{"text_format":"1","workbook":"xlsx","n_sheets":3,"sheets":["ReadMe","Analysis","Action Plan"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":2,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"ReadMe","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Analysis","index":1,"n_rows":116,"n_cols":20,"rows_kept":116,"cut":false,"hidden":false,"merged":[]}
["Item\nNo.","LEVEL\n(HIDE)","HOSP\nCLINIC\n(HIDE)","OFFICE\n(HIDE)","BA\n(HIDE)","RULE\n(HIDE)",null,null,null,"PrivacyProTM HIPAA Security Risk Analysis",null,"Weight\n1-5\n(HIDE)","Score\n(HIDE)","Risk\nLevel",null,null,"Phase 2 2016 OCR \nAudit Protocols & ONC 2016 SRA Items\n","Action Item Statements","Threats","Vulnerabilities"]
["Item\nNo.","LEVEL\n(HIDE)","HOSP\nCLINIC\n(HIDE)","OFFICE\n(HIDE)","BA\n(HIDE)","RULE\n(HIDE)","Policy","HIPAA Citation\n(Text in Comments)","HIPAA Security Rule Standard\n    Implementation Spec","Analysis Questions","Answer","Weight\n1-5\n(HIDE)","Score\n(HIDE)","Risk\nLevel","Comments\nProvide details to support your answer","June 2012 OCR KPMG \nAudit Protocols\nQuestions KPMG Asks During Government Sanctioned Audits ","Phase 2 2016 OCR \nAudit Protocols","Action Item Statements","Threats","Vulnerabilities"]
["Section \nB",null,null,null,null,null,null,null,null,"ADMINISTRATIVE SAFEGUARDS"]
["B.001",1,0,1,0,null,"N/A",null,"EHR MU attestation requirement, per MU auditors in 2013. ","Are the EHR(s) system(s) being attested to for Meaningful Use integrated and operational with other systems being used by the Eligible Provider",null,5,{"$f":"IF(OR(K4=\"Yes\",K4=\"Addressible - explain\"),L4, IF(K4=\"Partial\",L4/2, 0))","v":0},{"$f":"IF(K4<>\"\",L4-M4,0)","v":0},null,null,null,"Create procedures to ensure EHRs being attested to Meaningful Use are integrated and operational with other systems being used by the eligible provider","#5, 6","# 1, 3, 5"]
["B.01",1,1,1,1,null,"19s, 19as","164.306(a) and (b)\n164.308(a)(1)(i)","Security Management Process","General Requirements. No specific audit inquiries for this line \nFlexibility of Approach.  CE or BA should take into account the factors to determine security measures to implement to safeguard ePHI.",null," ",null,null,null,"Protocol Present","Protocol #S1, S2",null," "," "]
["B.1",1,1,1,1," ","1s, 2s, 19s ","164.308(a)(1)(ii)(A)\n","    Risk Analysis (R)","Does the entity have P&P to conduct accurate & thorough assessment of potential risks and vulnerabilities for ePHI? Answer 'Yes' if you are completing this form and will use these materials to update the P&P as the rules materially change and on an on-going basis.",null,5,{"$f":"IF(OR(K6=\"Yes\",K6=\"N/A\"),L6, IF(K6=\"Partial\",L6/2, 0))","v":0},{"$f":"IF(K6<>\"\",L6-M6,0)","v":0},null,null,"Protocol Present\n#S4\nONC SRA \nA1, A2, A4, A5, PO1","Create procedures to conduct regular assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI maintained by the entity","# 1, 2, 3, 4, 5","# 1, 2, 3, 4 "]
["B.11",1,1,1,1," ","1s, 2s, 19s ","164.312(e)(2)(ii)","    Risk Analysis (R)","Does the entities Risk Analysis evaluate risks associated with not having encryption for data in motion and data at rest? ",null,5,{"$f":"IF(OR(K7=\"Yes\",K7=\"N/A\"),L7, IF(K7=\"Partial\",L7/2, 0))","v":0},{"$f":"IF(K7<>\"\",L7-M7,0)","v":0},null,null,"ONC SRA T45","Create procedures to conduct regular assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the ePHI maintained by the entity","# 1, 2, 3, 4, 5","# 1, 2, 3, 4 "]
["B.7",1,1,1,1,null,"1s, 2s, 19s ","164.308(a)(1)(ii)(B)","    Risk Management (R)","Does the entity have P&P for a (Security) Risk Management Plan and processes sufficient to reduce risks & vulnerabilities, including for prevention of  wrongful disclosures?",null,5,{"$f":"IF(OR(K8=\"Yes\",K8=\"Addressible - explain\"),L8, IF(K8=\"Partial\",L8/2, 0))","v":0},{"$f":"IF(K8<>\"\",L8-M8,0)","v":0},null,null,"Protocol \n#S5\nONC SRA \nA6, A7","Create and implement policies and procedures for a (Security) Risk Management Program designed to reduce the risk level of identified threats and vulnerabilities to acceptable levels","# 1, 2, 3, 4, 5","# 1, 2, 3, 4 "]
