Checklist Items
Every required and addressable specification under the current HIPAA Security Rule, organized by safeguard category with regulatory citations.
Free Resource . No Paywall
HIPAA Security Rule Gap Checklist 2026
Self-assess your organization posture across all 45 CFR Part 164 safeguards in under 30 minutes. Includes the proposed 2025 NPRM updates that OCR is targeting to finalize this year.
- 45 CFR §164.308, §164.310, §164.312 fully mapped
- 2025 NPRM proposed requirements included
- Built by a physician-executive with direct HIPAA compliance experience
- Printable . use it in board meetings, audits, or vendor reviews
A printable, regulator-mapped checklist with a live score.
2025 Proposed Updates
The 12 proposed NPRM requirements at 90 FR 800 flagged separately so you know exactly what is coming before OCR finalizes.
Compliance Score
Check items as you go and watch your gap score update in real time. Printable summary for board or compliance committee reporting.
HIPAA Security Rule Gap Checklist
Proposed Rule Notice (NPRM 90 FR 800): Items marked Proposed 2025 are not yet enforceable. OCR is targeting May 2026 finalization. If finalized as published, the compliance deadline falls approximately 180 days after the effective date, estimated November 2026. Begin gap assessment now. Remediation at scale takes 6 to 12 months for most mid-market organizations.
Administrative Safeguards
§164.308 . 16 items| Done | Spec | Requirement | Type |
|---|---|---|---|
§164.308(a)(2) | Required | ||
§164.308(a)(1)(ii)(A) | Required | ||
§164.308(a)(1)(ii)(B) | Required | ||
§164.308(a)(1)(ii)(C) | Required | ||
§164.308(a)(1)(ii)(D) | Required | ||
§164.308(a)(5) | Addressable | ||
§164.308(b)(1) | Required | ||
§164.308(a)(4) | Addressable | ||
§164.308(a)(7)(ii)(A) | Required | ||
§164.308(a)(7)(ii)(B) | Required | ||
§164.308(a)(7)(ii)(C) | Required | ||
§164.308(a)(7)(ii)(D) | Addressable | ||
§164.308(a)(7)(ii)(E) | Addressable | ||
§164.308(a)(6) | Required | ||
§164.308(a)(8) | Required | ||
§164.316 | Required |
Physical Safeguards
§164.310 . 8 items| Done | Spec | Requirement | Type |
|---|---|---|---|
§164.310(a)(1) | Required | ||
§164.310(a)(2)(i) | Addressable | ||
§164.310(a)(2)(ii) | Addressable | ||
§164.310(a)(2)(iv) | Addressable | ||
§164.310(b) | Required | ||
§164.310(c) | Required | ||
§164.310(d)(2)(i) | Required | ||
§164.310(d)(2)(ii) | Required |
Technical Safeguards
§164.312 . 8 items| Done | Spec | Requirement | Type |
|---|---|---|---|
§164.312(a)(2)(i) | Required | ||
§164.312(a)(2)(ii) | Required | ||
§164.312(a)(2)(iii) | Addressable | ||
§164.312(a)(2)(iv) | · Proposed to become mandatory | Addressable | |
§164.312(b) | Required | ||
§164.312(c)(1) | Required | ||
§164.312(d) | Required | ||
§164.312(e)(1) | Addressable |
Proposed 2025 NPRM Updates
NPRM 90 FR 800 . 12 items| Done | Spec | Requirement | Type |
|---|---|---|---|
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 | ||
NPRM | Proposed 2025 |
Organizational Requirements
§164.314 . 2 items| Done | Spec | Requirement | Type |
|---|---|---|---|
§164.314(a)(1) | Required | ||
§164.314(b) | Required |
Common Questions
What does the HIPAA Security Rule actually require?
The HIPAA Security Rule (45 CFR Part 164 Subpart C) requires covered entities and business associates to protect ePHI through Administrative, Physical, and Technical safeguards. Each safeguard contains required specifications (must implement) and addressable specifications (implement if reasonable and appropriate, or document why not).
When does the proposed 2025 HIPAA update take effect?
The proposed update at NPRM 90 FR 800 is on OCR's May 2026 finalization agenda. If finalized as published, the rule takes effect 60 days after Federal Register publication, with compliance mandatory 180 days after the effective date. Estimated compliance deadline: November 2026.
How often should the risk analysis be updated?
OCR does not specify a fixed interval. Risk analysis should be updated when there are environmental or operational changes affecting ePHI: new systems, new locations, significant workflow changes, or technology migrations. Most healthcare attorneys recommend annual formal analyses with interim updates for material changes. Risk analysis failure appears in the majority of OCR enforcement actions.
What happens after I complete this checklist?
Each unchecked item is a documented gap. Gaps in required specifications require remediation or risk acceptance documented in your risk management plan. Gaps in proposed NPRM items require a remediation roadmap with target dates. For organizations with more than 5 gaps across required specifications, a structured risk advisory engagement typically resolves material exposure within 90 days.
Gaps found. Now what?
A3HCS provides physician-executive-led HIPAA risk advisory for mid-market hospitals, post-acute organizations, and health-adjacent startups. Flat-fee tiers from $3,500. No retainer required to start.
Request a Rapid Snapshot → Or book a 20-min call → Primary CTA . § 12
Request a Care Transition and Growth Diagnostic.
A two-to-four-week structured diagnostic delivered as an executive memo, not a deck. It defines where your system is losing time, margin, and trust, and identifies the two-to-three corrections worth investing in next.
- Structured interviews with operational and clinical owners
- Data pull and variance analysis against peer benchmarks
- System map of friction points across the continuum
- Executive memo with prioritized correction paths
- No findings before facts. No outcome guarantees. Clear scope.