Tool primitives — internal showcase

Do you have a documented inventory of every system, vendor, and channel that touches PHI?

Is PHI tagged or classified separately from non-PHI data in your storage layer?

Do you de-identify PHI before sending it to any non-HIPAA-eligible third party (analytics, LLMs, etc.)?

Is PHI prevented from being sent to consumer LLMs (ChatGPT, Gemini, Claude consumer plans)?

Do you have a signed BAA with every vendor that touches PHI?

Are BAAs reviewed annually and on every contract renewal?

Do you require subcontractor BAAs to flow down liability for PHI?

Are all PHI access events logged with user, timestamp, action, and record ID?

Are audit logs retained for at least 6 years?

Are audit logs reviewed regularly for anomalous access patterns?

Is access to PHI granted on a least-privilege, need-to-know basis?

Is multi-factor authentication enforced for every account that can access PHI?

Are user accounts deprovisioned within 24 hours of role change or termination?

Are unique user IDs used (no shared/generic accounts) for PHI access?

Is automatic logoff/session timeout enforced on all PHI-handling apps?

Is PHI encrypted at rest using AES-256 or equivalent?

Is PHI encrypted in transit using TLS 1.2 or higher?

Are encryption keys managed via a dedicated KMS / HSM?

Are mobile devices and laptops with PHI access fully-disk encrypted?

Do you have a written incident-response plan covering breach notification timelines (60 days)?

Is the IR plan tested at least annually (tabletop or live)?

Is there a designated Privacy Officer and Security Officer?

Does every workforce member complete HIPAA training at hire and annually?

Is sanction policy for HIPAA violations documented and applied?

Have you completed a HIPAA risk analysis in the last 12 months?

Is there a documented risk-management plan with prioritized remediations?

Are servers, backups, and workstations with PHI in physically secured locations?

Is there a documented media disposal / sanitization policy for drives that held PHI?

Are PHI backups taken regularly, tested, and stored encrypted off-site?

Is there a written disaster-recovery / contingency plan with RTO/RPO targets?

Do you have a documented Notice of Privacy Practices and a process for patient access requests?