HIPAA + 42 CFR Part 2
compliance self-audit.
Twenty-five yes-or-no questions across the HIPAA Privacy Rule, HIPAA Security Rule, and 42 CFR Part 2. You get a live score, a ranked gap list, and the recommended action for every gap. Designed by a behavioral-health operator for behavioral-health operators.
This is operator-grade self-assessment, not legal advice. The audit reflects common best practices for HIPAA and 42 CFR Part 2. Consult qualified behavioral-health compliance counsel before relying on the output for any binding decision. Your answers stay in your browser unless you click one of the contact buttons.
Twenty-five questions. One honest score.
Answer yes or no for each control. Live score updates as you go. Skip nothing — gaps are ranked by severity once you finish.
Privacy Rule
Patient-facing controls: NPP, authorizations, BAAs, and access rights.
- Q1
Do you have a designated Privacy Officer responsible for HIPAA compliance?
High - Q2
Do you have a current Notice of Privacy Practices and provide it to every patient at first encounter?
High - Q3
Do you obtain written authorization before disclosing PHI for purposes beyond treatment, payment, or healthcare operations (TPO)?
High - Q4
Do you have a signed Business Associate Agreement (BAA) with every vendor that touches PHI?
High - Q5
Do you provide patients with access to their medical records within 30 days of their request?
Security Rule
Technical safeguards: risk analysis, encryption, identity, and audit logs.
- Q6
Have you conducted a formal HIPAA Security Risk Assessment in the last 12 months?
High - Q7
Is all electronic PHI encrypted at rest (database, file storage, backups, mobile devices)?
High - Q8
Is all PHI encrypted in transit (TLS 1.2+ for web, encrypted email/SFTP for file transfer)?
High - Q9
Does every staff member with PHI access have a unique user account (no shared logins)?
High - Q10
Are PHI access permissions limited by role to the minimum necessary for each staff member's job?
- Q11
Does your EMR capture audit logs for every PHI access, modification, and deletion?
High - Q12
Do you have a documented incident response and breach notification plan?
High
Administrative Safeguards
Policies, training, sanctions, and routine activity-log review.
- Q13
Do all employees with PHI access complete annual HIPAA training, with documentation?
- Q14
Do you have written policies and procedures covering each Privacy and Security Rule requirement?
- Q15
Do you have a documented sanctions policy for staff who violate HIPAA, and apply it consistently?
- Q16
Do you review system activity logs for inappropriate access at least quarterly?
42 CFR Part 2
SUD-specific consent, redisclosure, segmentation, and court orders.
- Q17
Do you obtain Part 2-compliant written consent before disclosing SUD treatment records (with specific recipient, purpose, expiration)?
High - Q18
Do all redisclosures of Part 2 records carry the federal notice prohibiting further redisclosure?
High - Q19
Do you maintain Part 2 records separately or with technical controls preventing commingling with non-Part 2 records?
High - Q20
Do you have a documented process for revoking Part 2 consent, and honor revocations promptly?
- Q21
Do staff who handle SUD records receive training on 42 CFR Part 2 specifically (not just HIPAA)?
- Q22
Do you have a documented process for handling subpoenas and court orders for Part 2 records that complies with 42 CFR Part 2?
High
Operational
Internal audits, complaint handling, and six-year documentation retention.
- Q23
Do you conduct internal compliance audits at least annually?
- Q24
Do you have a designated point of contact for patient privacy complaints, and document every complaint?
- Q25
Do you retain compliance documentation (policies, training records, audits, BAAs) for at least six years?
High
Answer all 25 questions to reveal score.
0/25 answered · 25 remaining
Compliance is the foundation,
not the checklist.
HIPAA and 42 CFR Part 2 compliance is the foundation of every Navix deployment. Audit logs on every PHI access. Encryption at rest and in transit. BAAs signed with every paid customer. The Compliance Agent watches your chart in real time and exports payer-ready packets on demand.
- EncryptionAES-256 at rest · TLS 1.2+ in transit
- Audit logsEvery PHI access, modification, deletion
- ComplianceHIPAA · 42 CFR Part 2 · SOC 2 · Drummond ONC