["B.11",1,1,1,1,null,"2s, 26s","164.308(a)(1)(ii)(C)","    Sanction Policy (R)","Does the entity have P&P for sanctions applied to workforce members who violate security P&P?",null,5,0,0,null,"Protocol Present","Protocol \n#S6\nONC SRA \nA9, A10","Create a documented sanction policy and apply it to workforce members who fail to comply with HIPAA security policies and procedures","# 2","# 1 "]
["B.14",1,1,1,1,null,"7s, 18s, 106s","164.308(a)(1)(ii)(D)","    Information System Activity Review (R)","Does the entity have P&P regarding regular review of info system activity?",null,5,0,0,null,"Protocol Present","Protocol \n#S7\nONC SRA B.11, B.12","Create and implement procedures and policies to regularly review records of information system activity, such as review of audit logs, access reports, and security monitors security incident reports","# 2, 3","# 1, 3, 4 "]
["B.17",1,1,1,1,null,"19s","164.308(a)(2)","Assigned Security Responsibility (R)"]
["B.23",1,1,1,1,null,"19s, 101s, 102, 103s","164.308(a)(3)(i)","Workforce Security (R)"]
["B.25",1,1,1,1,null,"7s, 102s, 106s, 107s","164.308(a)(3)(ii)(A)","    Authorization and/or Supervision (A)","Does the entity have P&P regarding the authorization and/or supervision of workforce members who work with ePHI or in areas it's accessed?",null,5,{"$f":"IF(OR(K13=\"Yes\",K13=\"Addressible - explain\"),L13, IF(K13=\"Partial\",L13/2, 0))","v":0},{"$f":"IF(K13<>\"\",L13-M13,0)","v":0},null,null,"Protocol \n#S10","Create and implement policies and procedures for authorization and supervision of employees who work with PHI or in locations where it might be accessed","#  2, 3","# 1, 2"]
["B.27",1,1,1,1,null,"6s, 102s, 103s 107s, ","164.308(a)(3)(ii)(B)","    Workforce Clearance Procedure (A)","Does entity have P&P ensuring workforce members access to ePHI is appropriate by using clearance procedures (e.g. background checks and other screening processes)?",null,5,0,0,null,"Protocol Present","Protocol \n#S11\nONC SRA\nA27","Create and implement polices and procedures to allow access to ePHI based on workforce screening and clearance results","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.31",1,1,1,1,null,"103s","164.308(a)(3)(ii)(C)","    Termination Procedures (A)","Does the entity have P&P for quickly terminating (de-provisioning) workforce access to ePHI at end or employment or other arrangement? ",null,5,0,0,null,null,"Protocol \n#S12","Create and implement standard procedures for quickly terminating access (de-provisioning ) to PHI when a workforce member terminates employment","# 2, 5, 6","# 1, 2, 4"]
["B.35",1,1,1,1,null,"18s, 19s, 101s","164.308(a)(4)(i)","Information Access Management (R)",null,null,null,null,null,null,null," "]
["B.36",0,0,0,0,"HCC","19s","164.308(a)(4)(ii)(A)","    Isolating Health Care Clearinghouse\n    Function (R)","If entity is a clearing house that is part of a larger organization, do they have P&P to protect ePHI from access within the larger entity? ",null,5,{"$f":"IF(OR(K17=\"Yes\",K17=\"Addressible - explain\"),L17, IF(K17=\"Partial\",L17/2, 0))","v":0},{"$f":"IF(K17<>\"\",L17-M17,0)","v":0},null," ","Protocol #S14","Create a P&P to segregate access to clearinghouse ePHI from the rest of the entity ","# 2, 3, 4, 6","# 1, 2"]
