6 min read · Educational guide · Sources reviewed November 6, 2026
Ownership and people
1. Who has designated security responsibility? 2. When was our risk analysis last reviewed? 3. How do we train staff to recognize and report security concerns? 4. How quickly are accounts removed when someone leaves?
Systems and recovery
5. Which systems use individual accounts and MFA? 6. Who can use administrator privileges? 7. When did we last successfully restore a backup? 8. How are updates and known vulnerabilities prioritized?
Partners and response
9. Which vendors handle ePHI, and who reviews the necessary business associate agreements? 10. Who makes decisions during an incident, including escalation to legal advisers? Record uncertain answers as follow-up work. These are screening questions, not a complete regulatory checklist.