CompyMax
Sign inStart free trial

Intake questionnaire

45 questions in 5 parts, 37 of them required. Most practice managers finish in thirty to forty-five minutes. Nothing is saved until you submit, so set aside the time or keep the tab open. If you have not ordered yet, that is fine: the answers are kept for you either way.

Do not enter patient information.

This questionnaire asks about your systems, vendors, devices, procedures and history, never about a patient. Do not include any patient’s name, record number, diagnosis, dates of care or anything else that identifies a person you treat. A risk assessment does not need it, this site is not built to hold it, and anything of the kind that arrives by mistake is deleted.

Contact

Part 1 of 5

Practice profile

What kind of organization this is and how big the assessment needs to be. Scope is the first thing a risk analysis has to get right.

  1. 1.What kind of organization are you?
  3. 3.How many physical locations handle patient information?
  4. 4.How many people work in the practice, including part-time staff and contractors with system access?
  5. 5.Who is the designated security official?

    The Security Rule requires one named person to be responsible. A role is enough here, not a name.

  6. 6.Are you a covered entity, a business associate, or both?

    A provider that bills electronically is a covered entity. A billing company is a business associate of its clients.

  7. 7.Do you bill Medicare and report under MIPS?

    MIPS attestation requires a security risk analysis each performance year.

  8. 8.Who manages your IT day to day?
  9. 9.Does anyone access patient information from outside the office?

Part 2 of 5

ePHI systems and vendors

Every system that creates, receives, stores or sends electronic patient information, and the vendors behind them. Name the products; do not describe any patient.

  4. 13.Is patient information ever sent by email?
  6. 15.How do you send and receive faxes?
  10. 19.Do you have a signed business associate agreement with each vendor that handles patient information?
  11. 20.Is there a list of those vendors and where each agreement is filed?

Part 3 of 5

Devices and access

The computers, phones and accounts through which patient information is reached, and how access is granted and taken away.

  3. 23.Are laptops, desktops and mobile devices encrypted?
  4. 24.Is multi-factor authentication required on the EHR and on email?
  5. 25.Does every person have their own login, or are any accounts shared?
  8. 28.Is patient-facing or guest Wi-Fi separated from the practice's own network?
  10. 30.How are operating system and software updates applied?

Part 4 of 5

Policies and training

The written programme: what exists, when it was last read, and whether the workforce has been trained on it. The Security Rule requires documentation to be kept for six years.

  2. 33.When were the policies last reviewed or updated?
  3. 34.Has every workforce member completed HIPAA training in the last twelve months, with a record kept?
  4. 35.Is there a written sanction policy for workforce members who break the rules?
  5. 36.Is there a written contingency or disaster-recovery plan, and has it been tested?
  6. 37.Is there a written incident-response procedure that says what to do and whom to call?
  7. 38.How often is the list of who has access to what reviewed?

Part 5 of 5

Incidents and prior assessments

What has already been done and what has already gone wrong. Describe events in general terms, never identify a patient.

  2. 41.If so, was there a remediation plan, and was it worked through?
  4. 43.Has the practice ever reported a breach to HHS, or received a complaint or inquiry from OCR?

0 of 45 answered · 37 are required. Nothing has been sent yet.

Before you submit: check that no answer names or describes a patient. The questionnaire is about your systems and procedures only.

Your answers are stored so the assessment can be prepared and are emailed to the team working on it. They are not used for anything else and are deleted on request. See our privacy policy. The assessment itself is a compliance deliverable, not legal advice.