Training, exams and certification
Training, exams and certification
Sixty-four requirements on 45 CFR Parts 160 and 164 for small practices, clinics and health-tech vendors, with every Security Rule specification marked as Required or Addressable, and nothing to install.
Reviewed by GoToCertify’s Subject Matter Expert ·
Scope and ePHI inventory; the administrative, physical and technical safeguards of the Security Rule; business associate contracts; policies and six-year documentation; the Breach Notification Rule with its 60-day limit and the 500-individual threshold; the Privacy Rule duties a security assessment normally touches (minimum necessary, notice of privacy practices, access, accounting); enforcement and the civil money penalty tiers.
A first question asks whether the organisation is a covered entity or only a business associate, and excludes the duties that apply only to covered entities. Once unlocked, the tool produces Word drafts of a security risk analysis and risk management report, with the decisions on the Addressable specifications, a breach risk assessment form and the register of required documents.
Regulatory status: snapshot of 13 November 2026, based on the eCFR text of 45 CFR Parts 160 and 164. The proposed rule to modify the Security Rule (90 FR 898, 6 January 2025) has not been adopted: the current Security Rule remains in effect.
Nothing is sent to our servers: the answers stay in the browser, and you can download a save file to resume later or share with colleagues.
Free and paid: The questionnaire, the dashboard with the overall score and the score by area, and a summary PDF are free, with no account. Unlocking one assessment costs €18 including VAT for 45 days, with no subscription; GoToCertify Pro unlocks every assessment for €39, and whoever has already unlocked single assessments pays only the difference. Unlocking adds compliance guidance on every requirement, the full action plan, the detailed dashboard (by source, by control and gaps by area), the full PDF report with your logo, the evidence tracker, comparison with a previous baseline, the Excel export and Word document drafts pre-filled from the answers; the cross-framework view is included in Pro. The access link arrives by email after payment through Stripe.
Security officials, privacy officials and practice managers of US covered entities, and CTOs and compliance leads of business associates such as health-tech, cloud and billing vendors, including European companies that serve US healthcare customers.
The assessment is part of the GoToCertify Compliance Self-Assessment Hub, which also covers the EU AI Act, the GDPR, NIS2, DORA, NIST CSF 2.0 and SOC 2 readiness.
No. It shows where the safeguards stand and structures the report, but the risk analysis must cover the systems, threats and vulnerabilities of your own organisation.
An Addressable specification must be assessed: implement it if reasonable and appropriate, otherwise document why and implement an equivalent alternative where reasonable and appropriate (45 CFR 164.306(d)(3)).
The questionnaire, the dashboard with the score by area and the summary PDF are free. Unlocking this assessment (18 euro including VAT for 45 days) adds guidance, the full action plan, the full report and the Word document drafts; GoToCertify Pro (39 euro) unlocks every assessment.
Free questionnaire, no registration, nothing to install, summary PDF included.
Start the HIPAA assessment
BITIL.COM is an ATO (Accredited Training Organization) and an AEO (Approved Examination Organization) of PeopleCert. PRINCE2® and PRINCE2 Agile® are registered trade marks of PeopleCert.
