# hipaa.compliancehub.wiki

> Free HIPAA security and healthcare cybersecurity self-assessment tool — 2026 edition. Helps healthcare CISOs, CCOs, compliance officers, and IT security teams evaluate their organization's security posture across 8 weighted domains. Updated for the 2025 HIPAA Security Rule NPRM and emerging AI/LLM healthcare risks.

## Assessment Tool

- [HIPAA Security Assessment 2026](https://hipaa.compliancehub.wiki/): Comprehensive 8-section self-assessment covering HIPAA Security Rule (mandatory MFA, vulnerability scanning, penetration testing per 2025 NPRM), IoT medical device security, AI/LLM risk governance, EMR/EHR security, data sharing, telemedicine, and incident response. Produces risk score, HIPAA compliance %, and security maturity level.

## Sections & Coverage

- [Organizational Security Governance](https://hipaa.compliancehub.wiki/): 11% weight. Dedicated security team, governance structure, security strategy, vendor risk management, security awareness training, change management, budget allocation.

- [HIPAA Compliance & Regulatory Requirements](https://hipaa.compliancehub.wiki/): 17% weight. Annual Security Risk Assessment, BAAs, PHI encryption, audit logs, mandatory MFA (2025 NPRM), bi-annual vulnerability scanning (2025 NPRM), annual penetration testing (2025 NPRM), technology asset inventory and network map (2025 NPRM), critical patch management timelines (2025 NPRM), anti-malware/EDR on all PHI systems (2025 NPRM), accelerated breach notification (2025 NPRM), state-specific laws, HITECH/Omnibus compliance.

- [IoT Medical Device Security](https://hipaa.compliancehub.wiki/): 19% weight. Device inventory, network segmentation, procurement assessments, patch management, compensating controls, default password management, FDA security advisory evaluation, implantable device risks, SBOM tracking.

- [EMR/EHR and Data Management Security](https://hipaa.compliancehub.wiki/): 13% weight. Patch management, role-based access, provisioning/deprovisioning, audit logs, backup/recovery, insider threat controls, patient portal MFA.

- [Data Sharing & Integration Security](https://hipaa.compliancehub.wiki/): 8% weight. Health information exchange protocols, data minimization, data sharing agreements, audit trails, API security, cloud environment assessments.

- [Telemedicine & Remote Care Security](https://hipaa.compliancehub.wiki/): 7% weight. Platform security assessments, end-to-end encryption, authentication, remote monitoring device security, clinician security training.

- [AI and Advanced Technology Security](https://hipaa.compliancehub.wiki/): 12% weight. AI system vulnerability assessment, data integrity controls, algorithm validation, generative AI and LLM governance policies, PHI leakage prevention from public AI tools (ChatGPT, Copilot, etc.), AI clinical documentation oversight, adversarial/red-team testing, third-party AI vendor HIPAA compliance.

- [Incident Response & Recovery](https://hipaa.compliancehub.wiki/): 13% weight. Documented IR plan, tabletop exercises, ransomware procedures, offline backups, business continuity for clinical operations, breach notification procedures, post-incident review, supply chain and third-party vendor compromise scenarios.

## Risk Scoring

The tool uses criticality-weighted scoring (1–3 per question) combined with section weights. Results include:
- Overall risk level: Low Risk (90–100%), Moderate Risk (75–89%), High Risk (50–74%), Critical Risk (<50%)
- HIPAA compliance percentage and status (Compliant / Partially Compliant / Non-Compliant)
- Security maturity level: Initial → Managed → Defined → Measured → Optimized
- Prioritized top-3 recommendations with regulatory impact ratings
- Resource allocation guidance by section

## Regulatory Frameworks

This assessment incorporates: HIPAA Security Rule (including 2025 NPRM updates), HITECH Act, HITRUST CSF v11, NIST Cybersecurity Framework 2.0, NIST AI Risk Management Framework 1.0, FDA Guidance on Medical Device Cybersecurity (2023), HHS OCR Audit Protocol, NIST SP 800-66r2, ISO 27001:2022 / ISO 27799, HHS AI Strategy for Healthcare.

## Sister Tools

- [DeviceRisk Assessment Tool](https://devicerisk.compliancehub.wiki/): Specialized medical device cybersecurity risk assessment focused on FDA compliance, device inventory management, vulnerability scanning, and risk scoring. Part of the ComplianceHub.wiki toolkit.

## Optional

- [Blog: HIPAA Compliance Checklist 2026](https://hipaa.compliancehub.wiki/blog/hipaa-compliance-checklist-2026)
- [Blog: AI Security in Healthcare 2026](https://hipaa.compliancehub.wiki/blog/ai-security-healthcare-2026)
- [Blog: Secure IoT Medical Devices](https://hipaa.compliancehub.wiki/blog/secure-iot-medical-devices)
- [Blog: Healthcare Ransomware Prevention](https://hipaa.compliancehub.wiki/blog/healthcare-ransomware-prevention)
- [HIPAA Resources](https://hipaa.compliancehub.wiki/hipaa-resources)
- [IoT Medical Device Security Guide](https://hipaa.compliancehub.wiki/iot-medical-device-security)
- [Privacy Policy](https://hipaa.compliancehub.wiki/privacy-policy)
- [Terms of Service](https://hipaa.compliancehub.wiki/terms-of-service)