CRU TechnologiesHIPAA Binder

← All sample documents  ·  Print

Sample document for a fictional practice. Yours is written from your own answers. Get my quote

Evaluation and annual review procedure

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.308(a)(8) (evaluation); 164.316(b)(2)(iii) (periodic review and update of documentation); 164.530(i) (review of privacy policies).

Approved by Dr. Maria Lindqvist, Owner. Led by Janelle Okafor, Office Manager.

Purpose

HIPAA requires a periodic technical and non-technical evaluation of how well the practice's safeguards meet the rule, repeated whenever the environment or the law changes. At Granite City Family Dental this is the annual review: one meeting each October, prepared in the weeks before it, recorded as minutes (document 24), and followed by a dated risk-register update. Every OCR corrective action plan imposed on a small practice requires exactly this; doing it on schedule is the practice's evidence.

1. Who does what

  • Lead: Janelle Okafor schedules the meeting, assembles the evidence, and writes the minutes.
  • Security Officer (Janelle Okafor): brings the risk register, the user access list, log-review notes, backup and restore evidence, and the device inventory.
  • Owner (Dr. Maria Lindqvist, Owner and Dentist): attends, re-confirms the officer designations, approves policy changes, signs the residual-risk acceptance and the retention attestation.
  • IT provider (CRU Technologies): attends or submits a written status on MFA, encryption, patching, backups and logging.
  • Compliance committee: Dr. Maria Lindqvist (Owner); Janelle Okafor (Privacy and Security Officer); CRU Technologies (IT provider).

2. When

  • The review meeting is held in October every year. Preparation starts six weeks before.
  • An extra, shorter evaluation is held within 60 days of any of these: a new EHR, vendor or cloud system; a new location or remodel; a security incident or breach; a new device class (tablets, imaging, telehealth); a change in the law that affects the policies; a change of Privacy or Security Officer.
  • The under-500 breach report to HHS is due by March 1 regardless of the review month (Janelle Okafor, document 22).

3. What is evaluated — the checklist

Each line is checked, the evidence named, and a finding recorded (Pass, Gap, or Not applicable). Gaps go to the risk register (section 5).

☐ Risk analysis updated within the last 12 months, scope covers every location, system, device class and paper store in the ePHI inventory (164.308(a)(1)(ii)(A)). Evidence: document 13, dated and signed.

☐ Risk management plan reviewed; every Medium and High risk has an owner and due date; items closed since last year are listed as proof of risk reduction (164.308(a)(1)(ii)(B)).

☐ Policies and procedures reviewed, version number advanced if changed, approval page re-signed (164.316(b)(2)(iii); 164.530(i)).

☐ Officer designations re-confirmed in writing (164.530(a); 164.308(a)(2)).

☐ Workforce training: every current workforce member on the roster with a privacy date and a security date in the last 12 months; new hires trained within 30 days; acknowledgments signed (164.530(b); 164.308(a)(5)).

☐ Security reminders issued quarterly; phishing results reviewed where tests are run.

☐ Business associate register reviewed by Janelle Okafor; every vendor that touches PHI has a signed agreement on file; new or departed vendors updated (164.504(e); 164.308(b)).

☐ Contingency plan tested: restore test completed and passed in the last 12 months; tabletop held; plan revised (164.308(a)(7)(ii)(D)).

☐ Device and media inventory reconciled against what is physically present; disposals have certificates (164.310(d)(2)(iii)).

☐ User access list reviewed quarterly through the year and certified at the meeting; departures log matches termination checklists (164.308(a)(3)-(4)).

☐ Information system activity review performed monthly by CRU Technologies with Janelle Okafor and summarized (164.308(a)(1)(ii)(D)).

☐ Technical controls sampled live at the meeting: MFA on email, EHR, remote access and admin accounts; encryption on a sample laptop and phone; automatic logoff; patch status; antivirus reporting (164.312).

☐ Facility walkthrough completed at every location; key-holder list current; visitor and maintenance logs in use (164.310(a)).

☐ Sanction log reviewed for consistency; count reported (164.308(a)(1)(ii)(C); 164.530(e)).

☐ Complaint, patient-request, incident and breach logs reviewed; access requests completed within the practice's 10-day target and never beyond 30 days (164.530(d); 164.524; 164.308(a)(6)).

☐ Under-500 breach submission to HHS made by March 1, or "none to report" recorded (164.408(c)).

☐ Notice of Privacy Practices still accurate; re-issued if uses, Part 2 status or contact details changed; posted on the website (https://www.granitecityfamilydental.example) (164.520).

