HIPAA Security Rule

HIPAA Security Rule Grade

Answer a few questions about how your practice or organization protects electronic PHI and get graded against the HIPAA Security Rule (45 CFR §§ 164.308–316). Your grade updates as you go, and we flag exactly which safeguards still need work.

How to answer. Items marked Required must be implemented as written. Items marked Addressable are not optional — you must either implement them or document a reasonable, equivalent alternative. If you've done the latter, choose "Documented alternative."

Grade me against the proposed Security Rule update. HHS has proposed the first major Security Rule overhaul in two decades (NPRM published January 2025, final action now targeted for 2027). Turning this on eliminates the "addressable" flexibility — every specification is graded as required, documented alternatives earn only partial credit — and adds the new proposed requirements: asset inventory, MFA, penetration testing, vulnerability scanning, and 72-hour recovery.

Your gaps to close

Ranked by priority. Tackle the red items first — those are Required specifications that aren't in place.

No open gaps. Every item you've answered is fully in place.

Turn these gaps into a finished program

Nwaj Tech builds and runs HIPAA security programs for healthcare and dental practices, from the Security Risk Analysis and written policies to the day-to-day monitoring, training, and incident response.

888.788.ZERO · nwajtech.com

Start with the cornerstone. Nearly every HIPAA enforcement action cites a missing or inadequate Security Risk Analysis. If you scored red on the first question, that's where we start — a documented, thorough SRA that drives everything else on this list.

About this tool. This grade is an educational self-assessment based on the administrative, physical, and technical safeguards and documentation requirements of the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312, 164.314, and 164.316). Each item is weighted equally. The optional proposed-rule mode reflects HHS's January 2025 Notice of Proposed Rulemaking, which has not been finalized and is not currently enforceable; its requirements and timing may change. A high grade is a strong signal, not a legal determination, and this tool does not constitute legal advice or guarantee compliance with HIPAA. For a formal assessment of your obligations, talk to Nwaj Tech and your legal counsel.