What is a HIPAA self-assessment?

A HIPAA self-assessment is a guided evaluation of your practice's compliance readiness. It helps you identify visibility gaps, stale controls, and risky assumptions across the areas that HIPAA requires you to manage — administrative safeguards, physical security, technical controls, and workforce training. It is designed as a fast readiness check, not a substitute for a full Security Risk Assessment.

Is the HIPAA self-assessment free?

Yes. Patient Protect's self-assessment is completely free with no login, credit card, or account required. It is permanently available as part of Patient Protect's commitment to making compliance intelligence accessible to every independent healthcare practice regardless of budget.

What is the difference between a risk assessment and a self-assessment?

A self-assessment is a readiness check — a fast way to identify where your practice may have compliance gaps or outdated controls. A risk assessment is the more comprehensive Security Risk Assessment (SRA) process required under the HIPAA Security Rule, which evaluates entity classification, ePHI data flow, threat modeling, and safeguard adequacy in detail. Patient Protect offers both: the self-assessment as a quick starting point, and the unified risk assessment as the full evaluation.

Assessment

Free HIPAA Self-Assessment for Independent Practices

Answer seven operational questions to see whether your practice has visibility gaps across ePHI flow, access proof, workforce training, incident response, vendor risk, and policy follow-through. No login, no email.

This is a readiness check, not a full HIPAA Security Risk Analysis. It shows whether your practice has the operational visibility needed before a deeper SRA.

What this 5-minute assessment evaluates.

ePHI flow visibility

Do you know where protected health information enters, lives, and exits your practice — and which vendors touch it along the way?

Access and audit proof

Can you show who accessed which patient record, when, and from where — without rebuilding it from memory?

Workforce training and acknowledgments

Is every staff completion timestamped and audit-ready, or stored in spreadsheets and email threads?

Vendor BAAs and policy follow-through

Are your active vendors covered by signed BAAs, and is policy acknowledgment tracked per staff member?

What your result looks like

A preview of the readiness snapshot.

Every finding maps to an operational category and, where relevant, the specific HIPAA Security Rule requirement it corresponds to. Sample data below, populated with realistic values for a small independent practice.

Sample readiness snapshot

Overall readiness

62/ 100

4 critical gaps · 7 medium · 3 documentation

A score in this range indicates meaningful operational coverage with several actively exploitable weaknesses that a same-day OCR review would surface.

Identified gaps

GAP: Vendor without BAA

3 identified· HIGH priority· 45 CFR §164.308(b)(1)

Cloud storage, transcription service, and appointment reminder vendor operating without executed business associate agreements.

GAP: Missing risk analysis

1 identified· HIGH priority· 45 CFR §164.308(a)(1)(ii)(A)

No documented Security Rule risk analysis on file within the last 18 months. Most-cited finding in OCR Corrective Action Plans.

GAP: Workforce training records incomplete

5 staff· MEDIUM priority· 45 CFR §164.530(b)

Training completed but not timestamped or acknowledged in a system of record. Cannot be produced on audit request.

GAP: Access log retention

1 system· MEDIUM priority· 45 CFR §164.312(b)

Practice management system retains access logs for 30 days; Security Rule expects a review-capable trail across a longer horizon.

Next actions

1Execute BAAs with the three uncovered vendors before the next patient encounter that routes ePHI through them.
2Conduct a documented Security Rule risk analysis under §164.308(a)(1)(ii)(A) and file the output with a review date.
3Move workforce training completions out of email into a timestamped system of record under §164.530(b).

Sample data. Your snapshot will populate with your own answers — no login, no email required.

1. Do you know which vendors, devices, and staff roles currently touch ePHI?

2. Can you prove who last accessed sensitive patient information?

3. Do you maintain documented security training completion for every employee?

4. Would you know within a day if a staff workflow created a privacy failure?

5. Are your policies aligned to how the practice actually operates today?

6. Do you have an incident response plan your team could follow this week?

7. Can leadership see whether risk is improving or quietly drifting?

Next step: run the full risk assessment

Map your full HIPAA risk with the unified assessment

The unified risk assessment combines this readiness check with entity classification, practice profile analysis, and ePHI data flow mapping — all in one tool.

Check Your Risk

Ready to fix the gaps?

Turn your assessment into a compliance plan.

Patient Protect turns the gaps from this assessment into assigned compliance work: risk assessment, policy templates, vendor BAA tracking, workforce training, evidence trails, and ongoing visibility. Plans start at $39/month.

Start free trial See pricing

Start a 14-day trial. Credit card required for verification. No charge until the trial ends.

Part of the HIPAA Foundation · 15+ free tools

See the full collection

AssessFree · proprietary

Assess risk

The seven questions flag visibility gaps. The platform closes them systematically — risk scoring, policy templates, BAA tracking, and workforce training.

Next in the sequence

Risk Assessment

Assessments, classification tools, and an AI assistant that reveal your actual compliance standing and starting point.