☐ Minnesota consent form and copy-fee schedule checked against Minn. Stat. 144.292–144.293 (document 23).

☐ Cyber insurance (Pending quote) renewal requirements compared with the controls in place.

☐ Regulatory watch recorded (section 7).

4. The HHS audit protocol as the question bank

The HHS Office for Civil Rights publishes the audit protocol it uses when it audits a covered entity (https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html). It lists, for every Privacy, Security and Breach Notification standard, the question OCR asks and the evidence it expects. Granite City Family Dental uses it as the question bank for this evaluation:

  1. Before the meeting the lead picks the protocol items for the sections of this binder that changed, had an incident, or were not sampled last year, and always the risk analysis, risk management, training, right of access and breach items.
  2. For each item the practice answers the protocol question in one or two sentences and names the document or register in this binder that proves it.
  3. An item the practice cannot prove with a document is a Gap, even if the practice believes it does the right thing.
  4. Over a three-year cycle every protocol item relevant to a provider of this type is covered at least once.

The free HHS Security Risk Assessment Tool (v3.7, https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool) is also completed; its report is filed behind document 13 and its open items are carried in the risk register.

5. How findings feed the risk register

  • Every Gap from the checklist or the question bank becomes a row in the risk register (document 13) the same week, with the risk stated plainly, a likelihood and impact rating, a treatment, an owner and a due date.
  • Items closed during the year stay in the register marked Closed with the date; they are the proof of risk reduction OCR now asks for.
  • Residual risks the practice chooses to accept are listed in the minutes and signed by Dr. Maria Lindqvist, Owner.
  • The Security Officer reports status on open items quarterly, outside the annual meeting, so nothing is first discovered a year late.

6. How the review is recorded

  • The lead records the meeting as minutes in document 24 using its fourteen headings, in the order given, so every year reads the same way.
  • The minutes name the attendees, the evidence examined, every finding and decision, the actions for the coming year with owners and dates, and the next meeting date.
  • The owner signs the attestation that the binder is retained for six years from the date of creation or last effective date, whichever is later (164.316(b)(2)(i); 164.530(j)).
  • Prior years' minutes stay in the binder unchanged; each renewal opens a new year.
  • Policy changes approved at the meeting are made in the binder, the version number is advanced, the approval page is re-signed, and the workforce is retrained on anything that changes daily work.

7. Regulatory watch

The lead records at each meeting the status of the items below and any new ones.

Proposed HIPAA Security Rule update — proposed, not final. HHS published a proposed rule on January 6, 2025 (90 FR 898). As of this binder's edition it has not been finalized; the government's agenda lists a target of July 2027, and the final text may differ. Granite City Family Dental builds to the current rule and treats the following proposed items as the direction of travel. When the final rule is published the Security Officer lists the actual requirements and compliance dates in the minutes and the risk register.

  • Proposed: a written asset inventory and network map of every system that touches ePHI, updated at least annually.
  • Proposed: multi-factor authentication required on every system holding ePHI.
  • Proposed: encryption of ePHI at rest and in transit required, with narrow exceptions.
  • Proposed: restoration of critical systems within 72 hours, with a written criticality analysis.
  • Proposed: vulnerability scanning every six months and penetration testing every twelve months.
  • Proposed: an annual compliance audit against the Security Rule.
  • Proposed: removal of a departed workforce member's access within one hour, and notice to other entities within 24 hours when a shared user's access changes.
  • Proposed: written verification from each business associate, at least annually, that its safeguards are in place.
  • Proposed: removal of the "addressable" category, making every implementation specification required.

42 CFR Part 2. Notice of Privacy Practices changes took effect February 16, 2026. Granite City Family Dental is not a Part 2 program; this is re-confirmed each year. Reproductive health care privacy rule (2024). Vacated by a federal court in June 2025; the practice does not use the attestation form or the related restrictions. No action unless the law changes.

Minnesota Health Records Act and Minn. Stat. 325E.61. Apply to this practice; checked each year under document 23 and document 22. Penalties. Civil money penalty amounts are adjusted for inflation each year (most recently January 28, 2026). Documented recognized security practices in place for 12 months, such as the 405(d) Health Industry Cybersecurity Practices followed in this binder, must be considered by HHS in reducing penalties (HITECH section 13412); the dated evidence in this binder is that documentation.

Approval

Procedure approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Privacy Officer: Janelle Okafor Signature: ___________________________ Date: ______________