["B.361",0,0,0,0,"HCC","19s",null,null,"Does the group health plan have P&P in place to ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard ePHI created, received, maintained or transmitted to or by the plan sponsor on behalf of the group health plan?",null,5,0,0,null,null,"Protocol #S63","Ensure the group health plan has P&P in place to ensure that its plan documents provide that the plan sponsor will reasonably and appropriately safeguard ePHI created, received, maintained or transmitted to or by the plan sponsor on behalf of the group health plan","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.362",0,0,0,0,"HCC","19s",null,null,"Do the plan documents of the group health plan include language that requires the sponsor to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of the group health plan? ",null,5,{"$f":"IF(OR(K19=\"Yes\",K19=\"Addressible - explain\"),L19, IF(K19=\"Partial\",L19/2, 0))","v":0},{"$f":"IF(K19<>\"\",L19-M19,0)","v":0},null,null,"Protocol #S64","Ensure the plan documents of the group health plan include language that requires the sponsor to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the ePHI that it creates, receives, maintains, or transmits on behalf of the group health plan","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.363",0,0,0,0,"HCC","19s",null,null,"Do the plan documents of the group health plan incorporate provisions to ensure that adequate separation required by 45 CFR § 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures?",null,5,0,0,null,null,"Protocol #S65","Ensure the plan documents of the group health plan incorporate provisions to ensure that adequate separation required by 45 CFR § 164.504(f)(2)(iii) is supported by reasonable and appropriate security measures","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.364",0,0,0,0,"HCC","19s",null,null,"Do the plan documents incorporate provisions that requires the sponsors to ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures?",null,5,{"$f":"IF(OR(K21=\"Yes\",K21=\"Addressible - explain\"),L21, IF(K21=\"Partial\",L21/2, 0))","v":0},{"$f":"IF(K21<>\"\",L21-M21,0)","v":0},null,null,"Protocol #S66","Ensure the plan documents incorporate provisions that requires the sponsors to ensure that any agent to whom it provides this information agrees to implement reasonable and appropriate security measures","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.365",0,0,0,0,"HCC","19s",null,null,"Does the entity have P&P to maintain written P&P related to the security rule and written documents of (if any) actions, activities, or assessments required of the security rule?",null,5,{"$f":"IF(OR(K22=\"Yes\",K22=\"Addressible - explain\"),L22, IF(K22=\"Partial\",L22/2, 0))","v":0},{"$f":"IF(K22<>\"\",L22-M22,0)","v":0},null,null,"Protocol #S67","Ensure the entity has P&P to maintain written P&P related to the security rule and written documents of (if any) actions, activities, or assessments required of the security rule","# 2, 3, 5, 6","# 1, 2, 3, 4"]
["B.39",1,1,1,1,null,"6s, 8s,101s, 110s","164.308(a)(4)(ii)(B)","    Access Authorization (A)","Does the entity have P&P for authorizing access to ePHI that supports the HIPAA Privacy Rule including methods limiting the access to it's ePHI?",null,5,0,0,null,"Protocol Present","Protocol #S13\nONC SRA \nA30","Create policies and procedures for authorizing access to ePHI that is compliant with the HIPAA Privacy Rule","# 2, 3, 5, 6","# 1, 3, 4"]
["B.78",1,1,1,1,null,"108s, 109s","164.308(a)(7)(i)","Contingency Plan (R)"," ",null,null,null,null,null,null," "]
["B.79",1,1,1,1,null,"109s","164.308(a)(7)(ii)(A)","    Data Backup Plan (R)","Does entity have P&P to create and maintain retrievable exact copies of ePHI?",null,5,{"$f":"IF(OR(K25=\"Yes\",K25=\"Addressible - explain\"),L25, IF(K25=\"Partial\",L25/2, 0))","v":0},{"$f":"IF(K25<>\"\",L25-M25,0)","v":0},null,null,"Protocol #S25","Create and implement P&P to create and maintain retrievable exact copies of ePHI","# 5","# 3, 4"]
