A new EHR or IT vendor
Business associate agreements, access controls and transmission security all come up.
Industries / Dental, medical & therapy offices
For dental, medical, chiropractic and therapy practices
Are your HIPAA policies complete, or just a template?
Upload your HIPAA policies, security procedures and office manual. We check them against the HIPAA Privacy, Security and Breach Notification Rules and OSHA's bloodborne pathogens standard, quoting your document wherever it addresses a rule.
When owners use it
The moments your paperwork gets asked for.
A patient complaint or records request
You want your access and complaint procedures to match the 30-day rules.
Opening or growing a practice
New staff need training on policies you can show in writing.
What we check
The rules your documents are checked against.
From the Healthcare Privacy & Security (HIPAA) rule pack. Each finding names the rule it's measured against and, where your document addresses it, quotes your words, checked word for word.
- Privacy officer and security officer named45 CFR 164.530(a); 45 CFR 164.308(a)(2)
- Security risk analysis and risk management45 CFR 164.308(a)(1)(ii)(A) and (B)
- Workforce privacy and security training45 CFR 164.530(b); 45 CFR 164.308(a)(5)
- Sanctions for workforce violations45 CFR 164.530(e); 45 CFR 164.308(a)(1)(ii)(C)
- Notice of Privacy Practices45 CFR 164.520
- Business associate agreements45 CFR 164.502(e); 45 CFR 164.504(e); 45 CFR 164.308(b)
- Minimum necessary use and access45 CFR 164.502(b); 45 CFR 164.514(d)
- Patients' right to access their records45 CFR 164.524
- Privacy complaints process45 CFR 164.530(d) and (g)
- Access controls and audit logs for electronic records45 CFR 164.312(a) and (b)
- Protecting health information sent electronically45 CFR 164.312(e)
- Data backup and disaster recovery45 CFR 164.308(a)(7)
- Breach notification45 CFR 164.400-414
- Keep HIPAA policies and records for 6 years45 CFR 164.530(j); 45 CFR 164.316(b)
- Bloodborne pathogens exposure control plan29 CFR 1910.1030
Plus the basics every employer needs (13 rules)
- OSHA "Job Safety and Health – It's the Law" poster29 CFR 1903.2
- OSHA injury and illness records (Forms 300, 300A, 301)29 CFR Part 1904
- Reporting severe injuries and deaths to OSHA29 CFR 1904.39
- Hazard Communication program29 CFR 1910.1200 (construction: 29 CFR 1926.59)
- Form I-9 employment eligibility verification8 U.S.C. 1324a; 8 CFR 274a.2
- Wage and hour records and minimum wage poster29 CFR Part 516 (poster: 29 CFR 516.4)
- Equal employment opportunity: "Know Your Rights" poster42 U.S.C. 2000e; 29 CFR 1601.30
- Written anti-harassment and complaint procedureEEOC Enforcement Guidance on Harassment in the Workplace (2024)
- Family and Medical Leave Act notices29 CFR 825.300
- EEO-1 Component 1 annual report29 CFR 1602.7
- Workers' compensation insuranceState workers' compensation law (varies by state)
- Business licenses and permits kept currentState and local licensing law (varies)
- General liability insurance kept currentContract / licensing requirement (varies)
We check your written policies, not your computers or network. Please don't upload patient records: the check only needs your policies.
Deep checks
Go point by point on one topic.
A deep check reads all of your documents against one topic the way an inspector would go down a checklist, and marks each point met, partial or missing. Topics for this industry:
HIPAA Security RuleHIPAA Privacy Rule and breach notificationBloodborne pathogensEmergency plans, exits and fire extinguishers
Deep checks come with the One-Time Report and the monthly plans.
What to upload
Start with the documents you already have.
- HIPAA privacy and security policies
- Notice of Privacy Practices
- Risk analysis
- Exposure control plan
- Office or employee handbook
PDF, Word or plain text. Please don't upload personnel files, patient records or anything with Social Security numbers: the check only needs your policies and programs.
Compliance information and organizing tools, not legal advice. Have your safety or HR person confirm the findings that matter most.
Other industries