For medical, dental and therapy practices
HIPAA, worked through one task at a time.
The HIPAA Security Rule written as 30 tasks, each tied to its section of the regulation, with plain-English guides and the documents a small practice is expected to keep.
- 14-day free trial
- No credit card
- Cancel anytime
From the HIPAA checklist
- Conduct a HIPAA Risk Analysis (§164.308(a)(1)(ii)(A))
- Maintain written policies and procedures (§164.316)
- Implement person/entity authentication (§164.312(d))
- Document a Breach Notification procedure (§164.404-414)
- Implement device and media disposal procedures (§164.310(d)(2)(i))
Each task comes with a plain-English guide.
01Why it matters
What's already being asked of you.
01
A risk analysis is required, not optional
The Security Rule requires a documented risk analysis. Secure-Stack walks you through it with a worksheet and keeps the finished version on file.
02
Every vendor touching patient data needs a BAA
Billing services, IT providers and cloud apps that handle ePHI need a business associate agreement. Track them alongside the rest of your work.
03
Staff come and go
Access, training and sanctions each have their own tasks, so onboarding and departures leave a record instead of relying on memory.
02What's included
Frameworks that fit how you work.
These are the frameworks that matter most for you. Starter includes one of your choice; Pro and above include all of them.
30 tasks
HIPAA
Risk management, workforce and access, physical and technical safeguards, BAAs and breach response, audit and monitoring.
30 tasks
Cyber Insurance Readiness
The controls insurers ask about on applications and renewals: MFA, backups, email security, incident response.
85 tasks
CIS Controls v8
A widely used baseline for securing the devices, accounts and networks your practice runs on.
HIPAA document templates
- HIPAA Risk Analysis Worksheet
- Business Associate Agreement (BAA)
- Notice of Privacy Practices (NPP)
- Workforce Confidentiality Agreement
- HIPAA Sanction Policy
- Workstation Use and Security Policy
03How it works
Three steps, at your own pace.
1
Answer a few questions
A short questionnaire at signup recommends the frameworks that apply to your business. Add or remove any of them later.
2
Work through the tasks
Each task says what to do and why, with a guide written for people without an IT background. Invite teammates or your IT provider to work through them with you.
3
Keep the evidence
Attach screenshots, documents and notes to each task as you finish it. When a processor, insurer, client or auditor asks, export it.
04Good to know
Questions we hear.
What Secure-Stack doesn't do
There is no official HIPAA certification, and Secure-Stack does not provide one or give legal advice. It helps you do the work the Security Rule asks for and keep the records that show you did.
- Should we put patient information in Secure-Stack?
- No. Secure-Stack is built to hold your compliance records, policies and evidence, not patient charts. Keep patient information in your practice management or EHR system.
- We're a three-person practice. Is this too much?
- The HIPAA framework is 30 tasks, and each one has a plain-English guide written for people without an IT background. You can invite your IT provider to work on tasks with you.
Start with the HIPAA checklist today.
From $50 a month, with a 14-day free trial and no credit card.