["B.84",1,1,1,1,null,"109s","164.308(a)(7)(ii)(B)","    Recovery Plan (R)","Does entity have P&P to restore lost data?",null,5,0,0,null,"Protocol Present","Protocol\n#S26\nONC SRA T11","Create policies and procedures to restore any loss of data","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["B.85",1,1,1,1,null,"109s, 110s","164.308(a)(5)(ii)(C)","    Emergency Mode Operation Plan (R)","Does the entity have P&P to enable continuity of critical business processes for protection of ePHI while in emergency mode? ",null,5,0,0,null,"Protocol Present","Protocol\n#S27\nONC SRA T12, A54","Create and implement an emergency mode operations plan, ensure that it will enable the organization to continue to provide critical functions while protecting the security of ePHI ","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["B.91",1,1,1,1,null,"109s, 116s","164.312(a)(2)(ii)\n164.308(a)(7)(ii)(D)","    Testing and Revision Procedure (A) ","Does the entity have P&P for periodic testing & revision of its IT contingency plans?",null,5,0,0,null,"Protocol Present","Protocol #S28\nONC SRA\nT15, A51, A55","Create and implement procedures regarding periodic testing of the organization's IT contingency plans","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["B.94",1,1,1,1,null,"109s","164.308(a)(7)Ii)(ii)€","    Applications and Data Criticality\n    Analysis (A)","Does the entity have P&P to assess the relative criticality of specific applications & data in support of other contingency plan components? ",null,5,0,0,null,"Protocol Present","Protocol \n#S29\nONC SRA T25 & A3, A49, A56","Create policies and procedures to assess the relative criticality of specific applications and data in support of other contingency plan components","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["B.95",1,1,1,1,null,"1s, 18s, 19s","164.308(a)(8)","Evaluation (R)",null,null,null,null,null,null,null," "]
["B.102",1,1,1,1,null,"29s, 39s","164.308(b)(1)","Business Associate Contracts and Other Arrangements (R) ",null,null,null,null,null,null,null," "]
["B.103",1,1,1,0,null,"39s","164.308(b)(1)&(3)","    Written Contract or Other Arrangement (R)","Does the entity have P&P to obtain & review satisfactory assurances from it's BAs (& Subs) and that applicable requirements are reflected in the BAA (or other written contract)?\n",null,5,{"$f":"IF(OR(K32=\"Yes\",K32=\"Addressible - explain\"),L32, IF(K32=\"Partial\",L32/2, 0))","v":0},{"$f":"IF(K32<>\"\",L32-M32,0)","v":0},null,null,"Protocol \n#S32, S32\nONC SRA \nA62","Create and implement P&P to obtain & review satisfactory assurances from the entity's BAs (& Subs) and that applicable requirements are reflected in the BAA (or other written contract)","# 6","# 1"]
[null," "," "," "," ",null,null,null,null,null,null,{"$f":"SUBTOTAL(109, L4:L32)","v":80},{"$f":"SUBTOTAL(109, M4:M32)","v":0}]
["Section C"," "," "," "," ",null,null,null,null,"PHYSICAL SAFEGUARDS"]
[" C.1",1,1,1,1,null,null,"164.310(a)(1)","Facility Access Controls (R)",null,null,null,null,null,null,null," "]
["C.3",1,1,1,1,null,"109s, 110s","164.310(a)(2)(i)","    Contingency Operations (A)","Does the entity have P&P to allow facility access for the entities workforce and IT service provider or contracted IT support for restoration of lost data under Disaster Recovery Plan and Emergency Ops Plan in event of emergency?",null,5,{"$f":"IF(OR(K36=\"Yes\",K36=\"Addressible - explain\"),L36, IF(K36=\"Partial\",L36/2, 0))","v":0},{"$f":"IF(K36<>\"\",L36-M36,0)","v":0},null,"Protocol Present","Protocol \n#S34\nONC SRA PH5","Create policies and procedures to allow facility access in support of restoration of lost data under the disaster recovery plan and emergency mode operations plan in the event of an emergency","# 5","# 1, 3"]
["C.4",1,1,1,1,null,"104s","164.310(a)(1)\n164.310(a)(2)(ii)\n164.310(c) ","    Facility Security Plan (A)","Does the entity have P&P to safeguard facility and equipment from unauthorized physical access, tampering and theft and for controlling the environment inside the facility?",null,5,0,0,null,"Protocol Present","Protocol \n#S35\nONC SRA PH2, PH28","Implement policies and procedures to safeguard the facility and the equipment inside the facility from unauthorized physical access, tampering, and theft","# 2, 4, 5","# 1, 2, 3, 4"]
