Do you have a hard copy of a completed HIPAA Security Risk Analysis (§164.308(a)(1)(ii)(A)) for the previous calendar year?

Do you have a hard copy of a HIPAA Security Management plan (§164.308(a)(1)(ii)(B)) that accompanies your last HIPAA Security Analysis?

Do you have copies of the Security Reminders (§164.308(a)(5)(ii)(A)) provided to your staff for last year?

Do you have a hard copy of a completed Evaluation (§164.308(a)(8)) for the previous calendar year?

Do you have copies of Business Associate Agreements (§164.308(b)(1)) for all your business associates?

Do you have copies of your facility security plan (§164.310(a)(1)?

Do you have logs (§164.312(b)) that have been reviewed to ensure that the access to ePHI have been conducted by authorized individuals?

Do you have documentation showing that information within the system has not been modified (§164.312(c)(2))?

Do you have assurances that your Business Associates are in compliance with HIPAA Security (Omnibus Rule)?

Have you reviewed or updated your policies and procedures and have documentation showing these actions?