________________________________________

### Audit Controls — §164.312(b)

| Requirement | Status | Evidence | Gap/Finding |
|-------------|--------|----------|-------------|
| Mechanisms to record and examine system activity | [ ] Implemented [ ] Not Implemented | | |
| Log retention policy (minimum 6 years recommended) | [ ] Implemented [ ] Not Implemented | | |
| Regular log review process | [ ] Implemented [ ] Not Implemented | | |

### Integrity — §164.312(c)(1)

| Specification | Type | Status | Evidence | Gap/Finding |
|--------------|------|--------|----------|-------------|
| Standard: Protect ePHI from improper alteration/destruction | Required | [ ] Implemented [ ] Not Implemented | | |
| Mechanism to Authenticate ePHI §164.312(c)(2) | Addressable | [ ] Implemented [ ] Alternative [ ] N/A | | |

### Person or Entity Authentication — §164.312(d)

| Requirement | Status | Evidence | Gap/Finding |
|-------------|--------|----------|-------------|
| Verify identity of persons seeking ePHI access | [ ] Implemented [ ] Not Implemented | | |
| Multi-factor authentication for remote access | [ ] Implemented [ ] Not Implemented | | |

### Transmission Security — §164.312(e)(1)

| Specification | Type | Status | Evidence | Gap/Finding |
|--------------|------|--------|----------|-------------|
| Integrity Controls §164.312(e)(2)(i) | Addressable | [ ] Implemented [ ] Alternative [ ] N/A | | |
| Encryption §164.312(e)(2)(ii) | Addressable | [ ] Implemented [ ] Alternative [ ] N/A | | |

---

## Encryption Inventory

| System/Application | ePHI? | Encryption at Rest | Algorithm | Encryption in Transit | Protocol | Exception Documented? |
|-------------------|-------|-------------------|-----------|---------------------|----------|---------------------|
| | | | | | | |

---

## Assessment Summary

| Safeguard Area | Required Specs | Compliant | Addressable Specs | Implemented/Alternative | Gaps |
|---------------|---------------|-----------|-------------------|------------------------|------|
| Access Control | 2 | /2 | 2 | /2 | |
| Audit Controls | 1 (standard) | /1 | 0 | N/A | |
| Integrity | 1 (standard) | /1 | 1 | /1 | |
| Authentication | 1 (standard) | /1 | 0 | N/A | |
| Transmission Security | 1 (standard) | /1 | 2 | /2 | |

## Remediation Plan

| Finding | Risk Level | Remediation Action | Responsible | Target Date | Status |
|---------|-----------|-------------------|-------------|------------|--------|
| | | | | | |