["C.9",1,1,1,1,null,"101s,104s113s, ","164.310(a)(2)(iii)","    Access Control and Validation\n    Procedures (A)","Does the entity have P&P for controlling a persons physical access to facilities based on their role, e.g. within a list, including Business Associates, that is periodically reviewed and updated?",null,5,0,0,null,"Protocol Present","Protocol \n#S36\nONC SRA PH12","Implement physical access controls validate a person's access to the entity's physical spaces containing ePHI based on their role or function","# 2, 5","# 1, 3"]
["C.13",1,1,1,1,null,"104s, 118s","164.310(a)(2)(iv)","    Maintenance Records (A)","Does entity have P&P related to documentation of repairs & modifications to physical security components that include a history of physical changes, upgrades and other facility modifications in areas that contain ePHI ? ",null,5,0,0,null,"Protocol Present","Protocol \n#S37\nONC SRA PH16","Create policies and procedures to maintain records of repairs and modifications to physical security components such as hardware, walls, doors, and locks within the facility","# 1, 2, 3, 4, 5","# 1, 2, 3, 4"]
["C.14",1,1,1,1,null,"13s","164.310(b)","Workstation Use (R)",null,null,null,null,null,null,null," "]
["C.19",1,1,1,1,null,"113s","164.310(c)","Workstation Security (R)",null,null,null,null,null,null,null," "]
["C.22",1,1,1,1,null,"111s","164.310(d)(1)","Device and Media Controls (R)",null,null,null,null,null,null,null," "]
["C.26",1,1,1,1,null,"111s","\n164.310(d)(1)\n164.310(d)(2)(i)","    Disposal (R)","Does the entity have P&P addressing the disposal of data, hardware or electronic media on which ePHI is stored before it is taken out of service and removed?",null,5,{"$f":"IF(OR(K43=\"Yes\",K43=\"Addressible - explain\"),L43, IF(K43=\"Partial\",L43/2, 0))","v":0},{"$f":"IF(K43<>\"\",L43-M43,0)","v":0},null,"Protocol Present","Protocol \n#S41\nONC SRA PH31","Create and implement policies and procedures for destroying data on hard drives, removable media, and any other device containing ePHI before that device is disposed of or taken out of service and removed","# 2, 3, 5","# 1, 2, 3, 4"]
["C.28",1,1,1,1,null,"111s","164.310(d)(2)(ii)","    Media Re-Use (R)","Does entity have P&P established to remove ePHI from reusable electronic media & who is responsible for overseeing these processes?",null,5,0,0,null,"Protocol Present","Protocol \n#S42\nONC SRA PH36","Create policies, procedures and ensure workforce members are responsible for destroying data on hard drives, removable media, and any other device containing ePHI before that device is re-used for another purpose","# 2, 3, 5","# 1, 2, 3, 4"]
["C.29",1,1,1,1,null,"111s, ","\n164.310(d)(2)(iii)","    Accountability (A)","Does entity have P&P to record movement of hardware, electronic media and responsible persons thereof?",null,5,0,0,null,null,"Protocol \n#S43\nONC SRA PH32","Create an inventory tracking procedure that maintains a record of all hardware and electronic media and the associated responsible workforce members that are responsible for them","# 2, 3, 5","# 1, 2, 3, 4"]
["C.32",1,1,1,1,null,"111s","164.310(d)(2)(iv)","    Data Backup and Storage (A)","Does the entity have P&P to create retrievable, exact copy of ePHI before the movement of digital equipment containing ePHI?",null,5,{"$f":"IF(OR(K46=\"Yes\",K46=\"N/A\"),L46, IF(K46=\"Partial\",L46/2, 0))","v":0},0,null," ","Protocol \n#S44\nONC SRA PH38","Create policies and procedures to be able to retrieve an exact copy of ePHI that is created before the movement of digital equipment containing ePHI","# 2, 5","# 1, 3"]
[null," "," "," "," ",null,null,null,null,null,null,{"$f":"SUBTOTAL(109, L35:L46)","v":40},{"$f":"SUBTOTAL(109, M35:M46)","v":0}]
["Section D"," "," "," "," ",null,null,null,null,"TECHNICAL SAFEGUARDS"]
