Assessment Date

Assessor Name

Is the Notice of Privacy Practices (NPP) provided to patients?

Are employees trained on HIPAA privacy and security policies?

Are access controls in place to limit PHI access to authorized personnel only?

Are patients notified promptly of any breaches involving their PHI?

Is there a process to audit and track access to PHI?

Overall Compliance Rating

• Excellent

• Satisfactory

• Needs Improvement

• Poor

Areas of Concern

Recommended Actions