Home
Products
Services
About
Blog
Compliance

Home
Products
Services
About
Blog
Compliance

Healthcare Compliance Self-Assessment Tool

This interactive tool is designed to help health providers in Maryland evaluate their compliance with HIPAA, COMAR and other regulations. By answering the questions and calculating your score, you can assess your clinic’s current compliance level and identify areas for improvement

Instructions

Review each question and select "Yes" or "No" based on your current practices.
Tally your scores at the end of each section.
Use the interpretation guide to evaluate your overall compliance level

Section 1:

Patient Privacy and Security (HIPAA)

1. Do you have a documented privacy policy that aligns with HIPAA requirements?

Yes No

2. Are patient records stored securely (e.g., encrypted digital files, locked physical cabinets)?

Yes No

3. Do you regularly conduct risk assessments to identify vulnerabilities in your systems?

Yes No

4. Are staff trained annually on HIPAA privacy and security rules?

Yes No

5. Do you have a protocol for reporting and managing data breaches?

Yes No

6. Do you validate encryption protocols to ensure compliance with the latest standards?

Yes No

7. Are unique and strong password policies enforced for all systems?

Yes No

8. Do you log and review system access activity regularly?

Yes No

Patient Access and Rights

1. Do you provide patients with access to their medical records within 30 days of a request?

Yes No

2. Are you obtaining written authorization before using patient information for non-treatment purposes?

Yes No

3. Do you provide patients with a Notice of Privacy Practices (NPP) upon their first visit?

Yes No

4. Is there a streamlined process for addressing patient grievances regarding their rights?

Yes No

Administrative Safeguards

1. Is there a Privacy Officer designated to oversee compliance efforts?

Yes No

2. Are business associate agreements in place with all PHI-handling vendors?

Yes No

3. Are access controls applied to ensure only authorized staff can view PHI?

Yes No

4. Is an incident response plan documented and updated regularly?

Yes No

5. Do you conduct periodic internal compliance audits?

Yes No

6. Are compliance policies reviewed and revised annually?

Yes No

7. Is there a whistle-blower protection policy to encourage reporting of compliance issues?

Yes No

Physical Safeguards

1. Is access to physical areas containing PHI restricted to authorized personnel?

Yes No

2. Are clean desk policies enforced to secure sensitive information?

Yes No

3. Are PHI-containing devices housed in secure locations?

Yes No

4. Are security cameras installed and monitored in PHI storage areas?

Yes No

5. Are physical security controls reviewed during regular audits?

Yes No

COMAR Compliance

1. Are patient rights and responsibilities prominently displayed?

Yes No

2. Are emergency preparedness plans compliant with state and federal regulations?

Yes No

3. Are record retention and destruction policies aligned with COMAR schedules?

Yes No

4. Are staff trained on Maryland-specific compliance requirements?

Yes No

Operational Compliance

1. Are staff screened against exclusion lists of banned entities regularly?

Yes No

2. Are external audits conducted to ensure compliance?

Yes No

3. Is there a policy to evaluate new software for compliance before implementation?

Yes No

4. Do you have a social media and website compliance policy?

Yes No

Website Compliance

1. Are all forms collecting patient information encrypted?

Yes No

2. Is your website equipped with an SSL certificate?

Yes No

3. Does your website include a HIPAA-compliant privacy policy?

Yes No

4. Are patient testimonials displayed with documented consent?

Yes No

5. Is there a cookie banner informing users about data collection?

Yes No

6. Are tracking tools compliant with HIPAA regulations?

Yes No

7. Is a Business Associate Agreement (BAA) in place for hosting services?

Yes No

Social Media Compliance

1. Are posts free of patient-identifiable information unless consent is documented?

Yes No

2. Are social media accounts managed by HIPAA-trained staff?

Yes No

3. Do posts include disclaimers clarifying non-urgent communication?

Yes No

4. Are reviews responded to without disclosing patient information?

Yes No

5. Is there a policy prohibiting clinical information sharing via direct messages?

Yes No

6. Are third-party tools for social media management HIPAA-compliant?

Yes No

7. Is an audit trail maintained for all social media activities?

Yes No

Compliance Results

Get Compliant Now