["D.1",1,1,1,1,null,"18s, 101s","164.312(a)(1)","Access Control (R)",null,null,null,null,null,null,null," "]
["D.4",1,1,1,1,null,"107s,114s, 115s","164.312(a)(2)(i)","   Unique User Identification (R)","Does the entity have P&P regarding the assignment of unique user ID for each user accessing ePHI to track each users specific identity?",null,5,{"$f":"IF(OR(K50=\"Yes\",K50=\"Addressible - explain\"),L50, IF(K50=\"Partial\",L50/2, 0))","v":0},{"$f":"IF(K50<>\"\",L50-M50,0)","v":0},null,"Protocol Present","Protocol \n#S46\nSRA ONC T5","Create and implement polices and procedures related to unique user ID and password to access ePHI","# 2, 5","# 1, 3"]
["D.8",1,1,1,1,null,"110s","164.312(a)(2)(ii)","    Emergency Access Procedure (R)","Does the entity have P&P in place and allow access to ePHI during an emergency, a so called 'break the glass' functionality or via another method?",null,5,0,0,null,"Protocol Present","Protocol \n#S47\nONC SRA \nT7","Create policies and procedures for obtaining necessary ePHI during an emergency","# 1, 5","# 1, 3, 4"]
["D.81",2,1,1,1,null,"110s","164.312(a)(2)(ii)","    Emergency Access Procedure (R)","Does the entity define different types of emergencies with access methodologies for each?",null,5,{"$f":"IF(OR(K52=\"Yes\",K52=\"Addressible - explain\"),L52, IF(K52=\"Partial\",L52/2, 0))","v":0},{"$f":"IF(K52<>\"\",L52-M52,0)","v":0},null,"Protocol Present","ONC SRA \nT7, T8","Create policies and procedures for obtaining necessary ePHI during an emergency","# 1, 5","# 1, 3, 4"]
["D.9",1,1,1,1,null,"112s ","164.312(a)(2)(iii)","    Automatic Logoff (A)","Does entity have P&P implemented to automatically terminate an electronic session after a pre-determined period of inactivity?",null,5,0,0,null," ","Protocol \n#S48\nONC SRA T17","Implement technology that terminates users access to ePHI after a predetermined period of inactivity","# 2, 4, 5","# 1, 3, 4"]
["D.12",1,1,1,1,null,"21s, 117s","164.312(a)(2)(iv)","    Encryption and Decryption (A)","Does the entity have P&P implemented to encrypt and decrypt appropriate ePHI according to risk analysis, including processes to protect the confidential process or keys? ",null,5,0,0,null,null,"Protocol \n#S49\nONC SRA T20, T22","Implement procedures to encrypt and decrypt ePHI as deemed appropriate according to risk analysis","# 2, 5","# 1, 3, 4"]
["D.16",1,1,1,1,null,"18s, 115s","164.312(b)","Audit Controls (R)",null,null,null,null,null,null,null," "]
["D.21",1,1,1,1,null,"105s, 117s, ","164.312(c)(1)","Integrity (R)",null,null,null,null,null,null,null," "]
["D.22",1,1,1,1,null,"105s, 117s, ","164.312(c)(2)","    Mechanism to Authenticate Electronic PHI (A)","Does the entity have P&P and technology in place to protect ePHI from improper alteration or destruction? ",null,5,{"$f":"IF(OR(K57=\"Yes\",K57=\"Addressible - explain\"),L57, IF(K57=\"Partial\",L57/2, 0))","v":0},{"$f":"IF(K57<>\"\",L57-M57,0)","v":0},null,null,"Protocol \n#S51\nONC SRA T32","Implement polices, procedures and technology that can prevent ePHI from being altered or destroyed in an unauthorized manner","# 2, 5","# 1, 3, 4"]
["D.221",1,1,1,1,null,"105s, 117s, ","164.312(c)(2)","    Mechanism to Authenticate Electronic PHI (A)","Does the entity have P&P implementing electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner?",null,5,{"$f":"IF(OR(K58=\"Yes\",K58=\"Addressible - explain\"),L58, IF(K58=\"Partial\",L58/2, 0))","v":0},{"$f":"IF(K58<>\"\",L58-M58,0)","v":0},null,null,"Protocol \n#S52\nONC SRA T33","Implement P&P addressing electronic mechanisms to corroborate that ePHI has not been altered or destroyed in an unauthorized manner?","# 2, 5","# 1, 3, 4"]
["D.23",1,1,1,1,null,"18s, 115s","164.312(d)","Person or Entity Authentication (R)",null,null,null,null,null,null,null," "]
["D.26",1,1,1,1,null,"117s","164.312(e)(1)","Transmission Security (R)",null,null,null,null,null,null,null," "]
