# HITECH Act Compliance Assessment — Template

## Organization Information

| Field | Value |
|-------|-------|
| Organization Name | |
| Entity Type | [ ] Covered Entity [ ] Business Associate |
| Assessment Date | |
| Assessor | |

---

## HITECH Penalty Exposure Assessment

### Current Violation Risk Areas
| Area | Risk Level | Potential Tier | Notes |
|------|-----------|---------------|-------|
| Risk analysis | | | |
| Breach notification | | | |
| BA management | | | |
| Access controls | | | |
| Encryption | | | |

### Recognized Security Practices (§13412)
- [ ] NIST Cybersecurity Framework implemented for 12+ months
- [ ] HITRUST CSF certified
- [ ] Section 405(d) HICP practices adopted
- [ ] Other recognized standard: _______________
- [ ] Documentation demonstrating 12+ months of practice available

---

## Business Associate Direct Liability (§13401)

### Security Rule Compliance
- [ ] Administrative safeguards (§164.308) — independently compliant
- [ ] Physical safeguards (§164.310) — independently compliant
- [ ] Technical safeguards (§164.312) — independently compliant
- [ ] Policies and documentation (§164.316) — independently compliant

### Privacy Rule Compliance
- [ ] Impermissible use/disclosure controls
- [ ] Minimum necessary standard implemented
- [ ] Breach notification to covered entity
- [ ] Subcontractor BAA management

---

## Promoting Interoperability

- [ ] Security risk analysis conducted for reporting period
- [ ] Security deficiencies identified and corrected
- [ ] Patient electronic access provided (portal)
- [ ] Secure messaging available
- [ ] E-prescribing active
- [ ] Health information exchange participation

---

## Approval

| Role | Name | Date |
|------|------|------|
| Compliance Officer | | |
| CISO | | |