Free tool · Medical & dental
Is your practice HIPAA ready?
Ten yes-or-no questions on the security basics HHS actually asks about. Two minutes, no sign-up, and nothing you click leaves your browser.
Have you done a written security risk analysis in the last twelve months?
Questions practices ask us
Does a good score mean my practice is HIPAA compliant?
No, and nothing short of the documented process can tell you that. HIPAA compliance means having done a written risk analysis, put safeguards in place based on it, and kept the paperwork that shows it. This check covers the common technical and administrative gaps; it can't see your documentation, and a perfect score still means the next step is the risk analysis.
Is there an official HIPAA certification we can get?
No. HHS does not endorse or recognise any HIPAA certification, so a vendor's "HIPAA certified" badge is marketing. What protects a practice in an investigation is its own records: the risk analysis, the policies, the training log, and the signed business associate agreements.
We're a brand-new practice. What should we do first?
Before any patient data goes into a system, get a business associate agreement from every vendor that will hold it, give every person their own login, and turn on multi-factor authentication for email and the EHR. Then do the risk analysis while the setup is still small enough to describe in an afternoon — it only gets harder to do later.
Is any of what I answer sent to you?
No. The check runs entirely in your browser. Nothing you click is sent to us or stored anywhere, and there is no sign-up.
Go further
- HIPAA security for medical & dental practicesRisk assessments, staff training, and fixing what they find.
- HIPAA Checklist for a New Medical PracticeWhat to have in place before the first patient walks in.
- What a HIPAA Risk Assessment Actually InvolvesThe requirement HHS enforcement keeps coming back to, explained plainly.