["D.28",1,1,1,1,null,"117s","164.312(e)(2)(i)","    Integrity Controls (A)","Does the entity have P&P and has implemented technology security controls to ensure that electronically transmitted ePHI cannot be improperly modified without detection until disposed of? ",null,5,{"$f":"IF(OR(K61=\"Yes\",K61=\"Addressible - explain\"),L61, IF(K61=\"Partial\",L61/2, 0))","v":0},{"$f":"IF(K61<>\"\",L61-M61,0)","v":0},null,null,"Protocol \n#S55\nONC SRA \nT39,T41","implement policies, procedures and technology security controls to prevent ePHI from being improperly modified without detection while it is being transmitted over a network","# 2, 5, 6","# 1, 3, 4"]
["D.32",2,1,1,1,null,"117s","164.312(e)(2)(ii)","    Encryption (A)","Does the entity have security controls, including encryption per Federal standards (NIST) to guard against unauthorized access to ePHI transmitted over electronic communications networks (\"Data in Motion\")? ",null,5,0,0,null,null,"Protocol \n#S56\nONC SRA T42","Utilize technology and create procedures to ensure that all ePHI is encrypted per Federal Standards (NIST) while it is being transmitted over the organization's internal LAN (\"Data in Motion\")","# 2, 5","# 1, 3"]
[null," "," "," "," ",null,null,null,null,null,null,{"$f":"SUBTOTAL(109, L49:L62)","v":45},{"$f":"SUBTOTAL(109, M49:M62)","v":0}]
["Section \nE"," "," "," "," ",null,null,null,null,"ORGANIZATIONAL REQUIREMENTS"]
["E.1",1,1,1,1,null,"29s, 39s","164.314(a)(1) ","Business associate contracts or Other Arrangements (R) ",null,null,null,null,null,null,null," "]
["E.2",1,1,1,0,null,"29s, 39s","164.314(a)(2)(i) ","    Business associate contracts (R)"," "]
["E.14",0,0,0,0,"HP","19s","§ 164.314(b)(1) \n§ 164.314(b)(2) ","    Requirements for group Health Plans (R)","Do plan documents require the plan sponsor to reasonably and appropriately safeguard ePHI?",null,3,{"$f":"IF(OR(K67=\"Yes\",K67=\"Addressible - explain\"),L67, IF(K67=\"Partial\",L67/2, 0))","v":0},{"$f":"IF(K67<>\"\",L67-M67,0)","v":0},null,null,null,"Create or update plan documents to require the plan sponsor to reasonably and appropriately safeguard ePHI","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["E.15",0,0,0,0,"HP","19s",null,null,"Do plan documents address the obligation to keep ePHI secure with respect to the plan sponsor’s employees, classes of employees, or other persons who will be given access to ePHI?",null,3,0,0,null,null,null,"Create or update plan documents that address the obligation to keep ePHI secure with respect to the plan sponsor's employees, classes of employees, or other persons who will be given access to ePHI","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
["E.16",0,0,0,0,"HP","19s, 39s",null,null,"Do the plan documents of the group health plan address the issue of subcontractors and other agents of the plan sponsor implementing reasonable and appropriate security measures?",null,3,0,0,null,null,null,"Create or update plan documents of the group health plan to ensure they address the issue of subcontractors and other agents of the plan sponsor implementing reasonable and appropriate security measures","# 1, 2, 3, 4, 5, 6","# 1, 2, 3, 4"]
[null," "," "," "," ",null,null,null,null,null,null,{"$f":"SUBTOTAL(109, L65:L69)","v":0},{"$f":"SUBTOTAL(109, M65:M69)","v":0}]
["Section\nF"," "," "," "," ",null,null,null,null,"POLICIES & PROCEDURES AND DOCUMENTATION REQUIREMENTS"]
["F.1"," "," "," "," ",null,"19s, 19sa","164.316(a)","Policies and Procedures (R)",null,null,null,null,null,null,null," "]
["F.3",1,1,1,1,null,"2s, 19s, 19sa","164.316(b)(1)","Documentation (R)",null,null,null,null,null,null,null," "]
["F.5",1,1,1,1,null,"2s","1634.312(b)\n164.316(b)(2)(i)","   Time Limit (R)","Does the entity have P&P in place regarding the retention of required documentation for six (6) years?",null,5,{"$f":"IF(OR(K74=\"Yes\",K74=\"Addressible - explain\"),L74, IF(K74=\"Partial\",L74/2, 0))","v":0},{"$f":"IF(K74<>\"\",L74-M74,0)","v":0},null,null,"Protocol \n#S70\nONC SRA \nT30, PO4","Create policies to ensure that all HIPAA security documentation is kept for at least 6 years","# 6","# 1"]
["F.6",1,1,1,1,null,"2s","164.316(b)(2)(ii)","    Availability ®","Does the entity have P&P in place requiring that documentation be made available to the workforce members responsible for implementing applicable Security Rule P&P?",null,5,{"$f":"IF(OR(K75=\"Yes\",K75=\"Addressible - explain\"),L75, IF(K75=\"Partial\",L75/2, 0))","v":0},{"$f":"IF(K75<>\"\",L75-M75,0)","v":0},null,null,"Protocol \n#S71","Create and implement policies and procedures to ensure that all HIPAA security documentation is available to all staff responsible for their implementation","# 1, 2, 3, 4, 5, 6","# 1"]
["F.7",1,1,1,1,null,"2s, 19s","164.316(b)(2)(iii)","    Updates (R)","Does the entity have P&P in place to perform periodic reviews and updates to P&P addressing the HIPAA Security Rule?",null,5,{"$f":"IF(OR(K76=\"Yes\",K76=\"Addressible - explain\"),L76, IF(K76=\"Partial\",L76/2, 0))","v":0},{"$f":"IF(K76<>\"\",L76-M76,0)","v":0},null,null,"Protocol \n#S72\nONC SRA \nPO%, PO6","Ensure a process is in place to have all policies and procedures updated as necessary, in response to regulatory, environment, or operational changes","# 1, 2, 3, 4, 5, 6","# 1"]
[" ",null,null,null,null,null,null,null,null,null,null,{"$f":"SUBTOTAL(109, L73:L76)","v":15},{"$f":"SUBTOTAL(109, M73:M76)","v":0}]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Create policies and procedures to ensure that patient provided devices are utilized for patient requested electronic copies of their own PHI","# 5","# 1, 3"]
[null,null,null,null,null,null,null,2,"Identifies  topics of highest importance that need to be addressed first"]
[null,null,null,null,null,null,null,1,"Identifies other lower importance topics that need to be addressed",null,null,null,null,null,null,null,null,"Identify all covered entities."]
[null,null,null,null,null,null,null,0,"identifies topics that have been addressed"]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
["HIDE THIS LINE AND ALL BELOW IT"]
[]
[null,null,null,null,null,null,null,null,"Level 1 (standard)","Covers all standard HIPAA requirements"]
[null,null,null,null,null,null,null,null,"Level 2 (in depth)","A more in depth evaluation with respect to HIPAA requirements"]
[null,null,null,null,null,null,null,null,"Level 3 (audit)","Comparable to a federal (OCR) audit"]
[]
[null,null,null,null,null,null,null,null,"Healthcare Entity Choices "]
[]
[null,null,null,null,null,null,null,"HO","Hospital"]
[null,null,null,null,null,null,null,"HO","Clinic"]
[null,null,null,null,null,null,null,"DO","Physician Office"]
[null,null,null,null,null,null,null,"BA","Business Associate"]
[]
[]
[null,null,null,null,null,null,null,"Yes"]
[null,null,null,null,null,null,null,"No"]
[]
[null,null,null,null,null,null,null,"Level 1"]
[null,null,null,null,null,null,null,"Level 2"]
[]
[null,null,null,null,null,null,null,"Web-based"]
[null,null,null,null,null,null,null,"Client/Server"]

{"sheet":"Action Plan","index":2,"n_rows":54,"n_cols":4,"rows_kept":54,"cut":false,"hidden":false,"merged":[]}
[null,"HIPAA Security Risk Analysis - Action Plan"]
[null,"Based on reviewing your questionairre, identify the key action steps to be taken","PRIORITY","RESOLVED?"]
[null,"If you need more space, just expand the row height."]
[1]
[]
[2]
[]
[3]
[]
[4]
[]
[5]
[]
[6]
[]
[7]
[]
[8]
[]
[9]
[]
[10]
[]
[]
[]
[]
[]
[null,"HIPAA Security Assessment - Acknowledgement"]
[]
[]
[]
[]
[]
[null,"Customer Signature"]
[null,"  "]
[]
[null,"                Print Name"]
[null,"   "]
[]
[null,"                               Date"]
[]
[null,"  Preparer Signature"]
[]
[]
[null,"                Print Name"]
[]
[]
[null,"                              Date"]
[]
[]
[]
[null,null,"High"]
[null,null,"Medium"]
[null,null,"Low"]